AWS Cloud Practitioner cheat sheet

Six advantages of cloud: trade capital expense for variable expense, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending money running data centers, go global in minutes.

Shared Responsibility Model: AWS is responsible for security OF the cloud (facilities, hardware, managed service software); the customer is responsible for security IN the cloud (data, IAM, guest OS patching, network configuration).

Deployment models: public (fully on AWS), private (single organization, on-premises or hosted), hybrid (connected mix of on-premises and cloud).

NIST essential characteristics of cloud: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service.

Service models: IaaS exposes raw compute/storage/network (EC2, EBS); PaaS abstracts servers (Elastic Beanstalk, RDS); SaaS delivers finished applications (WorkMail).

Scaling up/down is vertical (larger instance type); scaling out/in is horizontal (more instances). Elasticity automates horizontal scaling to match demand.

High availability uses multiple Availability Zones inside one Region; disaster recovery adds a second Region. A Region contains two or more AZs; an AZ contains one or more data centers.

Well-Architected Framework pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

IAM policy evaluation order: an explicit Deny always overrides; otherwise an explicit Allow is required; anything not allowed is implicitly denied.

Security groups are stateful, instance-level, and allow-only. Network ACLs are stateless, subnet-level, support allow and deny, and are evaluated in numbered rule order.

Root user hardening: enable MFA, delete or rotate access keys, never use it for daily tasks; use IAM roles for AWS services and cross-account access.

AWS Artifact provides AWS compliance reports (SOC, ISO, PCI) and self-service agreements such as the BAA; compliance of customer workloads remains the customer's responsibility.

Detection services: GuardDuty = threat detection, Inspector = vulnerability scanning, Macie = sensitive data discovery in S3, Config = configuration compliance, Security Hub = aggregated findings.

Protection services: Shield Standard (free, automatic DDoS), Shield Advanced (paid, response team), WAF (HTTP/S exploit filtering), Firewall Manager (central rule management across accounts).

Encryption: in transit with TLS; at rest with KMS managed keys, CloudHSM dedicated hardware, or S3 server-side options SSE-S3, SSE-KMS, and SSE-C.

CloudTrail records API activity for audit and investigation; CloudWatch Logs stores application and system logs; both commonly supply compliance evidence.

Compute selection: EC2 for full server control, Lambda for event-driven serverless code (15-minute maximum), Fargate for serverless containers, ECS/EKS for orchestration, Elastic Beanstalk for PaaS-style deployment.

Storage mapping: S3 = object storage (regional, effectively unlimited); EBS = block volumes (single AZ, one instance); EFS = Linux NFS file system (multi-AZ); FSx = Windows SMB or high-performance Lustre.

S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive; lower cost trades against retrieval speed.

Databases: RDS/Aurora = managed relational (Multi-AZ for availability, read replicas for read scaling); DynamoDB = NoSQL key-value; Redshift = data warehouse; ElastiCache = in-memory cache; Neptune = graph.

Load balancers: ALB for layer 7 HTTP/HTTPS routing, NLB for layer 4 TCP/UDP performance, GWLB for third-party appliances. Route 53 provides DNS; CloudFront provides CDN caching.

VPC building blocks: public and private subnets, route tables, internet gateway, NAT gateway for private egress, security groups, network ACLs, VPC peering, and VPC endpoints.

Management and governance: CloudWatch (metrics, logs, alarms), CloudFormation (infrastructure as code), Systems Manager (patching, run command), Trusted Advisor (best-practice checks), AWS Config (configuration history).

Integration services: SQS = decoupled queues, SNS = pub/sub fan-out, EventBridge = event bus with rules, Step Functions = workflow orchestration, Kinesis = real-time streaming ingestion.

Pricing fundamentals: compute is billed per second with a 60-second minimum for Linux and Windows, storage per GB-month, and data transfer OUT to the internet per GB; inbound transfer is generally free.

EC2 purchase options: On-Demand (no commitment), Reserved Instances or Savings Plans (1-3 year commitment), Spot (steep discount, interruptible), Dedicated Hosts (licensing and compliance needs).

Savings Plans: Compute Savings Plans cover EC2, Fargate, and Lambda across families and Regions; EC2 Instance Savings Plans lock to one family in one Region for a deeper discount.

Cost tools: Pricing Calculator estimates a design before deployment; Cost Explorer visualizes and forecasts actual spend; Budgets sends threshold alerts; Cost and Usage Report gives the most granular line-item data.

AWS Organizations consolidated billing: one payer account, one bill, aggregated usage for volume discounts, and shared Reserved Instance and Savings Plan benefits across member accounts.

Support tiers: Basic is free with 7 core Trusted Advisor checks and billing support; Developer adds business-hours email; Business adds 24/7 access, full Trusted Advisor, and a 4-hour production-down response.

Enterprise On-Ramp has a minimum of about $5,500 per month with a 30-minute business-critical response and a pool of Technical Account Manager hours; Enterprise has a minimum of about $15,000 per month with a 15-minute response and a designated TAM.

Free Tier categories: always-free allowances (for example 1 million Lambda requests per month), 12-month introductory limits (for example 750 hours of a micro EC2 instance), and short-term trials; usage beyond limits bills at on-demand rates.