PCAM cheat sheet

The AWS Well-Architected Framework has six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

The Well-Architected Tool produces a review scored by risk level (HIGH, MEDIUM, NONE) per question; HIGH-risk items are prioritized first.

The AWS Cloud Adoption Framework (CAF) organizes guidance into six perspectives grouped in two domains: Business (Business, People, Governance) and Technical (Platform, Security, Operations).

Migration strategies (the "7 Rs"): Retire, Retain, Rehost, Relocate, Replatform, Repurchase, Refactor/Re-architect.

A landing zone is a multi-account baseline provisioned with AWS Control Tower, including an organization in AWS Organizations, centralized logging, and guardrails.

Control Tower guardrails are either preventive (SCPs) or detective (AWS Config rules); they apply at OU or account level.

AWS Organizations service control lists (SCPs) set the maximum permissions for member accounts but never grant permissions by themselves.

A multi-account strategy isolates environments and blast radius; consolidated billing in Organizations aggregates usage for volume discounts and shares Savings Plans and Reserved Instance benefits.

A VPC spans one Region and is subdivided into Availability Zones; each subnet maps to exactly one AZ and cannot span AZs.

AWS reserves 5 IP addresses per subnet: the network address, the VPC router, DNS (base+2), future use (base+3), and the broadcast address.

Security groups are stateful and allow-only; network ACLs are stateless and support allow and deny, evaluated in numbered order.

A NAT Gateway provides outbound IPv4 internet access for private subnets and must reside in a public subnet with an Elastic IP; it does not accept inbound connections.

VPC peering does not support transitive routing; Transit Gateway provides hub-and-spoke connectivity and can peer across Regions.

A VPC Gateway Endpoint (S3, DynamoDB) adds a route to the route table at no hourly charge; Interface Endpoints (AWS PrivateLink) use ENIs and incur hourly and data charges.

Direct Connect provides dedicated private connectivity; a Site-to-Site VPN runs over the internet. Direct Connect Gateway connects VXCs to multiple VPCs across accounts and Regions.

Route 53 routing policies: simple, weighted, latency, failover, geolocation, geoproximity, and multivalue answer; alias records are free and target AWS resources.

IAM policy evaluation order: explicit deny > SCP > resource-based policy > identity-based policy > permissions boundary > session policy; absence of an allow is an implicit deny.

An IAM permissions boundary sets the maximum permissions an identity-based policy can grant but does not grant permissions itself.

IAM roles use temporary credentials via STS; cross-account access requires a trust policy on the role and a policy allowing sts:AssumeRole on the caller.

AWS KMS customer managed keys support automatic annual rotation; asymmetric KMS keys and imported key material do not support automatic rotation.

S3 default encryption uses SSE-S3; SSE-KMS adds an audit trail in CloudTrail and per-key access control; SSE-C means the customer supplies and manages the key.

AWS Config evaluates resource configuration against rules for compliance; CloudTrail records API activity; GuardDuty detects threats; Security Hub aggregates findings; Macie discovers sensitive data in S3.

AWS Artifact provides on-demand access to AWS compliance reports (SOC, ISO, PCI) and agreements such as the BAA.

Least privilege is implemented with IAM Access Analyzer to identify unused permissions and generate policies from CloudTrail activity.

S3 durability is 99.999999999% (11 nines); S3 Standard availability SLA is 99.9%. S3 Standard-IA and One Zone-IA have a minimum storage duration charge of 30 days.

S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive.

S3 lifecycle rules transition objects between classes and expire them; transitions to Standard-IA require at least 30 days in Standard.

EBS volumes are AZ-scoped and replicated within the AZ; snapshots are stored in S3 and can be copied across Regions. gp3 decouples IOPS and throughput from capacity.

Instance store is ephemeral and lost on stop/terminate; EBS persists independently of instance lifecycle.

EFS is a shared, elastic NFS file system for Linux across AZs; FSx provides Windows (SMB), Lustre (HPC), NetApp ONTAP, and OpenZFS variants.

DynamoDB partition throughput: each partition supports up to 3,000 RCU and 1,000 WCU; a hot partition limits effective throughput regardless of table capacity.

RDS Multi-AZ provides synchronous standby for failover, not read scaling; read replicas are asynchronous and can serve reads.

AWS Application Migration Service (MGN) performs lift-and-shift (rehost) replication of servers into EC2 with continuous block-level replication.

AWS Database Migration Service (DMS) migrates databases; the Schema Conversion Tool (SCT) converts schemas and code for heterogeneous migrations.

The AWS Migration Hub tracks migration progress across tools; Migration Evaluator builds a business case with discovery and TCO analysis.

Strangler fig pattern incrementally replaces legacy functionality behind a facade, allowing coexistence of old and new components.

Containers on ECS or EKS decouple application from infrastructure; Fargate removes server management for containers.

AWS App2Container containerizes existing .NET and Java applications; AWS Mainframe Modernization supports replatform and refactor patterns.

Decomposing a monolith into serverless functions (Lambda) suits event-driven, spiky, or short-lived workloads; long-running stateful processes fit containers or EC2.

Event-driven integration uses SNS fan-out, SQS queues, and EventBridge; the transactional outbox pattern avoids dual-write inconsistency.

RTO is maximum acceptable downtime; RPO is maximum acceptable data loss. Both drive the DR strategy selection.

DR strategies from lowest to highest cost and fastest recovery: Backup and Restore, Pilot Light, Warm Standby, Multi-Site Active/Active.

Backup and Restore uses RPO in hours and RTO in hours; Pilot Light keeps core data replicated; Warm Standby runs a scaled-down full stack; Active/Active runs full capacity in multiple Regions.

Multi-AZ is synchronous replication within a Region for high availability; cross-Region replication is asynchronous and used for DR.

Route 53 failover routing with health checks shifts traffic to a standby Region; health checks can be calculated or based on CloudWatch alarms.

An Availability Zone is one or more discrete data centers with independent power and networking; a Region has at least three AZs.

AWS Backup centralizes backup policies across services and supports cross-Region and cross-account copies with vault lock for immutability.

Static stability means the failover path does not depend on control-plane actions at failure time; pre-provisioned capacity avoids scaling delays.

Compute pricing models: On-Demand (no commitment), Savings Plans (1- or 3-year spend commitment, up to 72% off), Reserved Instances (standard or convertible), Spot (up to 90% off, interruptible).

Compute Savings Plans apply to EC2, Fargate, and Lambda across families, sizes, Regions, and OS; EC2 Instance Savings Plans are tied to a family and Region.

Spot is unsuitable for stateful or non-interruptible workloads; Spot Fleet and EC2 Auto Scaling with capacity-optimized allocation reduce interruption impact.

S3 Intelligent-Tiering charges a small monitoring fee per object but no retrieval fee; it is best for unknown or changing access patterns.

Right-sizing uses CloudWatch metrics and Compute Optimizer recommendations; Cost Explorer shows cost and usage trends; Budgets sends alerts and can trigger actions.

gp3 baseline is 3,000 IOPS and 125 MiB/s throughput, independently configurable; io2 Block Express scales to 256,000 IOPS per volume.

ElastiCache and CloudFront reduce latency and backend load; CloudFront caches at edge locations and supports origin failover.

Aurora read replicas (up to 15) share storage and scale read throughput; Aurora Serverless v2 scales capacity in ACUs automatically.

CloudWatch provides metrics, logs, and alarms; CloudTrail records API calls for audit; AWS Config records resource configuration state and changes.

CloudWatch Logs Insights queries log groups; metric filters convert log patterns into metrics that trigger alarms.

AWS Systems Manager: Parameter Store for configuration and secrets, Session Manager for shell access without SSH or bastion hosts, Patch Manager for patching, Automation for runbooks.

Infrastructure as Code: CloudFormation uses templates and stacks with drift detection; AWS CDK synthesizes CloudFormation; StackSets deploy across accounts and Regions.

AWS Config conformance packs bundle rules and remediation; automatic remediation invokes SSM Automation documents.

AWS Service Catalog controls which approved products users can provision, enforcing governance at provisioning time.

Tag policies in Organizations standardize tag keys and values; cost allocation tags must be activated to appear in billing reports.

AWS Trusted Advisor checks cost, performance, security, fault tolerance, and service quotas; support plan determines the depth of checks.