0 · 难词换简单词 Hard word → simple word
考试写答案时，难词可以换成右边的简单说法，意思一样、照样得分。术语本身（黑体）必须会拼。
| 难词 Hard | 简单说法 Simple (你写这个也行) | 意思 |
|---|---|---|
| ephemeral | temporary; lost when stopped | 临时的 |
| durable / durability | data is not lost | 持久 |
| provision | create / set up | 创建 |
| decouple | separate the parts | 解耦 |
| synchronous / asynchronous | at the same time / later（术语要会写 sync/async） | 同步/异步 |
| elasticity | scale out and in on demand | 弹性 |
| high availability (HA) | still works when one part fails | 高可用 |
| failover | the standby takes over | 故障转移 |
| least privilege | give only the permissions needed | 最小权限 |
| idempotent | safe to run twice | 幂等 |
| offload | move work to hardware | 卸载 |
| attack surface | fewer things to attack | 攻击面 |
⚠️ 这些术语必须原样会写（不能换）：delete marker, versioning, replication, Multi-AZ, Read Replica, quorum, redo log, VCL/CPL/VDL, Instance Profile, execution role, resource-based policy, visibility timeout, DLQ, fan-out, IGW, NAT Gateway, Security Group, target group, launch template, Task Definition, Pod, Deployment, Service, etcd, kubelet。
Q2 · IAM identity（10分）默写模板
背这段 MEMORISE
A User is for one person or app. It has long-term credentials: a password for the console, and an access key for code.
User 给一个人/应用，长期凭证：控制台用密码，代码用访问密钥。
A Group is a set of users. You attach one policy to the group, and all users in it get the permissions. A group cannot log in and cannot contain another group.
Group 是用户集合，策略附在组上人人生效；组不能登录、不能套组。
A Role has temporary credentials from STS: access key + secret + session token + expiry time. A user, an app, or an AWS service can assume a role.
Role 是 STS 发的临时凭证（密钥+令牌+过期时间），可被用户/应用/AWS服务 assume。
A Policy is a JSON document that lists permissions. You attach it to a user, group, or role.
Policy 是列权限的 JSON，附到用户/组/角色上。
EC2 访问 S3（必考）
Best practice: attach a Role to the EC2 instance with an Instance Profile. The app gets temporary keys that rotate automatically. Never write keys in the code — they can leak and do not rotate.
给 EC2 用 Instance Profile 附一个 Role，应用拿到自动轮换的临时密钥；绝不把密钥写进代码——会泄露且不轮换。
Q3 · IAM policy 分析（10分）答题公式
评估规则（先写这句）: An explicit Deny always wins. If there is no Allow, the default is Deny.显式 Deny 永远胜出；没有 Allow 就默认拒绝。
arn:aws:s3:::bucket= the bucket itself → bucket actions like ListBucket.不带 /* 是桶本身 → 桶级操作(列目录)。arn:aws:s3:::bucket/*= the objects inside → object actions like GetObject / PutObject.带 /* 是桶里的对象 → 对象级操作。- All Conditions must be true at the same time.Condition 里所有条件要同时满足。
- Identity policy = "what I can do". Resource policy = "who can use me" (it has a Principal).身份策略=我能做什么；资源策略=谁能用我(带 Principal)。
答题句式 TEMPLATE
"This policy allows [actions] on [resource], only when [conditions]. It does not allow [other actions] because they are not in the Action list. It does not allow ListBucket because the resource is object-level (
/*), not the bucket ARN. Everything else is denied by default."
"此策略允许…，仅当…。不允许…因为不在 Action 里；不允许 ListBucket 因为资源是对象级；其余默认拒绝。"
Q4 · SQS（6分）默写模板
核心三句 MEMORISE
1. SQS is point-to-point: one message goes to one consumer, who pulls it from the queue.
SQS 点对点：一条消息只给一个消费者，消费者主动拉取。
2. Visibility timeout: after a worker receives a message, it is hidden from other workers. The worker must delete it after processing. If it does not, the message becomes visible again after the timeout, and another worker may process it again (duplicate).
可见性超时：取走后对别人隐藏；处理完必须删除；不删则超时后重新可见，会被重复处理。
3. Fix: set the timeout longer than the processing time, and make processing safe to run twice (idempotent). Messages that fail many times go to the DLQ (dead-letter queue).
修复：超时设得比处理时间长 + 处理幂等；反复失败的消息进死信队列。
- Standard queue: at-least-once, order not guaranteed. FIFO: in order, exactly-once.标准=至少一次、不保序；FIFO=保序、恰好一次。
- SNS is one-to-many push. Fan-out = SNS sends the same message to many SQS queues; each queue has its own consumer.SNS 一对多推送；扇出=SNS 发给多个 SQS，各自独立消费。
- For SNS→SQS, the SQS queue policy must allow the SNS topic to
sqs:SendMessage.SNS发SQS：队列策略要允许该主题 SendMessage。
补漏 GAP：Long polling: the consumer waits up to 20s for a message instead of asking again and again. It reduces empty responses and cost. (Short polling returns at once, maybe empty.)长轮询：最多等20秒拿消息，减少空响应和费用；短轮询立即返回可能为空。
Q5 · VPC + 安全组（16分）默写模板
六句核心 MEMORISE
1. A VPC is in one region and can span many AZs. A subnet is in one AZ only.
VPC 在一个 region、可跨多 AZ；子网只在一个 AZ。
2. A subnet is public when its route table has
0.0.0.0/0 → Internet Gateway.
路由表有 0.0.0.0/0→IGW 的子网才是公有子网。
3. A private subnet uses 0.0.0.0/0 → NAT Gateway. The NAT lets instances go out (for updates) but blocks traffic coming in.
私有子网走 NAT：能出去更新，外面进不来。
4. The NAT Gateway sits in a public subnet and needs an Elastic IP. One per AZ for HA.
NAT 放公有子网、绑弹性IP，每 AZ 一个。
5. A Security Group is stateful (reply traffic is allowed automatically), works at the instance level, and has allow rules only.
安全组有状态、实例级、只有允许规则。
6. Best practice: use another SG as the source, not an IP range. Example: DB-SG allows port 5432 only from App-SG.
最佳实践：源写另一个安全组而不是IP段，如 DB-SG 只收 App-SG 的 5432。
请求路径 REQUEST TRACE（照着写）
client → Internet Gateway → public route table → ALB (ALB-SG allows 80/443 from the internet) → web instance (Web-SG allows traffic only from ALB-SG) → app tier (App-SG only from Web-SG) → database (DB-SG allows 5432 only from App-SG). The database is never reachable from the internet.
客户端→IGW→公有路由表→ALB→web→app→db；数据库永远不对公网开放。
- Each subnet reserves 5 IPs: .0 network, .1 router, .2 DNS, .3 reserved, .255 broadcast.每子网保留5个IP。
- Subnet CIDR must be inside the VPC CIDR and must not overlap. VPC max /16, min /28; cannot change after creation.子网CIDR必须在VPC内且不重叠；最大/16最小/28，建后不可改。
补漏 GAP — SG vs NACL（MCQ 常考）：SG = stateful, instance level, allow only. NACL = stateless (must allow both directions), subnet level, has allow and deny rules.NACL 无状态(进出都要写规则)、子网级、有允许+拒绝。
补漏 GAP — VPC Endpoint：Gateway endpoint (S3 and DynamoDB only, free) is a route-table target; Interface endpoint creates an ENI in your subnet (paid). Both keep traffic inside AWS, off the public internet.网关端点(仅S3/DynamoDB,免费,写进路由表)；接口端点(建ENI,收费)。流量不走公网。
Q6 · ASG + ALB（8分）默写模板
背这段 MEMORISE
The ALB is a layer-7 load balancer. It spreads requests across healthy targets in several AZs and runs health checks. It stops sending traffic to an unhealthy instance.
ALB 是七层负载均衡：跨 AZ 分发到健康目标、做健康检查、不再发给不健康实例。
The ASG keeps the number of instances between min and max. It launches instances from a launch template and replaces failed ones.
ASG 把实例数维持在 min–max 之间，按启动模板开机器、替换坏机器。
Together: min=2 across 2 AZs means the app still works if one instance or one AZ fails (high availability). When load grows, the ASG adds instances and they auto-register with the ALB target group; when load drops, it removes them (elasticity).
合起来：min=2 跨 2AZ，坏一台/一个AZ仍能服务（高可用）；负载升加机器并自动注册到目标组，负载降缩容（弹性）。
CPU 80% 流程 FLOW（5步照写）
1. CloudWatch sees high CPU → 2. the alarm triggers the ASG scaling policy (e.g. target tracking, CPU=60%) → 3. the ASG launches new instances from the launch template → 4. they register with the ALB target group → 5. traffic spreads out and CPU goes down.
CloudWatch 报警→触发伸缩策略→按模板启新实例→注册目标组→流量分摊CPU回落。
补漏 GAP — ELB 四类型 + 算法（MCQ）：ALB=layer 7 (HTTP); NLB=layer 4 (TCP, very low latency, static IP); GLB=for security appliances; CLB=old. Routing: round-robin (default) or Least Outstanding Requests — better when request times are very different.ALB七层/NLB四层低延迟/GLB安全设备/CLB旧。算法：轮询(默认)；请求耗时差异大用LOR。
补漏 GAP — 健康检查替换流程：health check fails → instance marked unhealthy → ALB stops routing to it first → ASG terminates it → launches a replacement → it registers and passes checks → traffic resumes.检查失败→标不健康→ALB先停发流量→ASG终止→启新机→注册通过→恢复。
Q7 · A2 讨论（10分）默写模板
架构一句话 + 流程七步 MEMORISE
My A2 is an event-driven PDF analysis app on AWS: a VPC across 2 AZs with public and private subnets, an Internet Gateway, NAT Gateways, a Bastion host, an ALB in front of a web tier in an ASG, worker EC2 instances, S3 for PDFs, RDS PostgreSQL for results, one SNS topic and two SQS queues. Workers and RDS are in private subnets.
A2=事件驱动PDF应用：2AZ的VPC、公私子网、IGW、NAT、堡垒机、ALB+ASG web层、worker EC2、S3存PDF、RDS存结果、SNS+2个SQS；worker和RDS在私有子网。
Flow: 1. user request → ALB → web instance; 2. web uploads the PDF to S3; 3. web publishes a message to SNS; 4. SNS fans out to the SQS queues; 5. a worker polls SQS, gets the PDF from S3 and processes it; 6. the worker writes results to RDS and deletes the message; 7. the web tier reads RDS and shows the result.
流程：请求→ALB→web；PDF存S3；发SNS；扇出到SQS；worker拉队列、取PDF处理；结果写RDS、删消息；web读RDS展示。
为什么用 SNS+SQS（背 4 点）
1. Decoupling: the web tier answers the user at once; it does not wait for the slow processing.解耦：web 立即响应，不等慢任务。
2. Buffering: the queue holds bursts of jobs, so nothing is dropped.缓冲：队列兜住突发任务。
3. Independent scaling: workers scale on queue depth, separate from the web tier.独立扩展：worker 按队列深度扩，与 web 无关。
4. Reliability: if a worker crashes, the message becomes visible again and is retried; repeated failures go to a DLQ. Nothing is lost.可靠：worker 崩了消息重新可见被重试，反复失败进 DLQ，不丢。
安全两句（加分）
Security groups form a chain: ALB-SG ← internet 80/443; Web-SG ← only ALB-SG; RDS-SG ← 5432 only from web/worker SGs. Each EC2 uses a least-privilege IAM role via an instance profile (web: S3 put + SNS publish; worker: SQS receive/delete + S3 get + RDS).
SG 链：ALB-SG收公网、Web-SG只收ALB、RDS只收web/worker的5432；每台EC2用最小权限角色（web=存S3+发SNS；worker=收删SQS+读S3+RDS）。
Q1 · MCQ 必背事实（一行一个）
云基础（补漏 GAP — 之前材料没单独列）
IaaS = AWS gives VM/network/storage, you manage OS and up (EC2). PaaS = you manage only code+data (Elastic Beanstalk). SaaS = you just use the software (Gmail).IaaS管OS以上(EC2)；PaaS只管代码数据；SaaS直接用。
Global services: IAM, Route53, CloudFront. Regional: S3, VPC, RDS, ALB, ASG, SQS, SNS, CloudFormation. Zonal (must pick an AZ): EC2, EBS, subnet, single-AZ RDS.全球：IAM/Route53/CloudFront；区域：S3/VPC/RDS/ALB/ASG/SQS/SNS/CFN；AZ级：EC2/EBS/子网。
Inside a VPC: EC2, RDS, ALB, ASG. Outside (fully managed): S3, SQS, SNS, DynamoDB, IAM, CloudFormation.VPC内：EC2/RDS/ALB/ASG；VPC外：S3/SQS/SNS/DynamoDB/IAM/CFN。
A Region has ≥2 (usually ≥3) AZs; an AZ = one or more data centers; resources in the same AZ are in the same data center area.Region含多个AZ；AZ=独立机房群；同AZ≈同数据中心。
Global services: IAM, Route53, CloudFront. Regional: S3, VPC, RDS, ALB, ASG, SQS, SNS, CloudFormation. Zonal (must pick an AZ): EC2, EBS, subnet, single-AZ RDS.全球：IAM/Route53/CloudFront；区域：S3/VPC/RDS/ALB/ASG/SQS/SNS/CFN；AZ级：EC2/EBS/子网。
Inside a VPC: EC2, RDS, ALB, ASG. Outside (fully managed): S3, SQS, SNS, DynamoDB, IAM, CloudFormation.VPC内：EC2/RDS/ALB/ASG；VPC外：S3/SQS/SNS/DynamoDB/IAM/CFN。
A Region has ≥2 (usually ≥3) AZs; an AZ = one or more data centers; resources in the same AZ are in the same data center area.Region含多个AZ；AZ=独立机房群；同AZ≈同数据中心。
虚拟化 / EC2
Nitro = thin hypervisor (only CPU+memory) + Nitro Cards (network/storage/security moved to hardware) + Security Chip. No Domain 0. Bare-metal uses the cards but not the hypervisor. Result: near bare-metal speed, fewer things to attack.Nitro=薄hypervisor(只管CPU内存)+Nitro卡(硬件卸载)+安全芯片；无Dom0；裸金属只用卡；性能高攻击面小。
Instance Store = temporary, lost on stop. EBS = persistent, one AZ, one instance; move with a snapshot. EFS = shared by many Linux instances. t3.large: t=family, 3=generation, large=size. Only EBS-backed instances can stop/start. AWS keeps your public key; you keep the private key.实例存储临时；EBS持久单AZ单实例(迁移靠快照)；EFS多Linux共享；t3.large=家族/代/规格；只有EBS型能stop/start；AWS存公钥你存私钥。
S3
11 nines = durability (not availability). Bucket name is globally unique. Free: upload + same-region transfer. A delete (no version ID) adds a delete marker — same key, its own version ID; GET then returns 404. CRR needs versioning on both buckets; delete markers are not replicated by default. Standard-IA min 30 days; One Zone-IA = 1 AZ, cheaper.11个9=持久性；桶名全球唯一；传入免费；删除=加删除标记(同key独立版本ID,GET变404)；CRR两桶都要开版本控制、删除标记默认不复制；IA最少30天；单区IA更便宜。
RDS / Aurora
Multi-AZ = synchronous, for HA, standby not readable. Read Replica = asynchronous, for read scaling, readable, can be promoted. Aurora: 10GB segments × 6 copies / 3 AZs; write quorum 4/6, read 3/6; primary sends only the redo log. Lose 1 AZ → 4 left → writes continue. VDL = highest CPL ≤ VCL (VCL=1006, CPLs 1003 & 1007 → VDL=1003).Multi-AZ同步HA不可读；RR异步读扩展可提升；Aurora 6副本3AZ、写4/6读3/6、只发redo日志；丢1AZ写继续；VDL=不超VCL的最大CPL。
容器 / ECS / K8s
Container shares the host kernel (namespace = what it sees, cgroup = how much it uses); a VM has its own guest OS — heavier. Container's writable layer is temporary. ECS: Task Definition ≈ launch template; ECS Service ≈ ASG; host port 0 = dynamic port mapping; Fargate = no EC2 to manage. K8s: Pod = smallest unit, containers in a pod share one IP and one node; Deployment keeps replicas; Service = stable address + load balancing; etcd stores cluster state (only API Server touches it); kubelet manages the node; manifest needs apiVersion/kind/metadata/spec.容器共享宿主内核(namespace看见什么/cgroup用多少)，VM有自己OS更重；可写层临时。ECS对应关系+host port 0动态映射+Fargate免管EC2。K8s：Pod最小单元同IP同节点；Deployment管副本；Service稳定地址；etcd存状态仅API Server访问；kubelet管节点；manifest四字段。
Lambda / API Gateway
Two permissions: resource-based policy = who can call the function; execution role = what the function can do (s3:GetObject goes here). Max 900 s. Firecracker MicroVM = between container and VM. By default Lambda cannot reach RDS inside your VPC — put it in the VPC. Anti-patterns: writing back to the same bucket that triggers it (loop!); Lambda calling Lambda (use SQS / Step Functions); waiting synchronously. API GW + Lambda = near-zero idle cost, good for low or spiky traffic.两类权限：资源策略=谁能调；执行角色=函数能做什么。最长900秒；微VM介于容器和VM；默认到不了VPC内RDS；反模式=写回触发桶/Lambda调Lambda/同步等待；API GW+Lambda空闲近零成本。
CloudFormation
Only Resources is required. Mappings = region→AMI lookup. Outputs + Export = share values across stacks.
!Ref = the default ID; !GetAtt = a specific attribute (SG without VpcId: Ref gives the name, use !GetAtt ...GroupId). Fails → automatic rollback. Preview changes with a Change Set.仅Resources必填；Mappings做region→AMI；Outputs+Export跨栈；!Ref默认ID，!GetAtt取属性(SG陷阱)；失败自动回滚；Change Set预览。DevOps / CodePipeline（补漏 GAP — 练习题里没有）
CI = merge code often, build and test automatically. Continuous Delivery = auto-release to a repository, a human approves the production deploy. Continuous Deployment = fully automatic to production, no human. CodePipeline = Pipeline → Stage → Action; if an action fails, the pipeline stops. CodePipeline orchestrates; CodeBuild builds; logs are in CloudWatch Logs.CI=频繁合并自动构建测试；持续交付=发到仓库、上生产要人批；持续部署=全自动无人批。Pipeline→Stage→Action，失败即停；CodePipeline编排、CodeBuild构建、日志在CloudWatch。
⭐ final5 真题陷阱急救包（考前最后背这页）
IAM Q5 trap: the Deny condition
IpAddress: 203.0.113.0/24 means deny WHEN the IP IS IN that range. From 203.0.113.17 → denied; from 198.51.100.10 → allowed. To deny everywhere EXCEPT a range, use NotIpAddress.Deny条件IpAddress=网段 → IP在网段内才拒绝;203.0.113.17拒绝、198.51.100.10允许;"除某网段外都拒"用NotIpAddress。SG only allows TCP 22 → SSH works but ping (ICMP) fails. Ping needs an ICMP rule, not a TCP port.SG只放TCP22 → SSH通、ping不通!ping走ICMP,不是TCP端口。
Subnet with NO route-table association → it uses the main route table (local only) → no internet either way, even with a public IP. Also: no NAT in the template = private subnet cannot download anything.子网没关联路由表 → 用主路由表(只有local) → 双向都上不了网,有公网IP也没用;模板里没NAT=私有子网啥也下载不了。
ASG scaling uses the GROUP AVERAGE: one instance at 90% + one at 10% → average 50% < 70% → no scale-out.ASG看组平均CPU:90%+10%平均50%<70% → 不扩容。
Buggy launch template → new instances fail health checks → ASG terminates & relaunches them → endless launch-terminate churn; old instances keep serving. That churn is the signal to check the startup script.启动脚本有bug → 新实例过不了健康检查 → ASG反复终止重开(实例疯狂换),老实例照常服务;看到这种循环就去查脚本。
EC2 → RDS data = database username/password (application-level, managed by RDS) — NOT IAM. IAM only covers managing the RDS instance (rds:StartDBInstance / StopDBInstance).EC2连RDS读写数据=数据库账号密码(应用层,RDS自己管),不是IAM!IAM只管对RDS实例的管理操作(启停)。
Lambda has NO instance profile — the execution role attaches directly. Chains: EC2 → instance profile → role → policy; Lambda → execution role → policy.Lambda不需要instance profile,执行角色直接挂;EC2才要:EC2→实例配置文件→角色→策略。
Block an IP range from a subnet → NACL DENY rule (SGs have no deny). Keep a fixed public IP → Elastic IP (default public IPs are dynamic, released on terminate). Unpredictable spikes + low cost → On-Demand + Auto Scaling.封IP段=NACL的DENY(SG没有deny);固定公网IP=弹性IP(默认公网IP动态,终止即释放);突发流量省钱=按需+ASG。
10.0.5.55 in VPC 10.0.0.0/16 with subnets .1/.2/.3 only → inside the VPC CIDR but in no defined subnet → cannot be assigned to anything.在VPC CIDR内但不落在任何已建子网 → 当前无法分配给任何资源。
Other L13 nuggets: the root (account) user has full access — don't use daily. S3 usually keeps ~3 physical copies in different AZs. Firecracker MicroVMs run on bare-metal instances to host Lambda. Provision units: VM→ASG, Task→ECS, Pod→EKS.root账户全权限,日常别用;S3一般3份物理副本跨AZ;Firecracker微VM跑在裸金属上承载Lambda;供给单位:VM/ASG、Task/ECS、Pod/EKS。
考场策略 Exam strategy
- MCQ: single choice, 4 options, 2 marks each, no penalty for wrong answers → answer all 20.单选4选1每题2分，错不扣分→20题全填，别留空。
- 时间：MCQ ~25min；Q5(16分)最大写~25min；其余按分配。先做会的。
- If unsure, write your assumption: "I assume ..., so ...". You still get marks for correct reasoning.不确定就写假设——推理对就有分（官方原话：尽力作答，可写你的理解/假设）。
- 写答案套路：先一句定义术语 → 再答问题 → 举一个具体例子/数字（端口、CIDR、4/6）。短句、简单词，写满给分点比写漂亮重要。
- 带学生证；可带纸质语言词典；有草稿纸；Q2–Q7写在卷子指定空白处，写不下用末尾附加页并标题号。