SAAF Cheat sheet — Fundamentals

Verified 2026-09-25 against the pages cited in each lesson. Items marked [unverified] were not retrieved from a page I fetched — look them up.

Cloud computing — two lists, don't mix them

AWS definition: "on-demand delivery … via the internet with pay-as-you-go pricing."

NIST SP 800-145 — 5 essential characteristics	AWS — 6 advantages
On-demand self-service	Trade fixed expense for variable expense
Broad network access	Benefit from massive economies of scale
Resource pooling	Stop guessing capacity
Rapid elasticity	Increase speed and agility
Measured service ("pay-per-use")	Stop spending money running and maintaining data centers
	Go global in minutes

Service models: IaaS → PaaS → SaaS. ⚠️ The OS is the line — IaaS consumer "has control over operating systems"; PaaS consumer "does not".

Deployment models: AWS = Cloud · Private cloud (on-premises) · Hybrid. NIST = private · community · public · hybrid. AWS has no community cloud; AWS equates private cloud with on-prem.

Exam guide target candidate: "at least 1 year of hands-on experience designing cloud solutions that use AWS services." No recommended-knowledge list on the HTML home page.

Global infrastructure

Thing	Key words (verbatim)
Region	"a separate geographic area" · "isolated from the other Regions" · "we don't automatically replicate them for you"
AZ	"one or more discrete data centers" · "dedicated metro fiber" · "within 100 km (60 miles) of each other" (S3 page)
Local Zone	"an extension of an AWS Region in geographic proximity to your users" · enable → subnet → launch · e.g. `us-west-2-lax-1`
Wavelength Zone	"edge of communications service providers' (CSP) networks" · 5G · carrier gateway · opt in
Outpost	AWS capacity "at a customer site" · "as part of an AWS Region" · exam's hybrid-compute example
Edge location / POP	CloudFront; request "routed to the edge location that provides the lowest latency"

Counts (2026-09-25): docs say "34 Regions" (standard accounts); marketing says "124 Availability Zones within 39 Geographic Regions", "750+" CloudFront POPs. Not reconciled. Not tested.
AZs per Region: "at least three" — but some accounts see fewer (N. California: "two" for newer accounts; constrained AZs).
Opt-in: Regions introduced after March 20, 2019 must be enabled. 17 default / 17 opt-in.
Partitions: standard · GovCloud (US-West, US-East) · China (Beijing, Ningxia). Can't see across.
⚠️ AZ name ≠ AZ ID. Accounts created before Nov 2025 in oldest Regions: us-east-1a may differ per account. AZ ID (use1-az1) = "same physical location in every AWS account".
Choosing a Region (per AWS pages): services available · latency to users · legal/regulatory. Residency = filter, not trade-off. [unverified on Region pages] price per Region.
Local Zones: no VPC endpoints · no Site-to-Site VPN · no charge to enable. Not named on In-Scope list (Wavelength and Outposts are).
Backbone: AWS→AWS traffic "stay[s] on the AWS global network" even to public IPs (except China, European Sovereign Cloud).

Zonal / Regional / Global

Source: AWS Fault Isolation Boundaries whitepaper (Nov 16, 2022) + each service's page.

Scope	Test	Examples (verified)	To survive more
Zonal	you choose the AZ	EC2 instance · EBS volume ("must be in the same Availability Zone") · subnet · EFS One Zone · S3 One Zone-IA	2nd AZ
Regional	one Regional endpoint	S3 (≥3 AZs) · DynamoDB (3 AZs, 99.99%) · SQS (whitepaper) · EFS Regional	2nd Region + replication
Global	control plane in ONE Region, data plane everywhere	IAM · Organizations (`us-east-1`) · Route 53 public DNS · CloudFront · ACM/WAF for CloudFront (`us-east-1`) · Global Accelerator · ARC (`us-west-2`)	keep its control plane out of recovery

Static stability: 6 needed across 3 AZs → run 9 (3 per AZ) → +50%.
⚠️ "AWS does not provide a synchronous Cross-Region replication feature" → cross-Region RPO > 0.
⚠️ S3 CreateBucket/DeleteBucket depend on us-east-1 (global name uniqueness).
⚠️ SDK/CLI STS defaults to us-east-1 → use Regional STS endpoints.
Route 53 health checks run from eight Regions (data plane).
Anti-patterns in a failover: change R53 records/weights · create IAM roles · change GA dials · edit CloudFront origins · provision ELB/RDS (creates R53 records). → Pre-provision. Data plane only.
RDS: single-AZ = zonal; Multi-AZ = synchronous standby in another AZ, no reads.
[unverified] scope of ELB, Lambda, ElastiCache, Aurora, NAT gateway (Regional NAT mode exists — check nat-gateways-regional.html), EBS snapshots.

Shared Responsibility

AWS = "of" the cloud: "from the host operating system and virtualization layer down to the physical security of the facilities." Customer = "in" the cloud: "guest operating system (including updates and security patches)… security group firewall" — and "determined by the AWS Cloud services that a customer selects."

Control	Example
Inherited	"Physical and Environmental controls"
Shared ("completely separate contexts")	Patch mgmt · Configuration mgmt · Awareness & training
Customer specific	"Service and Communications Protection or Zone Security"

	EC2	RDS	Lambda	S3
Guest OS patch	you	AWS performs; you pick window; optional updates — "RDS does not apply these automatically"	[unverified]	AWS
Runtime/engine	you	AWS (maintenance)	Auto mode: Lambda; container image: you redeploy	—
Network access	VPC + SGs	VPC + SGs	IAM (+VPC)	policies
Data · IAM · encryption choices	you	you	you	you

⚠️ Public S3 bucket = customer ("Managing access to your data"). Lambda requires TLS 1.2.

Networking

CIDR: addresses = 2^(32 − prefix). /16 = 65,536 · /20 = 4,096 · /24 = 256 · /28 = 16. +1 prefix = half.
VPC: /16 … /28 · RFC 1918 recommended · avoid 172.17.0.0/16 · can't resize a block; can add secondary (non-overlapping).
Subnet: /16 … /28 · 5 reserved (first 4 + last) → /28 = 11 usable · one AZ.
⚠️ Public = route to an internet gateway. Private = no direct IGW route, needs NAT. Also VPN-only, isolated.
Default VPC (accounts after Dec 4, 2013): default subnet per AZ + IGW route ⇒ public.
Overlapping CIDRs block peering and shared Direct Connect gateways.

Virtualisation

Nitro = Nitro Cards (all I/O: networking, EBS, instance storage) + Nitro Security Chip + Nitro Hypervisor ("no networking stack… neither a shell nor any type of interactive access mode").
Hypervisor performance "indistinguishable from bare metal for most workloads".
⚠️ Licence requires non-virtualized ⇒ bare metal instance.
"By design the Nitro System has no operator access."

Encryption

At rest = "non-volatile storage for any duration" → exam example KMS.
In transit = "sent from one system to another" → exam example ACM using TLS.
S3: SSE-S3 on every new upload since Jan 5, 2023 · SSE-C disabled by default on new buckets since April 2026.
DynamoDB: all data encrypted at rest by default.
EBS: you enable (per volume or by default) · covers at rest and instance↔volume in transit · can't remove encryption.
RDS: you enable · AES-256.

DNS & DNSSEC

Resolver asks; authoritative answers (Route 53 is authoritative for its zones). Hosted zone = records for a domain + subdomains. TTL = resolver cache time ⇒ DNS failover never instant.
Route 53 = domain registration · DNS routing · health checking.
DNSSEC signing = response "came from Amazon Route 53 and has not been tampered with" ⇒ origin + integrity, not secrecy.
KSK = you (KMS: asymmetric, ECC_NIST_P256, us-east-1). ZSK = Route 53.
TTL capped at one week · no multi-vendor · parent without DS support ⇒ child unresolvable · alarm on DNSSECInternalFailure / DNSSECKeySigningKeysNeedingAction.
Chain of trust = DS record in the parent zone. Lower max TTL to 1 h first.
Validation (VPC resolver) ≠ signing (hosted zone). Validation can cause an outage for public names.

Four things to carry in

Five characteristics are NIST's; six advantages are AWS's.
If you choose the AZ, it's zonal. "Global" still has a one-Region control plane.
Host OS is AWS's; guest OS is yours when you run it. Data, IAM and encryption choices are always yours.
A subnet is public because of its route table — and it lives in exactly one AZ.