EIP cheat sheet

Direct point-to-point links grow as n(n-1)/2 for n systems; a hub or canonical model reduces custom mappings and change propagation.

Synchronous request-response fits immediate consistency and simple queries; asynchronous messaging fits decoupling, load buffering, and partial-failure isolation.

At-least-once delivery requires idempotent consumers; exactly-once semantics are reliable only inside a bounded transactional scope, not across arbitrary systems.

A saga uses local transactions plus compensating actions; each compensation must be idempotent and retry-safe because failures can repeat.

API gateways handle routing, authentication, authorization, rate limiting, and protocol translation; domain business rules remain in services.

Use an ESB or integration middleware for mediated routing and transformation across heterogeneous on-premises systems; use iPaaS for cloud-to-SaaS connectivity and managed connectors.

Architecture domains are business, application, data, and technology; each element should trace to a requirement, capability, or stakeholder concern.

Service instability I = Ce / (Ca + Ce), where Ce is efferent and Ca is afferent coupling; lower I indicates a more stable, depended-upon service.

1NF requires atomic attributes; 2NF removes partial dependencies on a composite key; 3NF removes transitive dependencies on non-key attributes.

Star schemas use a central fact table and denormalized dimensions for simpler queries; snowflake schemas normalize dimensions and add joins.

SCD type 1 overwrites old values; type 2 adds rows with validity dates and current flags; type 3 stores a limited prior value in an extra column.

CAP theorem: during a network partition a distributed system chooses consistency or availability; the choice can vary by operation and business requirement.

ACID guarantees atomicity, consistency, isolation, and durability; BASE favors availability and eventual consistency with softer state guarantees.

Data quality dimensions include completeness, accuracy, consistency, timeliness, uniqueness, and validity; each requires an explicit measurable rule.

Freshness = current time - latest successful data timestamp; completeness = non-null required values / total required values.

Lineage records source-to-target movement and transformations; provenance adds who, when, and why for audit and reproducibility.

Risk score = likelihood x impact; residual risk is assessed after controls and compared with risk appetite.

Confidentiality protects against unauthorized disclosure; integrity protects against unauthorized modification; availability protects timely authorized access.

Authentication verifies identity; authorization determines permitted actions; accounting or auditing records actions for traceability.

RBAC assigns permissions to roles; ABAC evaluates attributes such as user, resource, action, and context.

Encryption at rest protects stored data; TLS protects data in transit; key management must separate duties and support rotation.

RTO is maximum tolerable downtime; RPO is maximum tolerable data loss; tighter targets require more costly recovery designs.

Incident response phases are preparation; detection and analysis; containment; eradication; recovery; post-incident lessons learned.

Segregation of duties prevents one person from controlling all stages of a sensitive transaction; compensating monitoring is required when separation is impractical.

Zero trust verifies every request explicitly and applies least privilege; network location alone is not an authentication factor.

Waterfall gates at phase boundaries; agile delivers increments with continuous feedback; governance can apply stage gates to either model.

Definition of Done is a team-wide completion checklist; acceptance criteria are specific to a backlog item.

Change control sequence: request, impact assessment, approval, implementation, verification, and closure.

RACI assigns Responsible, Accountable, Consulted, and Informed; exactly one accountable owner exists per activity.

CPI = EV / AC; CPI below 1 means cost overrun. SPI = EV / PV; SPI below 1 means schedule delay.

MoSCoW prioritizes Must, Should, Could, and Will-not-have requirements; Must items define the minimum usable release.

An architecture review board governs standards exceptions and design decisions; approved exceptions require documented rationale and expiry.

SLI is the measured indicator; SLO is the target range; SLA is the external agreement with consequences.

A risk register records probability, impact, owner, response, trigger, and status; review cadence is set by risk exposure.

IaaS provides virtualized compute, storage, and network; PaaS adds managed runtime; SaaS delivers complete applications; the customer always owns data access governance.

Availability = (total time - downtime) / total time. 99.9% allows about 43.8 minutes downtime per 30-day month; 99.99% allows about 4.38 minutes.

Horizontal scaling adds instances; vertical scaling adds resources to one instance; stateless services are candidates for horizontal scaling.

Blue-green uses two environments and a traffic switch; canary releases route a small percentage first and expand after validation.

Backup rule 3-2-1: three copies, two media types, one off-site or isolated copy.

Golden signals are latency, traffic, errors, and saturation; saturation predicts queueing and failure before utilization reaches 100%.

DR strategies from low to high cost and speed: backup and restore, pilot light, warm standby, multi-site active-active; tighter RTO and RPO increase cost.

Immutable infrastructure replaces instances instead of patching in place; rollback redeploys a previously validated image.

Cloud cost controls include rightsizing, auto-scaling, reserved capacity for steady load, spot capacity for fault-tolerant work, and mandatory tagging.