AWS Certified Cloud Practitioner cheat sheet

AWS Cloud Adoption Framework (CAF) has six perspectives: Business, People, Governance, Platform, Security, Operations; the first three are business perspectives, the last three are technical.

The AWS CAF transformation phases are Envision, Align, Launch, and Scale.

The Well-Architected Framework has six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

The 7 Rs of migration: Retire, Retain, Rehost, Relocate, Replatform, Repurchase, Refactor/Re-architect.

Economies of scale: AWS aggregates demand across many customers, lowering per-unit pricing versus self-hosted infrastructure.

Trade fixed capital expense (CapEx) for variable operational expense (OpEx): pay only for consumed resources.

Stop guessing capacity: auto scaling and elastic provisioning replace upfront capacity planning and idle overprovisioning.

Global reach in minutes: Regions, Availability Zones, and edge locations let you deploy close to users without building data centers.

AWS Regions are composed of multiple, isolated Availability Zones connected by low-latency links; a Region choice is driven by compliance, latency, and service availability.

Shared responsibility: AWS is responsible for security OF the cloud (facilities, hardware, hypervisor, managed service infrastructure); the customer is responsible for security IN the cloud (data, IAM, patching guest OS, network configuration).

IAM policy evaluation: explicit Deny overrides any Allow; with no Allow and no Deny the request is implicitly denied by default.

IAM identities: users (long-term credentials), groups (collection of users), roles (temporary credentials assumed by services, applications, or federated users).

MFA can be virtual (authenticator app), hardware TOTP token, or FIDO2 security key; root account should use MFA and access keys should be avoided for root.

AWS Organizations with Service Control Policies (SCPs) sets maximum permissions for member accounts; SCPs do not grant permissions, they filter them.

AWS Artifact provides on-demand access to AWS compliance reports (SOC, ISO, PCI) and agreements such as the BAA.

AWS CloudTrail records API activity for auditing; GuardDuty detects threats; Security Hub aggregates findings; Config tracks resource configuration compliance.

Encryption at rest uses KMS customer managed keys or AWS managed keys; encryption in transit uses TLS. KMS key policies control key access separately from IAM.

AWS Shield Standard protects against common DDoS at no extra cost; Shield Advanced adds enhanced detection, DDoS cost protection, and 24/7 DDoS response team access.

EC2 pricing models: On-Demand, Reserved (1 or 3 year, Standard or Convertible), Savings Plans (Compute or EC2 Instance), Spot (up to 90% off, interruptible), and Dedicated Hosts/Instances.

S3 storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive; durability is 99.999999999% (11 nines) for Standard.

S3 features: versioning, lifecycle policies, cross-region replication, Object Lock (WORM), and bucket policies for access control.

Amazon VPC building blocks: subnets (public/private), route tables, internet gateway, NAT gateway, security groups (stateful, allow-only), and network ACLs (stateless, allow and deny).

AWS Lambda runs code without provisioning servers, is event-driven, and bills per request and per GB-second of execution duration with a maximum timeout of 15 minutes.

Amazon RDS engines: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora; Multi-AZ is for high availability, Read Replicas are for read scaling.

Amazon DynamoDB is a fully managed NoSQL key-value and document database with single-digit millisecond latency and on-demand or provisioned capacity.

Elastic Load Balancing types: Application (Layer 7, HTTP/HTTPS), Network (Layer 4, TCP/UDP/TLS), Gateway (third-party appliances), and Classic (legacy).

Amazon CloudFront is a global CDN using edge locations; AWS Global Accelerator uses Anycast IPs to route traffic over the AWS global network for performance.

AWS Support plans: Basic (free, billing and account support, documentation, whitepapers), Developer, Business, and Enterprise (or Enterprise On-Ramp).

Business support adds 24/7 phone, chat, and email access to Cloud Support Engineers, a 1-hour response for production system down, and full Trusted Advisor checks.

Enterprise support adds a Technical Account Manager (TAM), a 15-minute response for business-critical system down, and infrastructure event management.

AWS Free Tier has three types: always free (e.g., 1 million Lambda requests/month), 12 months free (e.g., 750 hours of t2.micro/t3.micro), and short-term trials.

AWS Budgets sets custom cost or usage thresholds and can send alerts or trigger actions; AWS Cost Explorer visualizes and forecasts spend.

Consolidated billing through AWS Organizations combines usage for volume discounts and provides one bill, with the management account paying.

The AWS Pricing Calculator estimates costs before deployment; it does not provision resources.

Data transfer IN to AWS is generally free; data transfer OUT to the internet is charged, and inter-AZ traffic is charged in most cases.

Savings Plans and Reserved Instances reduce cost in exchange for a 1- or 3-year commitment; Spot Instances offer the deepest discounts but can be interrupted.