CCC-A cheat sheet

NIST definition has five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service; a model missing any of these is not cloud by definition.

Three service models: IaaS delivers compute, storage, and network with customer-managed OS and above; PaaS delivers runtime and middleware with customer managing only apps and data; SaaS delivers the full application with customer managing only access and data.

Four deployment models: public, private, hybrid, and community; hybrid means orchestration between distinct environments, not merely a VPN link between them.

Shared responsibility split: provider is always responsible for physical security and hypervisor; customer is always responsible for data classification, identity management, and access policy, in every service model.

Elasticity is automated, demand-driven scaling in both directions; scalability is the capacity to grow. Elasticity implies scalability, but scalability does not imply elasticity.

Multi-tenancy is resource pooling across customers; the isolation boundary is the hypervisor, network segmentation, or logical tenant partition depending on service model.

Measured service enables chargeback/showback: metering units include vCPU-hours, GB-months of storage, and GB transferred; reserved and spot pricing trade commitment or interruption risk for lower unit cost.

Cloud bursting is a hybrid pattern where peak load overflows to public cloud; it requires stateless or externally session-managed workloads to work reliably.

Six common migration strategies (the 6 Rs): rehost, replatform, refactor/re-architect, repurchase, retain, and retire; retire and retain are valid outcomes, not failures.

TCO comparison must include exit and migration costs, not just run-rate: egress fees, retraining, dual-running during cutover, and decommissioning of owned hardware.

CapEx-to-OpEx shift moves spend from depreciated assets to variable operating expense; financial benefit depends on utilization profile, since steady high utilization can favor owned infrastructure.

Business case metrics: ROI = (benefit - cost) / cost; payback period = initial investment / annual net benefit; NPV discounts future cash flows and is preferred for multi-year comparisons.

Cloud Center of Excellence (CCoE) is a cross-functional team owning standards, guardrails, and reusable patterns; it enables rather than gates delivery teams.

Value streams to measure: time to provision (lead time), deployment frequency, change failure rate, and mean time to restore; these are DORA-style delivery metrics, distinct from cost metrics.

Adoption maturity typically moves through project, foundational, migration-at-scale, and optimization/innovation stages; cost optimization and FinOps practices usually mature last.

Migration readiness assessment covers application dependency mapping, data gravity, licensing constraints, and compliance residency requirements before wave planning.

Regions contain multiple Availability Zones; an AZ is one or more discrete data centers with independent power and networking. Multi-AZ survives a data center failure; multi-Region survives a regional disaster.

Virtualization type 1 runs the hypervisor on bare metal; type 2 runs it on a host OS. Public cloud compute is type 1. Containers share the host kernel and isolate at the process level, so they are lighter but offer a weaker isolation boundary than VMs.

Availability design targets: single AZ ~99.9%, multi-AZ ~99.95-99.99%, multi-Region active-active higher still; composite availability of serial dependencies multiplies, so chained services are weaker than their weakest link.

Storage classes: block for single-instance attached volumes, file for shared POSIX access, object for flat namespace with HTTP API; object storage is eventually consistent in some implementations and not suitable as a database volume.

Scaling rules: horizontal (scale out) adds instances and suits stateless tiers; vertical (scale up) resizes an instance and is bounded by the largest available size. Autoscaling needs health checks and cooldown to avoid flapping.

Decoupling patterns: queue for point-to-point buffering, publish/subscribe topic for fan-out, API gateway for ingress control; each removes synchronous coupling and improves failure isolation.

Data gravity means large datasets attract compute and services toward them; moving compute to data is usually cheaper than moving data to compute because egress is metered.

Resilience patterns: retry with exponential backoff and jitter, circuit breaker to stop calls to a failing dependency, bulkhead to partition resources, and idempotency keys to make retries safe.

CIA triad plus the cloud-specific additions of identity as the new perimeter: authentication (who), authorization (what), and accounting/audit (what happened) must all be enforced.

Identity federation uses SAML 2.0 or OpenID Connect for SSO; OAuth 2.0 is for delegated authorization, not authentication. MFA should be enforced on all privileged and console access.

Least privilege is implemented with roles and scoped policies, not long-lived user credentials; temporary credentials from a token service should replace static access keys.

Encryption states: at rest (storage-level or client-side), in transit (TLS 1.2+), and in use (confidential computing). Key management options are provider-managed, customer-managed keys, and customer-held HSM; each step increases customer control and operational burden.

Network controls: security groups are stateful instance-level allow rules; network ACLs are stateless subnet-level allow/deny rules. Default-deny ingress is the baseline.

Logging and detection: control-plane audit logs, data-plane access logs, and flow logs feed SIEM; retention must satisfy legal hold and investigation windows.

Vulnerability management in cloud adds image and IaC scanning to host scanning; shift-left means scanning container images and templates in CI before deployment.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned; cloud adds the need for provider notification channels and shared forensic responsibilities.

Policy as code enforces guardrails at provisioning time; preventive controls block noncompliant resources, detective controls flag them after the fact, and corrective controls remediate automatically.

Tagging strategy must define mandatory keys (owner, cost center, environment, data classification); untagged resources break both chargeback and governance reporting.

Service level hierarchy: SLA is the contractual commitment with remedies; SLO is the internal measurable target; SLI is the actual measured indicator. Error budget = 1 - SLO and governs release velocity.

ITIL 4 service value chain activities: plan, improve, engage, design and transition, obtain/build, and deliver and support; incident, problem, and change management remain core practices.

Change management in cloud favors standard, pre-approved changes via CI/CD pipelines over individual change advisory board approval; emergency changes still require post-hoc review.

Configuration management requires a baseline, drift detection against that baseline, and reconciliation; infrastructure as code is the usual baseline source of truth.

Cost governance (FinOps) cycle: inform (visibility and allocation), optimize (rightsizing, commitments, waste removal), operate (budgets, anomaly alerts, continuous review).

Compliance inheritance: the provider's certifications cover the provider's layer only; the customer must still evidence controls for its own layer, so audit scope is always shared.