AWS SysOps Administrator cheat sheet

CloudWatch metric retention by period: 1-minute data points are kept 15 days, 5-minute points 63 days, and 1-hour points 455 days.

EC2 basic monitoring publishes metrics every 5 minutes at no charge; detailed monitoring publishes every 1 minute and is billed per metric.

A CloudWatch alarm has three states: OK, ALARM, and INSUFFICIENT_DATA. Evaluation is Period x Evaluation Periods, with M-of-N via Datapoints to Alarm.

Memory, disk usage, swap, and per-process metrics are not default EC2 metrics; they require the CloudWatch agent on the instance.

A CloudWatch Logs metric filter converts matching log events into a custom metric, which can then drive an alarm or an EventBridge rule.

CloudTrail Event history retains 90 days of management events by default; S3 data events and Lambda Invoke events must be enabled explicitly and cost extra.

AWS Config rules evaluate resource configuration against a desired state after the fact; they detect and can trigger SSM Automation remediation but do not block the API call.

EventBridge rules match an event pattern (or a rate/cron schedule) and route to targets such as Lambda, SSM Automation, SNS, or SQS for automated remediation.

CloudWatch alarms can invoke an EC2 recover action to move an impaired instance to new hardware while keeping its instance ID, private IP, and Elastic IP.

RDS Multi-AZ maintains a synchronous standby in a second AZ for automatic failover; it is not a read-scaling mechanism. Read replicas are asynchronous and serve reads.

Aurora stores six copies of data across three AZs and supports up to 15 Aurora Replicas with tier-based failover priority.

S3 Standard is designed for 99.999999999% (11 nines) durability and 99.99% availability; durability and availability are different guarantees.

Cross-Region Replication and Same-Region Replication both require versioning enabled on the source and destination buckets.

RTO is the maximum acceptable time to restore service; RPO is the maximum acceptable amount of data loss measured in time.

DR strategies ranked from lowest cost/highest RTO to highest cost/lowest RTO: backup and restore, pilot light, warm standby, multi-site active-active.

EBS snapshots are incremental and stored by AWS; copying a snapshot to another Region is the standard cross-Region block-storage recovery mechanism.

AWS Backup centralizes backup plans across services; Vault Lock enforces WORM retention so backups cannot be deleted before the retention period ends.

Route 53 failover routing requires a health check on the primary record; when the check fails, answers switch to the secondary record.

A CloudFormation change set previews the resource-level impact of a stack update before execution; no resources are modified until the change set is executed.

CloudFormation StackSets deploy one template across multiple accounts and Regions from a single administrator or delegated-admin account.

DeletionPolicy: Retain keeps a resource when its stack is deleted; Snapshot takes a final snapshot for supported resources such as RDS and EBS.

CreationPolicy with cfn-signal makes CloudFormation wait for instance bootstrapping; UpdatePolicy controls rolling updates for ASGs and ElastiCache.

Elastic Beanstalk deployment policies, safest and slowest first: Immutable, Traffic splitting, Rolling with additional batch, Rolling, All at once.

CodeDeploy lifecycle hooks in AppSpec run in order: BeforeInstall, AfterInstall, ApplicationStart, ValidateService; a failed hook triggers rollback per the deployment config.

Session Manager provides shell access to instances with no inbound ports, no bastion host, and no SSH key, logging sessions to S3 or CloudWatch Logs.

EC2 user data runs as root at first launch by default and is not re-executed on stop/start; launch templates are versioned and supersede launch configurations.

SSM Parameter Store holds plaintext and SecureString values (KMS-encrypted); Secrets Manager adds native automatic rotation driven by a Lambda function.

IAM evaluation order: an explicit Deny always wins, then an explicit Allow, and the implicit default is Deny.

A permissions boundary sets the maximum permissions an identity-based policy can grant but never grants permissions on its own.

Service control policies apply at the Organizations OU or account level and limit the maximum permissions for all principals in that account, including the root user.

KMS customer managed keys support automatic yearly rotation; imported key material and asymmetric keys do not rotate automatically.

S3 server-side encryption options: SSE-S3 (AES-256, Amazon-managed keys), SSE-KMS (key policy plus CloudTrail audit), SSE-C (customer-supplied keys), and client-side encryption.

GuardDuty detects threats from VPC Flow Logs, DNS logs, and CloudTrail; Inspector finds software vulnerabilities and unintended network exposure; Macie classifies sensitive data in S3.

A presigned URL grants time-limited access to a private S3 object using the permissions of the credential that signed it.

S3 Block Public Access can be set per bucket or per account and overrides bucket policies and ACLs that would otherwise allow public access.

CloudTrail log file integrity validation uses digest files to prove logs were not altered after delivery; delivering to a centralized log account protects against local tampering.

Security groups are stateful and support allow rules only; network ACLs are stateless, support allow and deny, and evaluate rules in ascending rule-number order.

VPC peering is non-transitive: a peered VPC cannot reach a third VPC through its peer. Transit Gateway provides transitive hub-and-spoke connectivity.

Gateway VPC endpoints exist only for S3 and DynamoDB and are wired into route tables; interface endpoints create ENIs with security groups and use PrivateLink.

A NAT Gateway is managed, lives in one AZ, uses an Elastic IP, and must be duplicated per AZ for high availability; NAT instances are self-managed EC2.

Elastic Load Balancing: ALB is Layer 7 with host/path routing and no static IP; NLB is Layer 4 with static IPs and ultra-low latency; GWLB inserts third-party appliances.

Route 53 routing policies: simple, weighted (percentage split), latency (lowest-latency Region), failover (health-checked), geolocation, geoproximity, and multivalue answer (up to eight healthy records).

CloudFront serves cached content from edge locations; origin requests outside the TTL cost money, and invalidation paths are billed above the free monthly allowance.

CloudFront signed URLs grant access to a single file while signed cookies grant access to multiple files, such as an entire HLS video stream.

An egress-only internet gateway provides outbound-only IPv6 connectivity; it does not accept inbound IPv6 connections.

Compute Savings Plans apply to EC2, Fargate, and Lambda in exchange for a one- or three-year hourly spend commitment; EC2 Instance Savings Plans are tied to a family and Region.

Spot Instances discount up to about 90% off On-Demand and receive a two-minute interruption notice before capacity is reclaimed.

S3 minimum storage durations: Standard-IA and One Zone-IA 30 days, Glacier Instant Retrieval and Glacier Flexible Retrieval 90 days, Glacier Deep Archive 180 days.

S3 Intelligent-Tiering charges a small monitoring fee per object and moves objects between access tiers automatically with no retrieval fees for frequent-access tiers.

EBS gp3 provisions baseline 3,000 IOPS and 125 MiB/s independently of volume size; gp2 baselines at 3 IOPS/GiB with burst credits up to 3,000 IOPS.

Cost Explorer visualizes and forecasts spend; AWS Budgets sends alerts or triggers actions against a threshold; the Cost and Usage Report is the most granular source and lands in S3.

Auto Scaling target tracking keeps a metric at a target value and is the simplest policy; step and simple scaling react to alarm breaches, scheduled scaling handles known peaks.

S3 multipart upload is recommended above 100 MB and required above 5 GB; the maximum single PUT is 5 GB and the maximum object size is 5 TB.

Placement groups: cluster for low-latency HPC, spread for a small number of critical instances on distinct hardware, partition for distributed systems such as HDFS and Kafka.