AWS Solutions Architect cheat sheet

Policy evaluation order: explicit Deny > Organizations SCP > resource-based policy > identity-based policy > permissions boundary > session policy; anything not explicitly allowed is implicitly denied.

Cross-account access needs permission on both sides: an identity-based policy in the caller account plus a resource-based policy or role trust policy in the owning account.

Security groups are stateful and allow-only and attach to ENIs; network ACLs are stateless, support both allow and deny, and are evaluated by rule number at the subnet boundary.

A KMS key policy is the primary access control for a customer managed key; IAM policies grant nothing unless the key policy delegates to IAM.

S3 Block Public Access set at the account level overrides bucket policies and object ACLs, so a permissive bucket policy alone will not open access.

Gateway VPC endpoints (S3, DynamoDB) work through route table entries and have no security group; interface endpoints (PrivateLink) create ENIs with security groups.

Secrets Manager performs scheduled automatic rotation via a Lambda rotation function; Parameter Store SecureString stores secrets cheaply but rotation must be implemented manually.

Cognito user pools authenticate users and issue OIDC tokens; identity pools exchange those tokens for temporary AWS credentials through STS scoped by an IAM role.

AWS Shield Standard is automatic and free for all accounts; Shield Advanced adds DDoS cost protection, SRT access, and Layer 7 mitigation for a subscription fee.

RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; backup-and-restore has the highest RTO/RPO and multi-site active-active the lowest.

DR strategies ordered by rising cost and falling RTO: backup and restore, pilot light, warm standby, multi-site active-active.

RDS Multi-AZ keeps a synchronous standby with automatic failover in roughly 60-120 seconds on the same DNS name; read replicas are asynchronous and need manual promotion.

Aurora maintains six copies of data across three AZs and fails over to a read replica, typically in under 30 seconds.

SQS visibility timeout should be at least six times the consumer or Lambda timeout so messages are not redelivered while still being processed.

Standard SQS queues give at-least-once delivery with best-effort ordering; FIFO queues give exactly-once processing per message group using a deduplication ID.

An Auto Scaling group spanning multiple subnets in different AZs should use ELB health checks so instances failing application checks are replaced, not just failed EC2 status checks.

Route 53 failover routing requires a health check on the primary record and sends traffic to the secondary record when that check reports unhealthy.

S3 One Zone-IA stores data in a single AZ and loses it if that AZ fails; use versioning plus Cross-Region Replication when regional loss must be survivable.

EBS gp3 gives a 3,000 IOPS and 125 MB/s baseline regardless of volume size; gp2 scales at 3 IOPS per GiB, so small gp2 volumes are IOPS-starved.

Use instance store for the highest IOPS at the cost of ephemerality; use io2/io1 EBS when high IOPS must persist across stop/start and AZ moves.

Placement group rules: cluster for low-latency HPC within one AZ, spread for a maximum of seven instances per AZ per group, partition for HDFS and Kafka.

Aurora provides up to 15 read replicas and a reader endpoint that load-balances connections; the cluster endpoint always points at the writer.

ALB is Layer 7 and routes by host, path, or header; NLB is Layer 4, preserves source IP, offers static IPs, and sustains millions of requests per second.

CloudFront origin groups pair primary and secondary origins so the distribution fails over on specified HTTP status codes or origin timeouts.

CloudFront Functions run sub-millisecond JavaScript at viewer request/response; Lambda@Edge handles heavier logic at viewer and origin events in Node.js or Python.

S3 multipart upload parallelizes parts for speed and resumability; it is recommended above 100 MB and required for objects larger than 5 GB.

DynamoDB throughput concentrates on partitions with hot keys; use high-cardinality partition keys with on-demand mode or adaptive capacity to spread load.

Compute Savings Plans apply across EC2, Fargate, and Lambda in any family or Region for up to 66% savings; EC2 Instance Savings Plans reach about 72% but lock to family and Region.

Spot Instances discount up to 90% with a two-minute interruption notice, so use them for stateless, checkpointed, or fault-tolerant batch work.

S3 Intelligent-Tiering charges a small monitoring fee and moves objects between access tiers automatically, avoiding retrieval fees that lifecycle transitions incur.

Minimum storage durations apply: S3 Standard-IA bills 30 days, Glacier Flexible and Instant Retrieval 90 days, and Deep Archive 180 days even if objects are deleted earlier.

Data transfer into AWS is generally free while egress to the internet is billed per GB, so architectures that keep traffic inside a Region or behind CloudFront cost less.

A NAT Gateway bills hourly plus per GB processed; routing S3 and DynamoDB traffic through a free gateway VPC endpoint removes that data processing charge.

EBS snapshots are incremental after the first copy and billed only for changed blocks; retain the chain carefully because deleting a parent leaves dependent blocks billed.

Reserved Instances are Standard (fixed family) or Convertible (exchangeable), in 1- or 3-year terms; only zonal RIs reserve capacity in a specific AZ.

Use cost allocation tags with the Cost and Usage Report for granular attribution, and AWS Budgets for threshold alerts rather than relying on billing alarms alone.