AWS Solutions Architect Professional cheat sheet

RPO bounds acceptable data loss; RTO bounds acceptable downtime. Backup-and-restore has the highest RTO, then pilot light, then warm standby, then multi-site active-active with the lowest RTO and highest cost.

RDS Multi-AZ is synchronous, non-readable, and fails over automatically; read replicas are asynchronous, readable, and require manual promotion.

Aurora replicas share the cluster storage volume, so replica lag is typically under 100 ms; a cluster supports up to 15 replicas and promotes a failed writer in roughly 30 seconds.

SQS standard queues deliver at-least-once with best-effort ordering; FIFO queues deliver exactly-once per message group at 300 msg/s per partition without batching, up to about 3,000 msg/s with 10-message batches.

A redrive policy with maxReceiveCount moves poison messages to a dead-letter queue; the visibility timeout must exceed consumer processing time or the message is redelivered mid-work.

Spot Instances deliver a 2-minute interruption notice; they fit stateless, checkpointed, or batch work, and a mixed instances policy with an On-Demand base preserves availability.

Auto Scaling lifecycle hooks hold instances in pending:wait or terminating:wait so targets can be registered or deregistered and connections drained before the instance proceeds.

Route 53 health checks drive failover routing; weighted routing supports canaries and latency routing spreads traffic across Regions. Record TTL determines how fast a DNS change takes effect.

S3 Standard is designed for 99.999999999% durability and 99.99% availability; cross-Region replication requires versioning enabled on both source and destination buckets.

Compute decision rule: Lambda for event-driven work of 15 minutes or less, Fargate for containers without cluster management, EC2 for full control or GPUs, AWS Batch for queued jobs.

Storage decision rule: EBS for single-instance block, instance store for ephemeral high-IOPS scratch, EFS for shared Linux NFS, FSx for Windows SMB or Lustre HPC, S3 for object data.

Database decision rule: RDS/Aurora for relational OLTP with ACID, DynamoDB for key-value at any scale with single-digit millisecond latency, Redshift for OLAP, Neptune for graph, Timestream for time series.

Messaging decision rule: SQS for decoupled work queues, SNS for fan-out push, EventBridge for content-based routing across AWS and SaaS sources, Kinesis or MSK for ordered streaming with replay.

ALB operates at layer 7 with host, path, and header routing plus WebSocket and gRPC; NLB operates at layer 4 with static IPs and source IP preservation; GWLB inserts third-party inspection appliances.

PrivateLink exposes a service to other VPCs through interface endpoints without CIDR overlap or peering sprawl; Transit Gateway is the hub for transitive VPC-to-VPC, VPN, and Direct Connect routing.

Athena runs standard SQL directly against S3 and bills per terabyte scanned; partition prefixes and Parquet or ORC columnar formats are the primary cost and speed levers.

API Gateway REST APIs support API keys, usage plans, caching, and request validation; HTTP APIs are cheaper and faster; WebSocket APIs hold bidirectional stateful connections.

DynamoDB capacity modes: on-demand for unpredictable traffic, provisioned with auto scaling for steady traffic; global tables provide active-active multi-Region replication with last-writer-wins resolution.

The migration strategies are rehost, replatform, refactor, repurchase, relocate, retain, and retire; retire is evaluated first because it removes the workload and its cost entirely.

AWS Application Migration Service replicates source servers block-by-block with an agent, launches non-disruptive test instances, and performs final cutover with minimal downtime.

DMS moves data for homogeneous or heterogeneous migrations; pair it with the Schema Conversion Tool for schema and code rewriting, and use change data capture for near-zero-downtime cutover.

Transfer sizing: 1 TB over 1 Gbps takes about 2.2 hours; over 100 Mbps the same terabyte takes about 22 hours. Snowball Edge is chosen when the dataset is large or the link is slow or shared.

Application Discovery Service collects server inventory and dependencies agentlessly or via agent; Migration Hub aggregates migration status across tools and Regions in one view.

Cutover patterns are big bang, phased by tier, or parallel run; weighted Route 53 records shift traffic incrementally and allow rollback by changing weights.

Lower DNS TTLs well before the cutover window, and keep the source environment writable until replication lag reaches zero and validation tests pass.

Hybrid connectivity during migration: Site-to-Site VPN for fast low-cost setup, Direct Connect for consistent bandwidth and latency, Transit Gateway to scale the number of attached VPCs.

Migrate tiers in dependency order (data, then middleware, then presentation) and decouple with SQS or SNS so each tier can be moved and rolled back independently.

SCPs define the maximum permissions available to member accounts; they never grant permissions, do not apply to the management account, and do not restrict service-linked roles.

AWS Organizations consolidated billing aggregates usage for volume discounts and shares Reserved Instance and Savings Plans discounts across all member accounts.

Control Tower provisions a landing zone with Account Factory, preventive SCP guardrails, detective Config rule guardrails, and dedicated log archive and audit accounts.

CloudFormation StackSets deploy one template to many accounts and Regions; service-managed permissions use Organizations, self-managed permissions use IAM roles in target accounts.

AWS RAM shares subnets for VPC sharing as well as Transit Gateways and other resources; the VPC owner retains control of subnets, route tables, and network ACLs.

IAM Identity Center assigns permission sets to organization accounts and federates with an external identity provider, removing the need for per-account IAM users.

Guardrail stack: SCPs prevent, Config rules and conformance packs detect, Security Hub aggregates findings, IAM Access Analyzer finds external access, an organization trail in CloudTrail audits.

Cross-account access uses sts:AssumeRole; require an ExternalId for third-party access and use permission boundaries to cap permissions delegated to teams.

Centralized egress shares one egress VPC with NAT Gateways through Transit Gateway instead of per-VPC NAT, reducing cost and consolidating traffic inspection.

Compute Savings Plans (1 or 3 year, up to 66% off) apply to EC2, Fargate, and Lambda across families and Regions; EC2 Instance Savings Plans reach up to 72% but are locked to a family and Region.

Spot Instances discount up to 90% off On-Demand and can be reclaimed on a 2-minute notice, so only interruptible or checkpointed workloads qualify.

EBS gp3 decouples IOPS and throughput from capacity, starting at 3,000 IOPS and 125 MB/s for any size; gp2 scales at 3 IOPS per GB and bursts to 3,000.

S3 lifecycle: Standard to Standard-IA (30-day minimum, 128 KB minimum billable) to Glacier Instant Retrieval, Flexible Retrieval, or Deep Archive; Intelligent-Tiering removes lifecycle tuning for unknown patterns.

Silent costs include unattached EBS volumes, stale snapshots, and idle load balancers, NAT Gateways, and Elastic IP addresses; Data Lifecycle Manager automates snapshot retention policies.

Data transfer: inbound to AWS is free, inter-AZ traffic is billed in both directions, and gateway VPC endpoints for S3 and DynamoDB avoid NAT Gateway processing charges.

Cost visibility: Cost Explorer for trends, Budgets for alerts and automated actions, and the Cost and Usage Report in S3 queried by Athena for line-item detail.

Right-sizing tools: Compute Optimizer for EC2, Auto Scaling groups, EBS, Lambda, and Fargate; Trusted Advisor cost checks; S3 Storage Lens for storage usage and activity.

Commit for predictable baselines with Reserved Instances, Savings Plans, DynamoDB reserved capacity, or Redshift nodes, and cover the variable remainder with On-Demand or Spot.