AWS CloudOps Engineer (SOA-C03) cheat sheet

CloudWatch metric retention: 1-minute data for 15 days, 5-minute for 63 days, 1-hour for 455 days; longer periods are aggregated, not raw.

Detailed (1-minute) monitoring must be enabled per EC2 instance; default basic monitoring publishes every 5 minutes.

CloudWatch Alarms evaluate three states: OK, ALARM, INSUFFICIENT_DATA; alarm actions fire on state transitions, not on every breaching datapoint.

Metric math lets one alarm combine metrics (e.g., errors/requests); composite alarms combine alarm states with AND/OR logic to reduce noise.

CloudWatch Logs subscription filters stream matching log events to Kinesis, Firehose, or Lambda for real-time processing.

Logs Insights queries scan only the selected log groups over the chosen time range; query results are billed by data scanned.

EventBridge rules match event patterns and route to targets; a rule can schedule cron/rate expressions to trigger remediation Lambda functions.

AWS Config conformance packs evaluate managed and custom rules across accounts; remediation actions can be automatic or manual.

CloudTrail management events are logged by default; data events (S3 object-level, Lambda invoke) must be enabled separately and cost extra.

RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss window. Both drive backup, replication, and DR strategy choice.

Backup strategy order by cost/recovery speed: backup and restore, pilot light, warm standby, multi-site active-active.

S3 durability is 99.999999999% (11 nines) for objects; cross-region replication requires versioning on source and destination buckets.

EBS snapshots are incremental and stored in S3-managed storage; the first snapshot is full, later ones capture changed blocks.

AWS Backup centralizes backup plans, vault lock (WORM), and cross-region copy across EBS, RDS, EFS, DynamoDB, and FSx.

Multi-AZ RDS provides synchronous standby failover; read replicas are asynchronous and do not provide automatic failover by themselves.

Route 53 health checks plus failover routing implement active-passive DNS failover; health checks can evaluate endpoint, calculated, or CloudWatch alarm status.

Auto Scaling groups should span multiple AZs; capacity rebalancing and instance refresh replace unhealthy or outdated instances.

CloudFormation change sets preview resource changes before execution; drift detection reports resources whose actual config diverges from the template.

StackSets deploy the same template to multiple accounts and regions from a single administrator account.

DeletionPolicy Retain preserves a resource when its stack is deleted; UpdateReplacePolicy controls behavior on replacement updates.

CodeDeploy deployment types: in-place (EC2/on-premises) and blue/green (EC2, ECS, Lambda); lifecycle hooks run scripts at specified stages.

CodePipeline stages contain actions; manual approval actions pause the pipeline until an IAM principal approves.

AWS SAM builds on CloudFormation for serverless; sam deploy packages code to S3 and creates or updates the stack.

SSM Parameter Store holds plaintext and SecureString values; Secrets Manager adds automatic rotation and cross-account access.

SSM Run Command executes commands on managed instances without SSH; Session Manager provides shell access with no inbound ports or bastion.

IAM policy evaluation: explicit Deny overrides any Allow; absence of an Allow is an implicit deny.

Permission boundaries cap the maximum permissions an IAM entity can have but do not grant permissions by themselves.

SCPs apply to accounts in an AWS Organization and limit maximum permissions; they do not grant access and do not affect the management account.

KMS key policies are the primary access control for KMS keys; IAM policies alone are insufficient unless the key policy delegates to IAM.

S3 Block Public Access has four settings; account-level settings override bucket-level settings.

GuardDuty detects threats from logs (VPC Flow, DNS, CloudTrail); Security Hub aggregates findings; Inspector assesses vulnerabilities.

Macie discovers and classifies sensitive data such as PII in S3 using machine learning.

Secrets Manager rotation uses a Lambda rotation function; automatic rotation is native, unlike Parameter Store.

AWS Artifact provides on-demand compliance reports (SOC, ISO, PCI) and agreements such as the BAA.

Security groups are stateful and allow-only; network ACLs are stateless, allow and deny, and evaluate rules in numeric order.

A VPC peering connection is non-transitive; a transit gateway provides hub-and-spoke transitive routing between VPCs and on-premises.

NAT Gateway enables outbound internet for private subnets; it is AZ-scoped, so deploy one per AZ for high availability.

VPC endpoints: gateway endpoints (S3, DynamoDB) use route tables and are free; interface endpoints use ENIs and are billed hourly plus data.

Route 53 routing policies: simple, weighted, latency, failover, geolocation, geoproximity, and multivalue answer.

CloudFront caches at edge locations; origin failover uses origin groups, and signed URLs/cookies restrict private content.

ALB operates at Layer 7 (path/host routing, WebSocket); NLB operates at Layer 4 with static IPs and extreme performance.

Direct Connect is a dedicated private connection; Site-to-Site VPN is IPsec over the internet and can back up Direct Connect.

Savings Plans (Compute) discount up to 66% in exchange for 1- or 3-year commitment; Reserved Instances apply to specific instance families.

Spot Instances offer up to 90% discount but can be interrupted with a 2-minute notice; use for fault-tolerant, stateless workloads.

S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive.

S3 Lifecycle rules transition objects between classes and expire them; minimum storage durations apply (e.g., 30 days for Standard-IA).

Compute Optimizer and Trusted Advisor recommend rightsizing; Cost Explorer and Budgets track and alert on spend.

EBS volume types: gp3 (baseline 3,000 IOPS, 125 MB/s, independently configurable), io2 Block Express for high IOPS, st1/sc1 for throughput.

Auto Scaling target tracking adjusts capacity to keep a metric at a target value; scheduled and predictive scaling handle known patterns.

Graviton (ARM) instances generally deliver better price-performance than comparable x86 instances for supported workloads.