ACE-Professional cheat sheet

Cloud deployment models: public, private, hybrid, and community; each differs in tenancy, control, and connectivity boundaries.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated horizontal or vertical scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with eventual or strong consistency per provider, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.

Shared responsibility model: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations, guest OS).

Elasticity = automated scaling to match demand; scalability = the ceiling of capacity a design can reach.

High availability uses redundancy within a region (multiple zones); disaster recovery uses a separate region and is measured by RTO (time to recover) and RPO (tolerable data loss).

Fault tolerance requires no interruption on component failure; HA tolerates brief failover; DR tolerates extended outage with defined data loss.

Well-architected pillars typically include operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Loose coupling via queues and events isolates components so a failure in one tier does not cascade to others.

Multi-region active-active lowers RTO to near zero but multiplies cost and requires data replication and conflict-resolution design.

Compute selection rule: short-lived event-driven tasks -> serverless functions; steady predictable load -> reserved or committed VMs; bursty containerized workloads -> managed container orchestration.

Vertical scaling changes instance size (more vCPU/RAM); horizontal scaling adds instances and requires stateless or externally stored session state.

Autoscaling policies: target tracking (hold a metric at a target), step scaling (tiered thresholds), and scheduled scaling (known traffic patterns).

Containers share the host kernel and package app plus dependencies; VMs include a full guest OS and therefore have higher per-instance overhead.

Serverless functions have execution time limits, cold-start latency, and ephemeral local storage; persistent state must go to external services.

Load balancer health checks remove unhealthy targets from rotation; connection draining lets in-flight requests finish before removal.

Batch vs stream: batch processes bounded datasets on a schedule; stream processes unbounded events continuously with low latency.

Spot/preemptible capacity is cheapest but can be reclaimed; use it for interruptible, checkpointed, or fault-tolerant workloads only.

Storage tiers by access pattern: hot/standard for frequent access, infrequent-access for monthly reads, archive for retrieval in hours, deep archive for compliance retention.

Object storage is key-value with provider-defined consistency, unlimited scale, and HTTP access; block storage attaches to a single compute instance; file storage is shared over a network protocol.

Durability is the probability data is not lost (often expressed as nines of 9s); availability is the fraction of time the data is reachable.

Lifecycle policies transition objects between tiers or expire them based on age, prefix, or tags, cutting cost without application changes.

RAID 0 stripes with no redundancy; RAID 1 mirrors; RAID 5 tolerates one disk failure; RAID 6 tolerates two; RAID 10 combines mirroring and striping.

Snapshots are incremental point-in-time copies; replication copies continuously to another location and has a smaller RPO than periodic snapshots.

Backup 3-2-1 rule: three copies, on two media types, with one copy offsite; immutability (object lock) protects against ransomware deletion.

Choosing a database: relational for transactions and joins; key-value for low-latency lookups; document for flexible schemas; wide-column for huge write throughput; graph for relationship traversals.

CIDR: a /24 has 256 addresses, a /16 has 65,536; usable host count is 2^(32-prefix) minus reserved addresses (network, broadcast, and provider-reserved).

A subnet is confined to one availability zone; spanning zones requires a route table entry or a load balancer across subnets.

Security groups are stateful (return traffic auto-allowed) and allow-only; network ACLs are stateless and support explicit allow and deny rules, evaluated in order.

Private connectivity options: VPN over the public internet (encrypted, variable latency) vs dedicated private circuit (consistent latency, higher cost).

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias to a name), MX (mail), TXT (verification/policy), and alias records that point to provider resources without extra lookups.

A NAT gateway lets private-subnet instances initiate outbound internet traffic while blocking inbound connections.

Anycast routes the same IP to multiple locations and directs users to the nearest edge; useful for global latency reduction and DDoS absorption.

VPC peering connects two networks directly and is non-transitive; a transit gateway or hub model scales many-to-many connectivity.

Least privilege: grant the minimum actions on the minimum resources under the minimum conditions; prefer roles and temporary credentials over long-lived access keys.

Identity federation uses standards such as SAML 2.0 or OIDC so users authenticate with an external IdP and receive short-lived role credentials.

Encryption at rest uses provider-managed or customer-managed keys; envelope encryption wraps data keys with a root key held in a KMS/HSM.

Encryption in transit uses TLS; certificate management and rotation prevent expiry outages.

Defense in depth layers identity, network, host, application, and data controls so one failed layer does not expose the system.

Logging and audit trails (API call logs, flow logs, access logs) are required evidence for most compliance frameworks and should be immutable and centrally retained.

Compliance frameworks map controls to requirements: SOC 2 (trust services), ISO 27001 (ISMS), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Secret management: store credentials in a managed secrets service with rotation; never embed them in code, images, or environment files committed to source control.

The four golden signals are latency, traffic, errors, and saturation; alert on symptoms users feel rather than on every raw metric.

SLI is a measured indicator, SLO is the target for that indicator, and the error budget is 1 minus the SLO - spending the budget funds releases.

Infrastructure as code makes environments reproducible and reviewable; state files must be locked and stored remotely, not on a laptop.

Deployment strategies: rolling (gradual replace), blue/green (parallel environment swap, instant rollback), canary (small traffic slice first).

Cost levers: rightsizing, eliminating idle resources, reserved/savings commitments for steady load, spot for interruptible work, and lifecycle tiering for storage.

Tagging by cost center, environment, and owner enables chargeback and identifies orphaned resources; untagged spend is unattributable.

Total cost of ownership includes compute, storage, egress, licensing, and staff time - data transfer out is a commonly underestimated line item.

Observability combines metrics (aggregated numbers), logs (discrete events), and traces (request paths) to diagnose distributed failures.