AWS cheat sheet

1. 1Global infrastructure and accountsWhere AWS runs your resources, how accounts separate them, and how you talk to AWS from a terminal.8 concepts

   1. 1RegionsA region is a separate geographic cluster of data centres, such as eu-west-2 (London).
   2. 2Availability zonesEach region has several availability zones: one or more data centres with independent power, cooling and networking, linked by low-latency private fibre.
   3. 3Edge locations and global servicesEdge locations are hundreds of smaller sites in cities worldwide that run CloudFront, Route 53 and Global Accelerator close to users.
   4. 4Shared responsibility modelAWS secures the cloud: hardware, facilities, the hypervisor and managed service internals.
   5. 5Accounts and the root userAn AWS account is a container for resources and the hard boundary for billing, quotas and security.
   6. 6AWS Organizations and SCPsOrganizations groups accounts under a management account, arranged in organisational units, with consolidated billing.
   7. 7ARNsAn ARN uniquely names a resource: arn:partition:service:region:account-id:resource.
   8. 8AWS CLI, profiles and queriesThe AWS CLI calls every service API from a shell.

   8 in this chapterOpen this chapter
2. 2IAM and access controlEvery API call on AWS is authenticated and then checked against policies. Getting IAM right is most of AWS security.10 concepts

   1. 1IAM users, groups and rolesA principal is who makes a request.
   2. 2Policy documentsA policy is JSON with statements.
   3. 3Identity-based vs resource-based policiesIdentity-based policies attach to a user, group or role and say what it may do.
   4. 4Policy evaluation logicEvery request starts denied.
   5. 5Least privilege and Access AnalyzerLeast privilege means granting only the actions and resources a principal needs.
   6. 6Policy conditionsA Condition block adds rules to a statement using keys such as aws:SourceIp, aws:PrincipalOrgID, aws:SecureTransport, aws:RequestedRegion or resource…
   7. 7STS and assuming rolesThe Security Token Service issues temporary credentials when a principal assumes a role.
   8. 8IAM Identity CenterIdentity Center is the central sign-in for people across all accounts in an organisation.
   9. 9Permissions boundariesA permissions boundary is a managed policy attached to a user or role that caps the permissions its identity policies can grant.
   10. 10KMS, Secrets Manager and Parameter StoreKMS manages encryption keys used by S3, EBS, RDS and others, with every use logged.

   10 in this chapterOpen this chapter
3. Compute: EC2, Lambda and containersVirtual machines, functions and containers: what each runs well, how it scales and how it is billed.8 conceptsOpens with credits
4. Storage: S3, EBS and EFSObject storage for files and data, block storage for instance disks and shared file systems, and how to keep each safe and cheap.7 conceptsOpens with credits
5. Databases and cachingManaged relational databases, DynamoDB for key-value access at any scale, and in-memory caches.7 conceptsOpens with credits
6. Networking: VPC, load balancing and edgeHow traffic reaches your resources and how you keep private things private: VPCs, routing, firewalls, load balancers, DNS and CDN.9 conceptsOpens with credits
7. Messaging and eventsQueues, pub/sub and event buses let services work independently and absorb load spikes. Pick the one that matches the shape of your messages.6 conceptsOpens with credits
8. Observability and auditMetrics, logs and alarms tell you how workloads behave; audit trails tell you who changed what.6 conceptsOpens with credits
9. Infrastructure as codeDefine AWS resources in reviewed, versioned files instead of console clicks, so every environment can be rebuilt the same way.6 conceptsOpens with credits
10. Cost control and Well-ArchitectedKnow where the money goes, stop surprises early, and review designs against AWS's six pillars.6 conceptsOpens with credits
11. 11Glossary, A to ZEvery concept in the sheet and the smaller terms it uses, in one list.107 terms

The AWS services and ideas you use to build, secure, run and pay for real workloads, with CLI commands and policy JSON.