CLF cheat sheet

Six advantages of cloud computing: trade fixed capital expense for variable expense; benefit from massive economies of scale; stop guessing capacity; increase speed and agility; stop spending money running and maintaining data centers; go global in minutes.

Cloud computing definition: on-demand delivery of compute, database, storage, applications, and other IT resources over the internet with pay-as-you-go pricing.

Three cloud deployment models: cloud (fully in the cloud), on-premises (private cloud, sometimes called on-prem), and hybrid (connecting cloud resources to on-premises infrastructure).

Three cloud service models: IaaS (you manage OS and up), PaaS (you manage applications and data only), SaaS (you manage only user access and configuration).

AWS Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

High availability means designing for minimal downtime across Availability Zones; fault tolerance means the workload keeps running despite component failure; disaster recovery restores service after a large-scale event.

Elasticity is automatic short-term capacity matching to demand; scalability is the ability to grow capacity structurally (vertical = larger instance, horizontal = more instances).

AWS Regions are geographic areas containing multiple isolated Availability Zones; AZs are one or more discrete data centers with redundant power, networking, and connectivity.

Edge locations and points of presence are used by services such as Amazon CloudFront and Route 53 to serve content and DNS closer to users.

Shared Responsibility Model: AWS is responsible for security OF the cloud (facilities, hardware, network, virtualization layer); the customer is responsible for security IN the cloud (data, IAM, guest OS, encryption, firewall configuration).

AWS Identity and Access Management: users are long-term identities, roles are assumed temporarily and issue short-lived credentials, policies are JSON documents evaluated as explicit deny > explicit allow > implicit deny.

Least privilege principle: grant only the permissions required to perform a task, and scope permissions with conditions and resource ARNs rather than wildcards.

Multi-factor authentication (MFA) adds a second factor to sign-in; AWS supports virtual MFA apps, hardware TOTP tokens, and FIDO security keys for the root user and IAM identities.

Encryption at rest protects stored data (Amazon S3 SSE-S3, SSE-KMS, SSE-C; EBS and RDS encryption) and encryption in transit protects data moving across networks using TLS.

AWS CloudTrail records API activity for auditing; Amazon GuardDuty detects threats; AWS Config evaluates resource configuration; AWS Artifact provides compliance reports and agreements.

AWS Shield Standard provides automatic DDoS protection at no extra cost; Shield Advanced adds enhanced detection and response for a subscription fee.

Security groups are stateful, instance-level virtual firewalls that allow rules only; network ACLs are stateless, subnet-level and support both allow and deny rules.

Compliance frameworks reported by AWS include SOC 1/2/3, ISO 27001, PCI DSS, HIPAA eligibility, and FedRAMP; customers inherit controls from AWS but must satisfy their own controls.

Compute decision rule: Amazon EC2 for full control of servers; AWS Lambda for event-driven code without managing servers; containers on Amazon ECS or Amazon EKS for portable packaged workloads; AWS Fargate to run containers without managing hosts.

EC2 pricing options: On-Demand (no commitment), Savings Plans and Reserved Instances (1- or 3-year commitment for discount), Spot Instances (up to 90% discount, interruptible), Dedicated Hosts (physical server for licensing or compliance).

Storage decision rule: Amazon S3 for object storage; Amazon EBS for block storage attached to a single EC2 instance; Amazon EFS for shared Linux file storage; Amazon FSx for Windows or high-performance file systems; AWS Storage Gateway for hybrid storage.

Amazon S3 storage classes: S3 Standard, S3 Intelligent-Tiering, S3 Standard-IA, S3 One Zone-IA, S3 Glacier Instant Retrieval, S3 Glacier Flexible Retrieval, S3 Glacier Deep Archive, ordered from most to least frequently accessed.

Databases: Amazon RDS for managed relational engines (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server); Amazon Aurora for AWS-built MySQL/PostgreSQL-compatible relational; Amazon DynamoDB for serverless key-value NoSQL; Amazon Redshift for data warehousing analytics.

Networking: Amazon VPC provides an isolated virtual network; an internet gateway connects a VPC to the internet; a NAT gateway lets private subnets reach the internet outbound; AWS Direct Connect is a dedicated private link from on-premises to AWS.

Amazon Route 53 is a managed DNS service with routing policies including simple, weighted, latency, failover, and geolocation; Amazon CloudFront is a content delivery network caching content at edge locations.

Management and governance: AWS CloudWatch for metrics, logs, and alarms; AWS CloudTrail for API audit history; AWS Trusted Advisor for best-practice checks; AWS Organizations for multi-account management and consolidated billing.

AWS global infrastructure services: Regions, Availability Zones, edge locations, and Local Zones; AWS Global Accelerator improves availability and performance using the AWS global network.

AWS pricing fundamentals: pay-as-you-go, pay less when you reserve, and pay even less per unit by using more (volume discounts and tiered pricing).

Total cost of ownership (TCO) compares the full cost of on-premises ownership (hardware, power, cooling, facilities, staff, licenses) against AWS usage costs; the AWS Pricing Calculator estimates monthly AWS costs before deployment.

AWS Free Tier has three types: always free (for example AWS Lambda request allowances), 12 months free (for example Amazon EC2 t2.micro/t3.micro hours), and trials (short-term offers such as Amazon SageMaker).

AWS Support plans from least to most comprehensive: Basic, Developer, Business, Enterprise On-Ramp, and Enterprise; only Business, Enterprise On-Ramp, and Enterprise include 24/7 phone, chat, and email support with production guidance.

Basic Support is included at no extra charge and provides customer service, documentation, whitepapers, and AWS Trusted Advisor core checks.

Enterprise Support includes a Technical Account Manager (TAM), a designated Cloud Support Engineer, and a 15-minute response time for business-critical system down cases.

AWS Organizations consolidated billing aggregates usage across accounts so volume discounts apply, and unused Reserved Instance discounts can be shared across accounts in the organization.

Billing tools: AWS Budgets sets custom cost or usage alerts; AWS Cost Explorer visualizes and forecasts spend; the AWS Cost and Usage Report is the most granular billing dataset.

AWS Marketplace is a digital catalog for buying third-party software that bills through the AWS account.