SAA4 Cheat sheet — Design Cost-Optimized Architectures (Domain 4, 20%)

Verified 2026-09-25 against the pages cited in each lesson. Items marked [unverified] were not retrieved from a page I fetched — look them up. Prices name the Region the page showed; they drift.

The rule

Cheapest option that still meets the stated requirement. Every cheap option has a condition — the distractor is the one whose condition the stem violates.

Tools (all four task statements)

Want to…	Use
see / trend / forecast	Cost Explorer — 13 months back, 18 months forecast; console free, API $0.01/paginated request; can't disable
be warned (actual or forecasted)	AWS Budgets — cost · usage · RI util/coverage · SP util/coverage; SNS/email; updated up to 3×/day, 8–12 h apart
act on a threshold	budget action → IAM policy · SCP · stop EC2/RDS; auto or approval. Mgmt acct can SCP another acct, can't target its instances
raw line items, hourly, per resource	Cost and Usage Report → your S3; Athena/Redshift/Quick. Now CUR 2.0 in Data Exports
split by team	cost allocation tags — `user:` / `aws:`; must be activated; management account only; up to 24 h
one bill, pooled discounts	consolidated billing — shares volume, RI and Savings Plans discounts; no extra fee
right-size	Compute Optimizer — opt in; 14 days default, 93 days enhanced (paid)
find waste (idle ELB, unattached EIP)	Trusted Advisor cost checks — [unverified] which plan gets which checks

⚠️ A budget alert is a smoke alarm; a budget action is the circuit breaker.

Storage (4.1)

Class	Min duration	Min size	Retrieval	AZs
Standard	—	—	—	≥3
Intelligent-Tiering	—	— (objects < 128 KB never tier)	no retrieval fees; monitoring fee	≥3
Standard-IA	30 d	128 KB	per GB	≥3
One Zone-IA	30 d	128 KB	per GB	1
Glacier Instant	90 d	128 KB	per GB, ms	≥3
Glacier Flexible	90 d	+40 KB metadata	Exp 1–5 min · Std 3–5 h · Bulk 5–12 h (free)	≥3
Deep Archive	180 d	+40 KB metadata	Std ≤12 h · Bulk ≤48 h	≥3

30 / 90 / 180. 128 KB. Early delete = charged for the remainder.
Monthly access → Standard-IA. Quarterly → Glacier IR (cheaper storage, dearer reads).
One Zone-IA only for re-creatable data or replicas.
Intelligent-Tiering: IA after 30 d, Archive Instant after 90 d; opt-in Archive/Deep Archive tiers.
Lifecycle = waterfall down. Glacier Flexible → Deep Archive only. Deep Archive is one-way. One Zone-IA → Glacier Flexible / Deep Archive only. Objects < 128 KB don't transition by default (since Sept 2024). Glacier billing starts on the rule date.
Aggregate small objects before archiving (40 KB overhead each; per-request transition charges).
Requester Pays: requester pays requests + download; owner always pays storage; no anonymous access; header x-amz-request-payer.
S3: data in from internet free; S3 → same-Region service free; S3 → CloudFront free. Requests and lifecycle transitions billed per 1,000. [unverified] per-request rates (didn't render).
EBS: SSD = IOPS, HDD = throughput. st1/sc1 not bootable, 125 GiB–16 TiB. gp3 20% cheaper/GiB than gp2, 3,000 IOPS + 125 MiB/s included, performance independent of size; migrate online. Snapshots incremental (deleting one may not save). Snapshot Archive up to 75% cheaper for ≥ 90 days, converts to full.
EFS: → IA after 30 d, → Archive after 90 d (defaults); not moved back unless "On first access". IA and Archive: 128 KiB minimum billable file size; Archive 90-day minimum duration; tiering is charged. [unverified] any EFS IA minimum duration.
FSx Windows: HDD cheaper; dedup 50–60% typical; storage can only grow; SSD→HDD needs restore.
RDS storage autoscaling: ≤ 10% free for ≥ 5 min → grows; never shrinks.
AWS Backup: incremental (most types), cold storage ≥ 90 days (retention ≥ cold-after + 90).
Hybrid: DataSync (move/archive files) · Transfer Family (SFTP/FTPS/FTP/AS2 → S3/EFS) · Storage Gateway (File, FSx File, Tape, Volume).
⚠️ No Snowball — dropped from the HTML guide.

Compute (4.2)

Workload	Buy
steady 24/7	Savings Plan (or RI)
interruptible, flexible	Spot — up to 90% off
short, spiky, can't be interrupted	On-Demand — per second, 60 s min
per-socket/core licences, host visibility	Dedicated Host (per-host billing)
single-tenant, no licence angle	Dedicated Instance (per-instance billing)
discount + capacity in one AZ	zonal RI (or Capacity Reservation)

Savings Plans (1 or 3 yr, $/hour, can't change after purchase):

	Up to	Scope
Compute	66%	any family/size/Region/OS/tenancy + Fargate + Lambda
EC2 Instance	72%	one family in one Region
Database	35%	Aurora, RDS, DynamoDB, ElastiCache, … incl. serverless
SageMaker AI	64%	SageMaker instances

⚠️ Spot is NOT covered by Savings Plans and doesn't count toward the commitment. ⚠️ Dedicated Instance $2/hour per Region fee is not discounted by SPs. EKS charges not covered.

RIs: AWS "recommend[s] Savings Plans over Reserved Instances". Billing discount, not an instance. Standard = biggest discount, modify only. Convertible = exchangeable. Can't cancel. Don't auto-renew. Regional = no capacity, any AZ, size-flexible (Linux, default tenancy). Zonal = reserves capacity, one AZ. Same price.

Spot interruption notice = 2 minutes. Via EventBridge + instance metadata (spot/instance-action), check every 5 s, best effort. Hibernate behaviour ⇒ no 2-minute warning. Rebalance recommendation = earlier risk signal.

Hibernation: RAM → EBS root; for slow warm-up; no instance charge while stopped, EBS still billed. [unverified] prerequisites (encryption, RAM, duration).

Right-size: match family to bottleneck, smallest size that works. T burstable for dev/test and small DBs · flex 40% baseline · Graviton best price-performance · HVM only on current gen.

Lambda: requests + GB-seconds, 1 ms rounding; free 1M requests + 400,000 GB-s/month. Fargate: vCPU + memory + storage, per second, 1-min min (Linux); Fargate Spot up to 70%. Lambda saves money on idle time, not busy time.

Outposts: on-prem AWS for latency / local processing / residency; racks (42U) or servers (1U/2U); contract term. Not a cost play.

Database (4.3)

Load	Choice
spiky / unknown / dev-test	Aurora Serverless (ACU ≈ 2 GiB; 0–256 ACU; 0 = auto-pause on newer versions) · DynamoDB on-demand
steady / forecastable	provisioned + reserved DB instances / Database SP · DynamoDB provisioned + auto scaling (target 70%)

DynamoDB on-demand is now the default and recommended mode. Provisioned bills provisioned, not consumed. Switch prov→on-demand 4× per 24 h; back any time.
RCU = 1 strongly consistent (or 2 eventually consistent) read/s up to 4 KB. WCU = 1 write/s up to 1 KB. Round up per item. Reads are eventually consistent by default.
Standard-IA table class when storage dominates.
Reserved DB instances: 1/3 yr; No Upfront 1-yr only; cover Multi-AZ; don't discount storage, backups, I/O; no size flexibility for SQL Server / Oracle LI; can't cancel; shared across the org.
Backups: retention 0–35 days (0 = off; switching to/from 0 = outage); default 1 d (API) / 7 d (console); >35 days ⇒ manual snapshots / AWS Backup. Manual snapshots survive deletion; 100/Region.
Migration: homogeneous = DMS; heterogeneous = DMS Schema Conversion or SCT, then DMS.
Caching: lazy loading (miss penalty, stale) · write-through (never stale, churn, missing on new node) · +TTL (best of both).
Columnar (Redshift) for analytic scans; Timestream for time series (memory → cost-optimised tier).
[unverified] a MySQL-vs-PostgreSQL cost difference — the licensing signal is commercial vs open source.

Network (4.4)

Path	Charge
internet → AWS	free
AWS → internet	charged; 100 GB/month free (aggregate)
AZ ↔ AZ	$0.01/GB in each direction (EC2, RDS, Redshift, DAX, ElastiCache, ENIs)
same AZ	free
EC2 ↔ S3/DynamoDB/SQS/SNS… same Region	free — unless a NAT gateway, TGW or PrivateLink endpoint is in the path (their processing charges apply)
Region → Region	charged on the source's outbound; inbound free
S3 → same-Region service / → CloudFront	free
AWS origin → CloudFront	waived
VPC peering same AZ	free; cross-AZ $0.01/GB in both "In" and "Out" direction (VPC pricing page)
Direct Connect in	$0.00/GB

[unverified] internet-egress per-GB tiers (table didn't render).

Gateway endpoints (S3, DynamoDB): no additional charge. Take S3 traffic off the NAT. Same Region only; not usable through peering. Everything else → interface endpoint (charged).
NAT gateway: hourly + per GB processed (Ohio: $0.045/h + $0.045/GB); HA in its AZ; 100 Gbps; AWS-managed. NAT instance: instance cost only; you patch and fail over; supports SGs, port forwarding, bastion. AWS recommends the gateway.
One NAT (dev: fewer hourly charges, cross-AZ traffic, AZ = SPOF) vs one per AZ (prod: "zone-independent", no cross-AZ).
Peering: "lowest overall cost", no processing fee, not transitive, < 10 VPCs; 100 VPCs full mesh = 4,950 links; 125 per VPC max.
Transit Gateway (Ohio): $0.05/attachment-hour + $0.02/GB. Hub-and-spoke; many VPCs + on-prem.
VPN: 1.25 Gbps/tunnel (5 Gbps large); Ohio $0.05/h; **> bandwidth = multiple VPNs on TGW
- ECMP + dynamic routing**.
Direct Connect: port-hours + data out; in free; dedicated 1–400 Gbps, hosted from 50 Mbps; lower egress rate; bypasses ISPs.
CloudFront: origin fetch waived; free plan 1M requests / 100 GB; flat-rate plans exist.
API Gateway throttling: token bucket; per-client (usage plan + API key) → per-method → account → Regional; 429; best effort.
[unverified] Global Accelerator, ELB, Route 53, interface endpoint, CloudFront price-class pricing.

Five things to carry in

30 / 90 / 180 days, 128 KB — the S3 minimums.
Spot = 2-minute notice (none if hibernating). Spot and Savings Plans don't stack.
Compute SP 66% flexible; EC2 Instance SP 72% locked. RIs only win for zonal capacity.
Gateway endpoints for S3/DynamoDB cost nothing — and remove NAT per-GB charges.
In is free, out is charged, across AZs is charged both ways, across Regions on the way out.