AWS Certified Cloud Practitioner (CRI series) cheat sheet

Cloud computing: on-demand delivery of IT resources over the internet with pay-as-you-go pricing, replacing upfront capital expenditure with variable operating expense.

Six advantages of cloud: trade fixed expense for variable, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending money running data centers, go global in minutes.

IaaS provides compute, storage, and networking; PaaS adds managed runtimes and middleware; SaaS delivers complete applications - control decreases from IaaS to SaaS.

AWS Regions are geographic areas containing multiple isolated Availability Zones; Availability Zones are one or more discrete data centers with independent power, cooling, and networking.

Edge locations and Regional edge caches sit closer to users than Regions and are used by CloudFront and Route 53 to reduce latency; they are not where general compute instances run.

AWS Well-Architected Framework pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Shared responsibility model: AWS is responsible for security OF the cloud (facilities, hardware, hypervisor); the customer is responsible for security IN the cloud (data, IAM, guest OS, patching).

High availability uses redundancy across Availability Zones; fault tolerance survives component failure with no interruption; disaster recovery restores service in another Region after a large-scale event.

Migration strategies (the 7 Rs): retire, retain, rehost, relocate, replatform, repurchase, and refactor/re-architect - rehost is lift-and-shift, refactor changes architecture for cloud benefit.

IAM identity types: root user (full access, use only for account tasks), IAM users (long-term credentials), IAM groups (collections of users, cannot be nested), and IAM roles (temporary credentials assumed by services or federated users).

IAM policy evaluation: explicit deny overrides everything; otherwise an explicit allow is required; absence of an allow means implicit deny. Permissions boundaries and SCPs further cap the maximum allowed permissions.

Least privilege means granting only the permissions needed for a task; use IAM Access Analyzer, credential reports, and last-accessed data to right-size policies.

MFA adds a second factor to sign-in; for privileged accounts prefer hardware or virtual MFA devices. Root access keys should not exist; rotate any long-term access keys.

AWS CloudTrail records API activity and is the audit trail for who did what, when, and from where; CloudWatch monitors metrics and logs; AWS Config tracks resource configuration changes and compliance.

Encryption at rest: SSE-S3, SSE-KMS, SSE-C, and client-side encryption for S3; KMS customer managed keys support rotation, key policies, and grants. Encryption in transit uses TLS.

AWS Artifact supplies AWS compliance reports and agreements (for example SOC, ISO, PCI attestations) on demand; AWS Config conformance packs and Security Hub standards assess resource compliance.

Network controls: security groups are stateful, allow-only, and instance-level; network ACLs are stateless, allow and deny, and subnet-level. AWS Shield protects against DDoS; WAF filters HTTP requests.

GuardDuty is managed threat detection using logs and threat intelligence; Inspector scans for vulnerabilities; Macie discovers sensitive data in S3; Security Hub aggregates findings across accounts.

Amazon EC2 pricing models: On-Demand (no commitment), Reserved/Savings Plans (1- or 3-year commitment for discount), Spot (up to about 90% off, interruptible), and Dedicated Hosts/Instances (physical isolation).

EC2 instance families: general purpose (M, T), compute optimized (C), memory optimized (R, X), storage optimized (I, D), and accelerated computing (P, G).

Amazon S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive; durability is 99.999999999% (11 nines) for Standard.

Amazon VPC components: subnets (public or private), route tables, internet gateway, NAT gateway, security groups, network ACLs, VPC peering, and AWS Transit Gateway for hub-and-spoke connectivity.

Amazon RDS is managed relational database for MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server; Aurora is a MySQL/PostgreSQL-compatible engine with higher performance and storage that auto-scales.

DynamoDB is a fully managed serverless NoSQL key-value and document database with single-digit millisecond latency; Redshift is a columnar data warehouse for analytics.

Compute choice: Lambda for event-driven serverless functions, Fargate for serverless containers, ECS/EKS for container orchestration, Elastic Beanstalk for platform-managed application deployment.

Amazon CloudFront is a global CDN using edge locations; Route 53 is DNS with routing policies including simple, weighted, latency, failover, and geolocation.

Elastic Load Balancing types: Application Load Balancer (HTTP/HTTPS, layer 7), Network Load Balancer (TCP/UDP, layer 4, ultra-high performance), Gateway Load Balancer (third-party appliances).

AWS pricing fundamentals: pay-as-you-go, save when you commit (Reserved Instances, Savings Plans), and pay less by using more (volume and tiered pricing such as S3 storage tiers).

AWS Free Tier has three types: always free (for example Lambda request allowances), 12 months free (for example limited EC2 hours), and short-term trials.

AWS Organizations with consolidated billing combines member accounts into one bill, aggregates usage for volume discounts, and applies service control policies as guardrails.

AWS Budgets sets custom cost or usage thresholds and sends alerts; AWS Cost Explorer visualizes and forecasts spend; the Cost and Usage Report is the most granular billing dataset.

Support plans: Basic (free, billing and account support, no technical support), Developer (business hours email, one primary contact), Business (24/7 phone/chat/email, full Trusted Advisor checks), and Enterprise (technical account manager, concierge support).

AWS Trusted Advisor inspects cost optimization, performance, security, fault tolerance, and service quotas; the full check set requires Business or Enterprise support.

Total Cost of Ownership analysis compares on-premises costs (servers, power, facilities, staff) with AWS spend; AWS Pricing Calculator estimates monthly cost of a proposed architecture.

Billing tools: AWS Cost Anomaly Detection flags unusual spend, Savings Plans and Reserved Instance utilization reports show commitment usage, and tags enable cost allocation.

Cloud computing: on-demand delivery of IT resources over the internet with pay-as-you-go pricing, replacing upfront capital expenditure with variable operating expense.

Six advantages of cloud: trade fixed expense for variable, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending money running data centers, go global in minutes.

IaaS provides compute, storage, and networking; PaaS adds managed runtimes and middleware; SaaS delivers complete applications - control decreases from IaaS to SaaS.

AWS Regions are geographic areas containing multiple isolated Availability Zones; Availability Zones are one or more discrete data centers with independent power, cooling, and networking.

Edge locations and Regional edge caches sit closer to users than Regions and are used by CloudFront and Route 53 to reduce latency; they are not where general compute instances run.

AWS Well-Architected Framework pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

Shared responsibility model: AWS is responsible for security OF the cloud (facilities, hardware, hypervisor); the customer is responsible for security IN the cloud (data, IAM, guest OS, patching).

High availability uses redundancy across Availability Zones; fault tolerance survives component failure with no interruption; disaster recovery restores service in another Region after a large-scale event.

Migration strategies (the 7 Rs): retire, retain, rehost, relocate, replatform, repurchase, and refactor/re-architect - rehost is lift-and-shift, refactor changes architecture for cloud benefit.

IAM identity types: root user (full access, use only for account tasks), IAM users (long-term credentials), IAM groups (collections of users, cannot be nested), and IAM roles (temporary credentials assumed by services or federated users).

IAM policy evaluation: explicit deny overrides everything; otherwise an explicit allow is required; absence of an allow means implicit deny. Permissions boundaries and SCPs further cap the maximum allowed permissions.

Least privilege means granting only the permissions needed for a task; use IAM Access Analyzer, credential reports, and last-accessed data to right-size policies.

MFA adds a second factor to sign-in; for privileged accounts prefer hardware or virtual MFA devices. Root access keys should not exist; rotate any long-term access keys.

AWS CloudTrail records API activity and is the audit trail for who did what, when, and from where; CloudWatch monitors metrics and logs; AWS Config tracks resource configuration changes and compliance.

Encryption at rest: SSE-S3, SSE-KMS, SSE-C, and client-side encryption for S3; KMS customer managed keys support rotation, key policies, and grants. Encryption in transit uses TLS.

AWS Artifact supplies AWS compliance reports and agreements (for example SOC, ISO, PCI attestations) on demand; AWS Config conformance packs and Security Hub standards assess resource compliance.

Network controls: security groups are stateful, allow-only, and instance-level; network ACLs are stateless, allow and deny, and subnet-level. AWS Shield protects against DDoS; WAF filters HTTP requests.

GuardDuty is managed threat detection using logs and threat intelligence; Inspector scans for vulnerabilities; Macie discovers sensitive data in S3; Security Hub aggregates findings across accounts.

Amazon EC2 pricing models: On-Demand (no commitment), Reserved/Savings Plans (1- or 3-year commitment for discount), Spot (up to about 90% off, interruptible), and Dedicated Hosts/Instances (physical isolation).

EC2 instance families: general purpose (M, T), compute optimized (C), memory optimized (R, X), storage optimized (I, D), and accelerated computing (P, G).

Amazon S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive; durability is 99.999999999% (11 nines) for Standard.

Amazon VPC components: subnets (public or private), route tables, internet gateway, NAT gateway, security groups, network ACLs, VPC peering, and AWS Transit Gateway for hub-and-spoke connectivity.

Amazon RDS is managed relational database for MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server; Aurora is a MySQL/PostgreSQL-compatible engine with higher performance and storage that auto-scales.

DynamoDB is a fully managed serverless NoSQL key-value and document database with single-digit millisecond latency; Redshift is a columnar data warehouse for analytics.

Compute choice: Lambda for event-driven serverless functions, Fargate for serverless containers, ECS/EKS for container orchestration, Elastic Beanstalk for platform-managed application deployment.

Amazon CloudFront is a global CDN using edge locations; Route 53 is DNS with routing policies including simple, weighted, latency, failover, and geolocation.

Elastic Load Balancing types: Application Load Balancer (HTTP/HTTPS, layer 7), Network Load Balancer (TCP/UDP, layer 4, ultra-high performance), Gateway Load Balancer (third-party appliances).

AWS pricing fundamentals: pay-as-you-go, save when you commit (Reserved Instances, Savings Plans), and pay less by using more (volume and tiered pricing such as S3 storage tiers).

AWS Free Tier has three types: always free (for example Lambda request allowances), 12 months free (for example limited EC2 hours), and short-term trials.

AWS Organizations with consolidated billing combines member accounts into one bill, aggregates usage for volume discounts, and applies service control policies as guardrails.

AWS Budgets sets custom cost or usage thresholds and sends alerts; AWS Cost Explorer visualizes and forecasts spend; the Cost and Usage Report is the most granular billing dataset.

Support plans: Basic (free, billing and account support, no technical support), Developer (business hours email, one primary contact), Business (24/7 phone/chat/email, full Trusted Advisor checks), and Enterprise (technical account manager, concierge support).

AWS Trusted Advisor inspects cost optimization, performance, security, fault tolerance, and service quotas; the full check set requires Business or Enterprise support.

Total Cost of Ownership analysis compares on-premises costs (servers, power, facilities, staff) with AWS spend; AWS Pricing Calculator estimates monthly cost of a proposed architecture.

Billing tools: AWS Cost Anomaly Detection flags unusual spend, Savings Plans and Reserved Instance utilization reports show commitment usage, and tags enable cost allocation.