Alibaba Cloud Architect Professional cheat sheet

ECS instance families: g-series general purpose, c-series compute optimized, r-series memory optimized, e-series economical; pick by vCPU-to-memory ratio, not by price alone.

SLB types: CLB (classic, L4/L7), ALB (application, advanced L7 routing, HTTP/HTTPS/gRPC), NLB (network, L4, high throughput, static IP).

Multi-AZ is the default HA pattern: place ECS and RDS across zones within one region; cross-region is for DR, not HA.

RDS read/write splitting requires a read-only instance plus a proxy or application-level routing; read-only instances have replication lag.

Auto Scaling triggers: scheduled, dynamic (metric-based like CPU or QPS), and fixed; combine with SLB and scaling groups for elastic tiers.

Decoupling patterns: use Message Queue (RocketMQ/Kafka) for async, OSS for large object offload, and Redis for session and hot-data caching.

VPC design: one VPC per environment, /16 CIDR, subnets per zone, NAT Gateway for egress, and VPC peering or CEN for cross-VPC connectivity.

Serverless fit: Function Compute for event-driven bursty workloads with sub-second billing; not for long-running stateful services.

Migration tooling: SMC (Server Migration Center) for P2V/V2V server migration, DTS for database migration, OSS Data Online Migration for object storage.

Cutover decision rule: run full sync, then incremental sync, validate with checksums or row counts, then switch DNS or SLB backend at low-traffic window.

Deployment strategies: blue-green (two identical stacks, switch SLB), canary (weighted routing via ALB), rolling (batch replace in scaling group).

Infrastructure as Code: Terraform or ROS (Resource Orchestration Service) templates for repeatable VPC/ECS/RDS provisioning across environments.

Container deployment: ACK (Kubernetes) for orchestration, ACR for image registry, and ACK Serverless for burst capacity without node management.

Hybrid connectivity options: VPN Gateway (IPsec, cheaper, internet-dependent), Express Connect (dedicated line), Smart Access Gateway (branch sites).

Database migration: DTS supports full plus incremental migration with minimal downtime; schema conversion needed for heterogeneous engines.

Rollback readiness: keep prior image tags, snapshot RDS before cutover, and retain old DNS TTL low (e.g., 60s) during migration window.

Monitoring stack: CloudMonitor for metrics and alarms, SLS (Log Service) for log collection and query, ARMS for APM and tracing.

Cost levers: reserved instance / savings plan for steady state, pay-as-you-go for spiky, spot instances for fault-tolerant batch, right-size via CloudMonitor CPU/memory data.

Storage tiering: OSS Standard, Infrequent Access, Archive, Cold Archive, Deep Cold Archive - retrieval time and minimum storage duration increase as tier cools.

Auto Scaling cooldown prevents thrash: set cooldown >= instance boot time plus application warm-up; use target tracking for smoother scaling.

Backup and DR: RDS automated backups plus log backups for point-in-time recovery; use HBR (Hybrid Backup Recovery) for ECS and on-prem.

Elasticity optimization: schedule scale-in during off-peak, use SLB health checks to drain unhealthy nodes, and set connection draining before removal.

Availability metrics: define RTO (recovery time objective) and RPO (recovery point objective); multi-region active-passive meets higher RTO than single-region multi-AZ.

Tagging and cost allocation: enforce tags (env, owner, project) to split bills by cost center and identify idle resources.

Identity model: RAM users, groups, roles, and policies; use roles with STS temporary credentials for cross-account and service-to-service access instead of long-term AKs.

Least privilege: grant by specific Action and Resource ARN in RAM policy statements; avoid wildcard '*' on Action or Resource in production.

Network security: Security Groups are stateful instance-level firewalls; NACLs are stateless subnet-level; combine with WAF for L7 and Anti-DDoS for L3/L4.

Data encryption: KMS for key management and envelope encryption; OSS and RDS support server-side encryption with KMS-managed keys.

Secrets handling: store credentials in KMS Secrets Manager or Parameter Store; never hardcode AK/SK in code or images.

Audit and compliance: ActionTrail records API calls, Config evaluates resource compliance rules, and SLS centralizes security logs for retention.

Compliance frameworks: MLPS (China multi-level protection scheme) levels 1-4, ISO 27001, and PCI DSS map to specific controls like encryption, logging, and access review.

Threat detection: Security Center (Cloud Security Center) provides baseline checks, vulnerability scanning, and anomaly detection across ECS and containers.