AWS Certified Cloud Practitioner (CLF-C02) cheat sheet

Cloud computing: on-demand delivery of IT resources over the internet with pay-as-you-go pricing, replacing upfront capital expenditure with variable operating expense.

Six advantages of cloud: trade capex for variable expense, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending on data centers, go global in minutes.

IaaS provides raw compute, storage, and networking (for example virtual servers); PaaS provides managed runtimes for deploying code; SaaS provides complete applications consumed by end users.

AWS Cloud Adoption Framework groups capabilities into six perspectives: Business, People, Governance, Platform, Security, and Operations.

Well-Architected Framework pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

AWS Regions are geographic areas containing multiple isolated Availability Zones; each Availability Zone is one or more discrete data centers with independent power and networking.

Edge locations and Regional edge caches host CloudFront content closer to users; they are separate from Regions and Availability Zones.

Migration strategies (the 7 Rs): Retire, Retain, Rehost, Relocate, Replatform, Repurchase, and Refactor or Re-architect.

Cloud elasticity automatically scales resources to match demand; scalability is the ability to handle growth, vertically by larger instances or horizontally by more instances.

Shared responsibility model: AWS is responsible for security OF the cloud (facilities, hardware, hypervisor); the customer is responsible for security IN the cloud (data, identity, patching of guest systems).

IAM users are long-term identities; IAM roles are assumed temporarily and issue short-lived credentials via STS, recommended for EC2, Lambda, and cross-account access.

IAM policy evaluation: explicit Deny overrides everything; otherwise an explicit Allow is required; absence of an Allow means implicit Deny.

Least privilege: grant only permissions required for a task, enforced through scoped IAM policies, permission boundaries, and access analyzer findings.

Security groups are stateful, allow-only virtual firewalls attached to ENIs; network ACLs are stateless, allow-and-deny filters applied at the subnet level.

Encryption at rest uses AWS KMS keys (customer managed or AWS managed); encryption in transit uses TLS; ACM issues and manages public and private certificates.

AWS CloudTrail records API activity for auditing; Amazon GuardDuty detects threats; AWS Config tracks resource configuration compliance; Security Hub aggregates findings.

Compliance programs include SOC 1/2/3, ISO 27001, PCI DSS, HIPAA eligibility, and FedRAMP; artifacts are downloadable from AWS Artifact.

AWS Organizations with service control policies sets a maximum permission boundary for member accounts; SCPs do not grant permissions by themselves.

Compute selection: EC2 for full-control virtual servers; Lambda for event-driven serverless functions; Fargate for serverless containers; ECS or EKS for container orchestration; Elastic Beanstalk for managed application deployment.

EC2 pricing models: On-Demand (no commitment), Reserved and Savings Plans (1- or 3-year commitment), Spot (spare capacity, interruptible, largest discount), Dedicated Hosts.

Storage selection: S3 for object storage; EBS for block volumes attached to one EC2 instance in one AZ; EFS for shared Linux file storage across AZs; FSx for Windows or high-performance workloads; Glacier tiers for archival.

S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive, ordered by decreasing cost and increasing retrieval time.

Amazon VPC provides isolated networking with subnets, route tables, internet gateways, NAT gateways, and security controls; a public subnet routes to an internet gateway.

Databases: RDS for managed relational engines; Aurora for MySQL/PostgreSQL-compatible high performance; DynamoDB for serverless key-value NoSQL; Redshift for data warehousing; ElastiCache for in-memory caching.

Decoupling and integration services: SQS queues, SNS pub/sub topics, EventBridge event buses, and Step Functions workflows.

AWS Global Infrastructure services: Route 53 for DNS, CloudFront for CDN, Global Accelerator for network path optimization, and Direct Connect for dedicated private connectivity.

Management and monitoring: CloudWatch for metrics, logs, and alarms; AWS Systems Manager for operational tasks; AWS Trusted Advisor for best-practice checks.

AWS pricing fundamentals: pay for what you use, pay less when you reserve, pay less per unit at higher volume, and pay less as AWS grows.

AWS Free Tier has three types: always free, 12 months free from account creation, and short-term trials.

Total cost of ownership compares on-premises costs (servers, power, cooling, facilities, labor) against AWS usage-based costs; AWS Pricing Calculator estimates monthly bills.

AWS Cost Explorer visualizes and forecasts spend; AWS Budgets sends alerts or triggers actions when thresholds are crossed; Cost and Usage Reports give granular billing data.

Consolidated billing through AWS Organizations aggregates usage, enabling volume discounts and one bill across member accounts.

Savings Plans (Compute or EC2 Instance) commit to a consistent hourly spend for 1 or 3 years in exchange for lower rates; Reserved Instances commit to instance attributes.

Support plans: Basic (free, billing and account support, Trusted Advisor core checks), Developer, Business, Enterprise On-Ramp, and Enterprise, with increasing response times and features.

Business support adds 24/7 access to Cloud Support Engineers by phone, chat, and email with a one-hour response for production-down cases; Enterprise adds a Technical Account Manager and shorter SLAs.

Spot Instances cost up to about 90 percent less than On-Demand but can be reclaimed with a two-minute interruption notice; data transfer inbound is generally free while outbound is charged.

Placeholder bullet one.

Placeholder bullet two.

Placeholder bullet three.

Placeholder bullet four.

Placeholder bullet five.

Placeholder bullet six.

Placeholder bullet one.

Placeholder bullet two.

Placeholder bullet three.

Placeholder bullet four.

Placeholder bullet five.

Placeholder bullet six.

Placeholder bullet one.

Placeholder bullet two.

Placeholder bullet three.

Placeholder bullet four.

Placeholder bullet five.

Placeholder bullet six.

Placeholder bullet one.

Placeholder bullet two.

Placeholder bullet three.

Placeholder bullet four.

Placeholder bullet five.

Placeholder bullet six.