Cloud+ cheat sheet

Service models: IaaS supplies compute, storage, and networking; PaaS adds runtime and managed middleware; SaaS delivers the finished application. The provider's management scope grows from IaaS to SaaS.

NIST's five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service.

Deployment models are public, private, hybrid, and community. Hybrid links on-premises and cloud resources and requires consistent identity and network addressing across both.

Under shared responsibility the provider owns facilities, hardware, and the hypervisor; the customer always owns data, identities, and access configuration, and the split shifts with the service model.

A region contains multiple availability zones; deploying across zones survives a single facility failure, while cross-region replication adds durability and disaster recovery at the cost of latency and egress fees.

High availability uses redundancy with brief failover; fault tolerance uses redundant components with no interruption; disaster recovery restores service after site-level loss and is measured by RPO and RTO.

Vertical scaling changes an instance's size and typically requires a restart; horizontal scaling adds instances and requires stateless design or shared session state.

Type 1 hypervisors run on bare metal (ESXi, Hyper-V, KVM); type 2 hypervisors run on a host OS. Containers share the host kernel and start faster than VMs but provide weaker isolation.

Multi-tenancy means shared physical resources; noisy-neighbor contention is reduced by quotas, reservations, and monitoring but is never fully eliminated.

Blue-green uses two identical environments with an instant load-balancer or DNS cutover; rollback is a switch back, so both versions must remain database compatible.

Canary routes a small traffic percentage, typically 1-5 percent, to the new version, compares error rate and latency against baseline, then ramps up or reverts.

Rolling deployment replaces instances in batches inside one environment; it avoids duplicate infrastructure cost but runs two versions at once, so APIs and schemas must be backward compatible.

Recreate or in-place deployment causes downtime and is acceptable only where an outage window is permitted.

Migration strategies: rehost (lift and shift), replatform (minor changes such as moving to a managed database), refactor or re-architect (highest effort, highest cloud benefit), repurchase (SaaS), and retire.

Infrastructure as code templates are declarative and version-controlled; a plan or preview step shows the diff before apply, and remote locked state maps templates to real resources.

A typical pipeline order is source, build, unit test, artifact registry, staging deploy, integration test, approval gate, production deploy, smoke test.

Rollback design must account for schema changes: additive-only migrations paired with feature flags allow the application to be reverted safely.

Immutable image deployments eliminate configuration drift because the same artifact is promoted unchanged through each environment.

Observability rests on three data types: metrics (numeric time series), logs (timestamped events), and traces (a request's path across services). Alert on user-facing symptoms, not every raw metric.

SLI is the measured value, SLO is the internal target such as 99.9 percent over 30 days, and SLA is the contract with consequences. Error budget equals 1 minus the SLO.

Backup types: full copies all data, incremental copies changes since the last backup of any type, differential copies changes since the last full. A restore needs the last full plus the subsequent incremental chain or latest differential.

The 3-2-1 rule calls for three copies, on two media types, with one offsite or off-region. Restores must be tested; an untested backup is not a backup.

RPO sets backup frequency; RTO sets the standby strategy, ranging from backup-and-restore through pilot light and warm standby to active-active.

Autoscaling policies: target tracking for steady load, step scaling for bursts, scheduled scaling for known peaks. Add capacity quickly and remove it slowly to prevent flapping.

Enforce tag keys for owner, environment, cost center, and data classification; tags drive chargeback reporting, automated shutdown, and incident ownership lookup.

Patch management combines golden baseline images, defined maintenance windows, and staged rollout starting with a pilot group plus a retained rollback image.

Capacity planning inputs are utilization trend, growth rate, burst headroom, and service quotas, which are frequently the actual ceiling hit before hardware limits.

The CIA triad governs control selection; controls are preventive, detective, or corrective, and data classification determines which controls are mandatory.

IAM separates authentication (who), authorization (what), and auditing (what happened). Prefer roles and short-lived tokens over long-lived access keys, and require MFA on privileged accounts.

Least privilege plus separation of duties; permission boundaries and policy conditions such as source network, MFA presence, or time of day constrain otherwise broad roles.

Data in transit uses TLS 1.2 or 1.3; data at rest uses AES-256 with provider-managed or customer-managed keys. Key rotation limits exposure, and key deletion is irreversible after a waiting period.

KMS performs envelope encryption for cloud services, an HSM provides FIPS 140-2/3 validated key custody for compliance, and a secrets manager stores and rotates credentials.

Security groups are stateful and instance-level with allow rules only; network ACLs are stateless and subnet-level with allow and deny rules that must permit both directions. A WAF filters HTTP content, while IDS detects and IPS blocks traffic patterns.

Federation uses SAML 2.0 for browser single sign-on, OIDC for modern and API clients, and SCIM for automatic provisioning; disabling the central account removes cloud access at once.

Zero trust verifies every request explicitly, applies least privilege, and assumes breach, replacing VPN-based implicit trust with identity, device health, and context checks.

Compliance evidence comes from audit logs shipped to immutable storage, conformance or configuration rules, scheduled vulnerability scans, and penetration tests performed under the provider's rules of engagement.

Continuous integration builds and tests every commit and stores the resulting immutable artifact in a registry under a unique version identifier.

Continuous delivery keeps every build releasable with a manual production approval; continuous deployment releases to production automatically. Both require automated tests and a rollback path.

Pipeline stages: source, build, unit test, static and dependency scan, artifact publish, staging deploy, integration and end-to-end test, approval, production deploy, smoke test.

Declarative IaC (Terraform, CloudFormation) states the desired end state, is idempotent, and detects drift; imperative scripts list steps and are unsafe to rerun unless written defensively. Run a plan or diff before apply.

Configuration management tools (Ansible, Puppet, Chef) converge existing hosts to a desired state; immutable image builds replace hosts instead of converging them.

Immutable infrastructure builds once and promotes the identical artifact through every environment, so no environment is patched by hand.

Microservices deploy and scale independently but add network latency, retry logic, and distributed tracing requirements; a monolith stays simpler until team or deploy frequency demands splitting.

DORA's four metrics are deployment frequency, lead time for changes, change failure rate, and time to restore service; high performers improve speed and stability together.

Shift-left places static analysis, unit tests, and secret scanning inside the pipeline, where defects are cheaper to fix and block fewer downstream stages.

Method order: identify the problem and gather information, establish a theory, test the theory, plan and implement the fix, verify full functionality, then document. Change one variable at a time.

Isolate by layer: link and physical (cable, NIC), network (IP address, route), transport (port, MTU, firewall), application (DNS, TLS, HTTP status code).

Tool mapping: ping tests reachability, traceroute shows path and per-hop delay, dig or nslookup tests resolution, curl -v shows TLS and HTTP headers, netstat or ss shows listening ports, tcpdump captures packets.

Latency is per-packet delay; bandwidth is capacity per second. Chatty request-per-page applications suffer from latency, while bulk transfers suffer from insufficient bandwidth.

DNS versus DHCP split: an address starting 169.254 means DHCP failed, while a valid address with failed name resolution means DNS failed.

An MTU mismatch shows large packets failing while small ones succeed, typically as a hung TLS handshake or stalled SSH session; lower the MTU or clamp MSS to resolve it.

Scope test: determine whether one user, one subnet, one tenant, one zone, or all customers are affected; the blast radius identifies the layer most likely at fault.

Check cloud-specific causes first: service quotas, IAM denials in audit logs, expired credentials or certificates, and recent security group or ACL changes.

Rollback is valid remediation when the triggering change is known, but preserve logs and copies before reverting so root-cause evidence survives.