IBM Cloud Professional Architect v6 cheat sheet

IBM Cloud resource hierarchy: account > resource group > service instance; a resource group is required for every service instance and cannot be changed after provisioning.

VPC infrastructure (VPC Infrastructure Services) is regional; a VPC spans one region but subnets are zonal. Deploy across at least two zones for HA.

Classic Infrastructure and VPC Infrastructure are separate networks; connectivity between them requires Transit Gateway or a classic-to-VPC connection.

Transit Gateway connects VPCs, classic infrastructure, and Direct Link across regions without full-mesh peering; use it when more than two networks must interconnect.

Region/zone selection rule: choose a region with at least three zones for production HA and one geographically near the data-residency requirement.

IBM Cloud Kubernetes Service (IKS) and Red Hat OpenShift on IBM Cloud are managed offerings; single-zone vs multizone clusters determine control-plane and worker-node SLA.

Cloud Foundry is deprecated for new workloads; use IBM Cloud Code Engine for serverless containers or IKS/OpenShift for orchestrated containers.

Reference architecture pattern: global load balancer (CIS) > regional load balancer > multi-zone app tier > managed database with cross-region backup.

IBM Cloud CLI uses 'ibmcloud' groups; target a resource group with 'ibmcloud target -g ' before creating services so instances land in the intended group.

Infrastructure as Code: IBM Cloud Schematics runs Terraform; use it for repeatable provisioning and drift detection rather than manual CLI calls.

Secrets belong in IBM Cloud Secrets Manager or Hyper Protect Crypto Services, never in environment variables or Git.

IBM Cloud Object Storage uses bucket + object; choose the resiliency tier: Cross Region, Regional, or Single Data Center (deprecated for new buckets).

Code Engine projects run container images or source builds with scale-to-zero; suited to event-driven and batch workloads without cluster management.

Event-driven integration: Event Streams (Kafka) for streaming, IBM MQ for messaging, IBM Cloud Functions (now Code Engine functions) for serverless handlers.

API exposure: API Connect or the VPC load balancer; terminate TLS at the edge and keep backend traffic on private subnets.

Tagging strategy: apply tags at creation for cost allocation and access governance; tags are inherited by resource but not by child resources automatically.

Modernization ladder: rehost (lift-and-shift) > replatform (managed service swap) > refactor (cloud-native) > retire/replace; choose per workload, not per portfolio.

IBM Cloud Migration Center / Migration Advisor assesses VMware and on-prem workloads and estimates sizing and cost before migration.

VMware workloads: IBM Cloud for VMware Solutions (VCD) provides dedicated or shared SDDC; keep the same vSphere tooling and NSX networking.

Database modernization path: Db2 on-prem > Db2 on Cloud or Db2 Warehouse; open-source > IBM Cloud Databases for PostgreSQL/MySQL/MongoDB/Redis.

Containerization path: move VMs to IKS/OpenShift, externalize state into managed services, then scale stateless pods horizontally.

Cutover rule: replicate data first, run parallel validation, then switch DNS/load balancer traffic; keep the source available for rollback until validation passes.

Mainframe/AS400 modernization uses IBM Cloud Pak for Data and integration services; plan for data gravity and latency to on-prem sources.

Cost model shift: migration from capex to opex means reserved vs on-demand capacity decisions should be made per workload SLA.

IAM model: users, service IDs, access groups, and policies; a policy binds a subject to a role on a resource, resource group, or account.

Platform roles (Viewer, Editor, Operator, Administrator) govern resource management; service roles (Reader, Writer, Manager) govern service data access.

API keys belong to a user or service ID; rotate them and never embed them in client code. Use IAM trusted profiles for federated workloads.

Hyper Protect Crypto Services provides FIPS 140-2 Level 4 keystore with keep-your-own-key (KYOK); Key Protect is FIPS 140-2 Level 3.

VPC security groups are stateful, attached to network interfaces; ACLs are stateless and applied at subnet level. Use both for defense in depth.

Activity Tracker records account-level API events; Log Analysis and Monitoring collect operational telemetry. Both are regional and must be provisioned per region.

Compliance: IBM Cloud offers SOC 2, ISO 27001, HIPAA, PCI DSS, and FedRAMP depending on service; check the service's compliance tab before committing.

Data residency: select a region whose data centers are in the required jurisdiction; Cross Region COS buckets may replicate outside the primary region.

SLA math: independent components multiply availability (0.999 x 0.999 = 0.998); serial dependencies reduce overall availability, parallel redundancy raises it.

RTO is maximum tolerable downtime; RPO is maximum tolerable data loss. Backup frequency drives RPO, failover automation drives RTO.

IBM Cloud Backup and VPC Block Storage snapshots provide recovery points; snapshots are incremental and stored in the same region by default.

Autoscaling: IKS horizontal pod autoscaler scales pods; VPC instance groups scale VMs; Code Engine scales to zero when idle.

Cost controls: use resource groups and tags for chargeback, reserved capacity for steady-state workloads, and stop non-production instances outside business hours.

IBM Cloud Monitoring (Sysdig) and Log Analysis (LogDNA) are the observability stack; configure alerts on SLOs, not raw CPU.

FinOps rule: right-size by reviewing 30-day utilization; a resource under 20% average utilization is a candidate for downsizing or consolidation.

Disaster recovery tiers: backup/restore (highest RTO), pilot light, warm standby, active-active (lowest RTO, highest cost).