C-CATODSW cheat sheet

Cloud computing: on-demand delivery of compute, storage, database, networking, and other IT resources over the internet with pay-as-you-go pricing, replacing upfront capital investment with variable operating expense.

Elasticity is the ability to acquire resources as workload grows and release them when demand falls; scalability is the capacity to handle growth through vertical scaling (larger instances) or horizontal scaling (more instances).

IaaS supplies virtualized infrastructure (compute, storage, network) that the customer manages; PaaS supplies a managed runtime and middleware; SaaS supplies a complete application managed by the provider.

The AWS Well-Architected Framework has six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

AWS global infrastructure hierarchy: Regions contain multiple Availability Zones (isolated data centers with independent power and networking); edge locations and Local Zones sit closer to end users for latency-sensitive delivery.

High availability uses redundancy across Availability Zones within one Region; disaster recovery uses a second Region and is measured by RTO (acceptable downtime) and RPO (acceptable data loss).

The shared responsibility model splits duties: AWS is responsible for security OF the cloud (physical facilities, hypervisor, managed service infrastructure); the customer is responsible for security IN the cloud (data, identity, patching of guest systems).

Migrating to the cloud trades fixed data-center costs for variable usage costs, improves global reach and time-to-market, and enables automation, but requires governance for cost control and compliance.

AWS Identity and Access Management (IAM) evaluates every request against identity-based policies, resource-based policies, permissions boundaries, service control policies (SCPs), and session policies; an explicit Deny always overrides any Allow.

IAM best practice: grant least privilege, avoid long-lived access keys for humans, require multi-factor authentication, and use IAM roles with temporary credentials (STS) for EC2, Lambda, and cross-account access.

AWS Organizations applies SCPs at the organization, organizational unit, or account level to set the maximum permissions available to member accounts; SCPs do not grant permissions by themselves.

Encryption: data at rest is protected with AWS KMS customer managed keys, CloudHSM, or S3 server-side encryption; data in transit is protected with TLS. KMS key policies control who may use a key.

AWS CloudTrail records API activity and management events for audit; Amazon GuardDuty detects threats; AWS Config tracks resource configuration and compliance; Amazon Inspector scans workloads for vulnerabilities; Security Hub aggregates findings.

Network protection: security groups are stateful instance-level virtual firewalls that allow only rules you add; network ACLs are stateless subnet-level filters with allow and deny rules evaluated in numbered order.

Amazon VPC design: public subnets route to an internet gateway; private subnets use a NAT gateway for outbound traffic; VPC endpoints (PrivateLink) reach AWS services without traversing the public internet.

Compliance programs: AWS Artifact provides on-demand access to AWS compliance reports (SOC, ISO, PCI) and agreements such as the BAA; AWS Config conformance packs and Audit Manager support evidence collection.

Amazon EC2 pricing models: On-Demand (no commitment), Reserved and Savings Plans (1- or 3-year commitment for discount), Spot (spare capacity at deep discount, interruptible with a 2-minute warning), and Dedicated Hosts/Instances.

Amazon S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive; durability is 11 nines, and lifecycle rules transition or expire objects.

Amazon VPC components: CIDR block, subnets, route tables, internet gateway, NAT gateway, security groups, network ACLs, and VPC peering or Transit Gateway for connectivity.

Amazon RDS is a managed relational service (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server) with Multi-AZ failover and read replicas; Amazon DynamoDB is a managed NoSQL key-value store with on-demand or provisioned capacity.

AWS Lambda runs code without provisioning servers, scales automatically, and is billed per request and per GB-second; Amazon ECS and Amazon EKS orchestrate containers, and AWS Fargate runs containers serverlessly.

Amazon CloudFront is a global content delivery network that caches content at edge locations and integrates with AWS WAF and Shield for protection; Route 53 provides DNS with routing policies such as latency, failover, and weighted.

Decoupling and integration: Amazon SQS queues buffer messages between components, Amazon SNS fans out notifications to subscribers, and Amazon EventBridge routes events between services.

AWS CloudFormation and AWS CDK provide infrastructure as code; Elastic Load Balancing (Application, Network, Gateway) distributes traffic; Auto Scaling groups adjust EC2 capacity to match demand.

AWS charges for compute by time (per second with a 60-second minimum for Linux EC2, per hour for some platforms), for storage by GB-month, and for data transfer by GB; inbound data transfer to AWS is generally free.

Data transfer out to the internet is billed per GB after a free tier allowance; transfer between Availability Zones is billed, while transfer within the same Availability Zone using private IP addresses is typically free.

AWS Free Tier has three types: always free (e.g., limited Lambda requests), 12 months free from account creation (e.g., 750 hours of t2.micro/t3.micro), and short-term trials.

AWS Budgets sets custom cost or usage thresholds and sends alerts or triggers actions; AWS Cost Explorer visualizes spending trends and forecasts; Cost and Usage Reports deliver the most granular billing data to S3.

Savings Plans (Compute or EC2 Instance) commit to a consistent amount of usage for 1 or 3 years in exchange for lower rates; Reserved Instances can be Standard or Convertible and offer zonal or regional scope.

AWS Organizations consolidated billing combines usage across accounts into one bill, aggregates volume discounts, and shares Reserved Instance and Savings Plan benefits across the organization.

The AWS Pricing Calculator estimates monthly costs before deployment; the Total Cost of Ownership (TCO) Calculator compares on-premises costs with AWS costs.

Pricing principles: pay-as-you-go, save when you commit, and pay less by using more (volume discounts for services such as S3 and data transfer); AWS Support plans are Developer, Business, Enterprise On-Ramp, and Enterprise.