Cheatsheet

AWS Solutions Architect Associate

Architecture rules of thumb for the Solutions Architect Associate exam: which service fits which problem.

Resilient design

```
Multi-AZ
```
Survive the loss of a data centre: RDS Multi-AZ, ELB across zones, Auto Scaling across zones
```
Read replicas
```
Scale reads (and cross-Region): they are not the failover
```
Route 53 routing
```
Failover, weighted, latency, geolocation, multi-value answer
```
Backup and recovery levels
```
Backup and restore (cheapest) -> pilot light -> warm standby -> multi-site active/active (fastest)
```
SQS between tiers
```
Decouple producers and consumers so a slow part does not stop the rest
```
S3 Cross-Region Replication
```
Copy objects to another Region for recovery or latency

```
S3 Standard / IA / One Zone-IA / Glacier tiers
```
Pay less as access becomes rarer; Intelligent-Tiering moves data for you
```
S3 lifecycle rules
```
Transition to cheaper classes and expire old objects automatically
```
EBS gp3 / io2
```
General purpose SSD; provisioned IOPS for databases
```
EFS
```
Shared NFS for many Linux instances across zones
```
FSx
```
Managed Windows file shares or high-performance Lustre
```
Storage Gateway / DataSync / Snowball
```
Hybrid access, online transfer, and offline bulk transfer

```
RDS / Aurora
```
Relational. Aurora: faster, up to 15 replicas, storage grows automatically
```
DynamoDB
```
Key-value at any scale; on-demand or provisioned; DAX for microsecond reads
```
ElastiCache (Redis / Memcached)
```
In-memory cache in front of a database
```
Redshift
```
Data warehouse for analytics (columnar, SQL)
```
Neptune / DocumentDB / Keyspaces / QLDB
```
Graph, document, wide-column and ledger databases
```
RDS Proxy
```
Pool connections so Lambda and bursts do not exhaust the database

```
Public vs private subnet
```
Public has a route to an internet gateway; private reaches out through a NAT gateway
```
Security group vs network ACL
```
Instance-level and stateful vs subnet-level and stateless
```
VPC endpoints
```
Gateway (S3, DynamoDB) and interface (PrivateLink): reach AWS services without the internet
```
VPC peering vs Transit Gateway
```
One-to-one links vs a hub that connects many VPCs and networks
```
Direct Connect vs Site-to-Site VPN
```
Dedicated private line vs encrypted tunnel over the internet
```
CloudFront / Global Accelerator
```
Cache content at the edge / route to the best endpoint over the AWS network
```
ALB / NLB / GWLB
```
HTTP-aware routing / very fast TCP-UDP / inspect traffic with appliances

```
IAM roles over keys
```
Give services and instances roles; avoid long-lived access keys
```
SCPs (Organizations)
```
Guard rails that limit what accounts can ever do
```
KMS and CMKs
```
Manage encryption keys; encrypt at rest and in transit
```
Secrets Manager vs Parameter Store
```
Rotating secrets vs simple configuration values
```
WAF / Shield / GuardDuty
```
Filter web attacks / absorb DDoS / detect threats
```
CloudTrail / Config
```
Who did what / what changed and does it comply

```
Right size and scale
```
Match instance types to load; use Auto Scaling policies (target tracking)
```
Compute pricing
```
On-Demand, Savings Plans, Reserved, Spot (interruptible), Dedicated Hosts for licences
```
Serverless first
```
Lambda, Fargate, DynamoDB, S3: no idle servers to pay for
```
Caching layers
```
CloudFront, ElastiCache, DAX, API Gateway caching
```
Data transfer
```
Into AWS is free; between Regions and out to the internet costs: keep traffic in a zone or Region

```
SQS standard / FIFO
```
At-least-once, unordered, huge throughput / ordered and exactly-once, lower throughput
```
SNS
```
Publish once, fan out to many subscribers
```
SNS + SQS fan-out
```
One event delivered to several queues for independent consumers
```
EventBridge
```
Route events from AWS services and apps by rules
```
Step Functions
```
Coordinate multi-step workflows with retries and branching
```
Kinesis
```
Real-time streaming data in order, per shard