SAA-C03 Cheat Sheet

Range /16 to /28. Maximum 5 VPCs per region (soft limit). Subnets live inside the VPC.

Has a route table with a 0.0.0.0/0 → Internet Gateway route. Instances need a public IP.

No route to an IGW. To reach the internet it uses a NAT Gateway (in a public subnet) or a NAT Instance.

NACL = stateless, subnet level, numbered rules, evaluates deny/allow. SG = stateful, instance level, allow only.

Managed by AWS, highly available per AZ. Lets private instances access the internet. Not free.

Captures IP traffic from ENIs. Destination: CloudWatch Logs or S3. Useful for troubleshooting and auditing.

Static public IP assigned to your account. Free while attached to a running instance. Costs money if unused.

Cluster = low latency (same rack). Spread = HA (separate instances). Partition = scale (Kafka, Cassandra).

General-purpose SSD. Baseline 3000 IOPS, 125 MiB/s throughput. Scales IOPS/throughput independently.

High-performance SSD. Up to 256K IOPS. For critical databases, sub-millisecond latency.

Ephemeral storage local to the physical host. Maximum speed. Lost on stop/terminate/hardware failure.

Amazon Machine Image. Includes OS, configuration, EBS data. Regional — copy it to another region to use it there.

Saves RAM contents to EBS. Resumes quickly. Maximum 60 days. Root volume must be encrypted.

io1/io2 only. Attach a single volume to multiple EC2 instances in the same AZ. Requires a cluster-aware FS.

99.999999999% (11 nines) for all objects across every class except One Zone-IA.

High availability 99.99%. Frequent access. No minimum duration.

Automatically moves objects between tiers. No retrieval fee. Ideal for unpredictable access.

Millisecond retrieval. Min 90 days. For archival data accessed quarterly.

Cheapest option. Retrieval 12h standard, 48h bulk. Min 180 days. For legal archives.

Uses CloudFront edge locations for fast uploads from distant geographies.

Mandatory for objects >5 GB. Recommended >100 MB. Allows retrying failed parts.

WORM — Write Once Read Many. Governance mode (admin can delete) or Compliance mode (no one can).

Identity-based (attached to user/role/group). Resource-based (attached to the resource, S3, KMS). Permission boundaries.

Maximum permission limit for a user/role. Even with an allow policy, the boundary can restrict it.

Defines WHO can assume the role (Principal). E.g.: EC2 service, another account, federated user.

Explicit DENY always wins. Then: Permission Boundaries → SCP → Resource-based → Identity-based.

Grant only the permissions needed. Never use AdministratorAccess in production. Review regularly with Access Analyzer.

Roles for EC2/Lambda/ECS — no hard-coded credentials. Access Keys only for human users or CI/CD pipelines.

Applied in AWS Organizations at the OU or account level. Restrict the maximum permissions of every user in that OU.

Synchronous replication to a standby in another AZ. Automatic failover in <2 min. NOT for reading — HA only.

Asynchronous replica for reads. Can be in another region. NOT for automatic HA.

6 copies of data across 3 AZs automatically. Failover <30s. Up to 15 Read Replicas. Storage auto-scales up to 128 TB.

EC2 (instance status checks) or ELB (load balancer health checks). ELB is more granular for apps.

Pauses the lifecycle (launch or termination) to run actions: install software, drain sessions.

Primary/Secondary. Route 53 health checks determine when to redirect to the secondary. Requires an endpoint health check.

Distributes traffic across AZs automatically. Cross-zone load balancing is on by default in ALB.

Up to 90% discount. Can be interrupted with a 2-minute warning. Ideal for batch, CI/CD, stateless.

1 or 3 years. Up to 72% discount. Standard RI = specific instance. Convertible RI = can change type.

$/hour commitment for 1-3 years. Compute SP applies to EC2, Lambda, Fargate. More flexible than RI.

Automatic transitions between storage classes and object expiration. Reduces storage cost.

Visualizes and analyzes historical costs and forecasts. Identifies trends. Exports to CSV.

Alerts when projected/actual cost exceeds thresholds. Can trigger actions (disable services).

5 categories: Cost, Performance, Security, Fault Tolerance, Service Limits. Business/Enterprise tier for all checks.