AWS Certified Cloud Practitioner (CRWT) cheat sheet

Six advantages of cloud computing: trade fixed expense for variable expense, benefit from massive economies of scale, stop guessing capacity, increase speed and agility, stop spending money running and maintaining data centers, go global in minutes.

AWS Cloud Adoption Framework (CAF) perspectives: Business, People, Governance, Platform, Security, Operations. The first three are business capabilities; the last three are technical capabilities.

AWS Well-Architected Framework pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability.

Cloud deployment models: public cloud (all in AWS), private cloud (on-premises or dedicated), hybrid (integration of both via services such as AWS Direct Connect, VPN, or Outposts).

AWS global infrastructure hierarchy: Regions contain Availability Zones; Availability Zones contain one or more data centers; edge locations and Regional edge caches serve CloudFront content.

Elasticity vs. scalability: elasticity automatically scales resources in and out with demand; scalability is the ability to handle growth by adding resources (vertical or horizontal).

Fault tolerance vs. high availability: fault tolerance continues operating through component failure with no interruption; high availability minimizes downtime through rapid recovery, typically across multiple AZs.

Migration strategies (7 Rs): Retire, Retain, Rehost, Relocate, Replatform, Repurchase, Refactor/Re-architect.

Shared responsibility model: AWS is responsible for security OF the cloud (physical facilities, hardware, network, virtualization layer); the customer is responsible for security IN the cloud (data, IAM configuration, guest OS patching, encryption choices).

IAM policy evaluation order: explicit deny > explicit allow > implicit deny (default). Permissions boundaries and SCPs set the maximum permissions but never grant permissions on their own.

IAM identity types: users (long-term credentials), groups (collection of users), roles (temporary credentials assumed by trusted entities). Prefer roles over long-term access keys.

AWS KMS key types: AWS managed keys, customer managed keys, and AWS owned keys. Customer managed keys support custom key policies, rotation, and cross-account grants.

Encryption at rest services: S3 SSE-S3, SSE-KMS, SSE-C, and client-side encryption; EBS encryption uses KMS; RDS encryption must be enabled at creation time.

AWS CloudTrail records API activity for auditing; AWS Config records resource configuration changes for compliance; Amazon GuardDuty detects threats; AWS Security Hub aggregates findings; Amazon Inspector scans workloads for vulnerabilities.

AWS Artifact provides on-demand access to AWS compliance reports (SOC, ISO, PCI) and agreements such as the BAA.

AWS WAF filters HTTP/HTTPS traffic at Layer 7; AWS Shield protects against DDoS; Network ACLs are stateless subnet-level filters; security groups are stateful instance-level firewalls.

Amazon EC2 instance families: general purpose (T, M), compute optimized (C), memory optimized (R, X, High Memory), storage optimized (I, D, H), accelerated computing (P, G, Inf, Trn).

Amazon S3 storage classes: S3 Standard, S3 Intelligent-Tiering, S3 Standard-IA, S3 One Zone-IA, S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, S3 Glacier Deep Archive. Durability is 99.999999999% (11 nines) for all classes.

AWS Lambda runs code without provisioning servers, scales automatically, and is billed per request and per GB-second of execution duration; maximum execution timeout is 15 minutes.

Amazon VPC components: subnets (public or private), route tables, internet gateway, NAT gateway, security groups, network ACLs, VPC peering, Transit Gateway, and VPC endpoints (gateway and interface).

Amazon RDS engines: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora. Aurora is MySQL- and PostgreSQL-compatible with higher performance and storage auto-scaling.

Amazon DynamoDB is a fully managed NoSQL key-value and document database with single-digit millisecond latency; DynamoDB Accelerator (DAX) provides in-memory caching.

Amazon CloudFront is a global content delivery network that caches content at edge locations; origins can be S3 buckets, EC2 instances, Elastic Load Balancers, or custom HTTP servers.

AWS Elastic Load Balancing types: Application Load Balancer (Layer 7, HTTP/HTTPS), Network Load Balancer (Layer 4, TCP/UDP, ultra-high performance), Gateway Load Balancer (Layer 3, appliances), and Classic Load Balancer (legacy).

AWS pricing fundamentals: pay-as-you-go, save when you commit (Reserved Instances, Savings Plans), and pay less by using more (volume discounts, tiered pricing).

EC2 purchasing options: On-Demand (no commitment), Reserved Instances (1- or 3-year term, up to 72% discount), Savings Plans (Compute or EC2 Instance, up to 72%), Spot Instances (up to 90% discount, interruptible), and Dedicated Hosts.

AWS Free Tier categories: always free (e.g., Lambda 1 million requests per month), 12 months free (e.g., 750 hours of t2.micro or t3.micro per month), and short-term trials.

AWS Budgets sets custom spending and usage budgets with alerts; AWS Cost Explorer visualizes and forecasts costs; the AWS Cost and Usage Report provides the most detailed billing data.

Consolidated billing through AWS Organizations aggregates usage across accounts, enabling volume discounts and a single payer.

AWS Support plans: Basic (free), Developer, Business, and Enterprise. Only Business and Enterprise include 24/7 phone, chat, and email support and a technical account manager (Enterprise).

Data transfer pricing: inbound data transfer to AWS is generally free; outbound data transfer to the internet is charged; data transfer between AZs in the same Region is charged; between Regions is charged.

Savings Plans types: Compute Savings Plan (applies to EC2, Fargate, and Lambda across Regions and families) and EC2 Instance Savings Plan (applies to a specific instance family in a Region).