ACE-Specialist cheat sheet

RTO is the maximum tolerable elapsed recovery time; RPO is the maximum tolerable data loss measured in time. Backup or replication frequency must be at least as often as the RPO requires.

Multi-AZ removes single-datacenter failure while keeping one Region; multi-Region adds latency-based failover but introduces cross-Region replication lag and data-residency obligations.

Synchronous replication yields near-zero RPO and higher write latency; asynchronous replication lowers latency at the cost of a nonzero RPO equal to the replication lag.

Loose coupling through queues or event buses is the correct choice when producer and consumer have different scaling profiles or availability requirements.

A stateless application tier scales horizontally only if session state is externalized to a cache or database so that any instance can serve any request.

Readiness signals gate traffic; liveness signals trigger restarts. Both must be exposed distinctly, otherwise load balancers send traffic to instances that cannot serve it.

Managed services are preferred when operational overhead dominates the decision; self-managed is justified only by kernel-level control, unsupported versions, or specific licensing.

Every architecture decision trades cost against resilience and performance; record the accepted risk for each deviation from the reference design so later reviewers can challenge it.

Blue/green switchover is reversible only if the previous stack stays deployed and warm during the bake period; scaling it down early removes the fast rollback path.

Canary releases shift a small traffic percentage first and automate promotion or rollback on measured error-rate and latency thresholds against the baseline version.

Rolling updates with zero unavailable instances require spare capacity headroom in the node pool or cluster; otherwise the rollout stalls or degrades service.

Artifacts identified by content digest are reproducible; mutable tags such as latest break rollback determinism because the same reference resolves to different bits over time.

Schema changes must be backward compatible across the rollout window: expand by adding structures, backfill and dual-write, then contract by removing old structures after no code references them.

A standard pipeline runs build, unit test, artifact signing, staging deployment, integration test, then a progressive production rollout of the identical artifact.

Feature flags decouple deploy from release, enabling dark launches and an instant kill switch without rebuilding or redeploying the application.

Provision network, identity, and data stores before compute; express the ordering explicitly through dependencies or separate layered state rather than implicit timing.

Least privilege means the smallest action set on the narrowest resource scope; prefer roles that issue temporary credentials over long-lived access keys.

Enforce encryption in transit with TLS 1.2 or later and at rest with a managed key service; define and audit a key rotation interval.

Separate the control-plane or management account from workload accounts so a compromised workload cannot disable organization-level guardrails or audit logging.

Federate workforce identity through SAML or OIDC so joiners, movers, and leavers are handled in the identity provider; require MFA on all privileged roles.

Secrets belong in a managed secret store with automatic rotation; infrastructure state files often contain plaintext secrets and must be treated as sensitive data.

Defense in depth layers independent controls: edge filtering, network segmentation, private subnets for data stores, and egress restrictions.

Control-plane and access logs must be shipped to a separate, write-once account with retention matching the compliance regime and delete rights restricted from workload owners.

An SLI is a measured ratio such as successful requests over total requests; the SLO is its target; the error budget is one minus the SLO and gates release velocity.

Alert on user-visible symptoms through SLO burn rate rather than on causes such as CPU percentage, which produces noise without indicating customer impact.

The four golden signals are latency, traffic, errors, and saturation; instrument each per service before adding specialized metrics.

Multi-window burn-rate alerts combine a short fast window for sudden outages with a longer slow window for gradual degradation, reducing both false positives and misses.

Distributed tracing with propagated correlation identifiers localizes latency across service hops; aggregated logs alone rarely reveal the critical path.

Metric labels must stay low-cardinality; identifiers such as user or request IDs belong in logs and traces, where they do not multiply time series.

Each alert needs a runbook covering detection signal, diagnosis steps, and rollback action, validated during game days rather than written after the first outage.

Post-incident review is blameless, distinguishes the trigger from contributing causes, and produces tracked action items with owners and due dates.

Declarative tooling converges infrastructure to a desired state and is idempotent; imperative scripts encode steps and typically are not safe to re-run unchanged.

Remote state with locking prevents concurrent applies from corrupting the same state file; enable object versioning on the state bucket as a recovery path.

State maps configuration to real resource identifiers and frequently contains sensitive values, so it must be encrypted, access-restricted, and never committed to version control.

Review the plan before every apply; any plan that destroys or replaces a stateful resource such as a database requires explicit review and usually a prevent-destroy lifecycle guard.

Modules encapsulate reusable components; pin module and provider versions so an upstream release cannot silently change a production plan.

Every automation task must be safe to re-run: use ensure-present semantics and treat a repeated execution as a no-op rather than an error.

Schedule periodic refresh and plan against production to detect drift introduced by manual console changes before it affects the next deployment.

Promote the same built artifact through environments using one pipeline definition with per-environment parameters, rather than rebuilding separately per stage.

Enforce mandatory tags such as owner, environment, cost center, and data classification at creation time through policy-as-code; untagged resources are reported and remediated rather than tolerated.

Showback and chargeback depend on a consistent account, subscription, or project hierarchy mapped one-to-one onto cost centers.

Cost levers in order of typical impact: eliminate idle and orphaned resources, rightsize over-provisioned instances, commit for steady-state baseline, and use interruptible capacity for tolerant workloads.

Storage lifecycle rules transition data to colder tiers by access age and expire noncurrent versions according to compliance retention, not storage convenience.

Budgets and anomaly detection must alert on both forecast and actual thresholds and route to the owning team, not a central mailbox.

Organization-level policy guardrails that deny public buckets, restrict Regions, and require encryption prevent noncompliance at the source instead of detecting it afterwards.

Track unit economics such as cost per transaction or per tenant to separate growth-driven spend from efficiency loss.