AWS Cloud Practitioner Cheat Sheet in 2026

Preparing for the AWS Certified Cloud Practitioner (CLF-C02) exam in 2026? This AWS Cloud Practitioner Cheat Sheet brings together the most important AWS cloud concepts, services, security principles, pricing models, networking fundamentals, storage options, and governance tools you need to remember before exam day.

The goal is not to memorize every AWS service. Instead, focus on understanding what each major service does, when it should be used, and how AWS concepts differ from one another. This cheat sheet is designed for quick revision and last-minute exam preparation.

1. Cloud Computing Fundamentals

Cloud computing means delivering computing resources such as servers, storage, databases, networking, and applications over the internet on demand.

CapEx vs. OpEx

• CapEx (Capital Expenditure): Upfront investment in physical infrastructure such as servers and data centers.
• OpEx (Operational Expenditure): Ongoing spending based on resource usage.
• AWS cloud model: Primarily shifts organizations from large upfront capital investments toward usage-based operational spending.

Exam tip: If a question describes avoiding large upfront infrastructure purchases and paying for resources as they are consumed, think OpEx.

Elasticity vs. Scalability

• Elasticity: Automatically adds or removes resources as demand changes.
• Scalability: The ability of a system to handle increased workload by adding resources.

Remember: Elasticity focuses on dynamically matching capacity with demand, while scalability focuses on the ability to grow to handle additional workload.

High Availability

High availability means designing systems to remain operational even when individual components fail. AWS achieves high availability through concepts such as multiple Availability Zones, redundancy, and managed services.

Global Reach

AWS provides infrastructure around the world, allowing organizations to deploy applications closer to their customers and users.

Economies of Scale

AWS can achieve lower infrastructure costs by purchasing and operating resources at enormous scale. These benefits can contribute to lower costs for customers.

Pay-as-you-go

AWS generally allows customers to pay for resources based on usage rather than purchasing all infrastructure upfront.

2. Cloud Deployment Models

Public Cloud

Infrastructure is provided by a cloud provider and shared among multiple customers while each customer's resources remain logically isolated.

Example: AWS public cloud.

Private Cloud

Cloud infrastructure is dedicated to a single organization. It may be operated within an organization's own environment or through a dedicated provider arrangement.

Hybrid Cloud

A hybrid cloud combines private infrastructure with public cloud resources, allowing workloads or data to operate across both environments.

Exam shortcut: Public + private environments working together = Hybrid Cloud.

3. Cloud Service Models

IaaS — Infrastructure as a Service

IaaS provides fundamental infrastructure resources such as virtual servers, storage, and networking. Customers have significant control over the operating system and applications.

AWS example: Amazon EC2.

PaaS — Platform as a Service

PaaS provides a managed platform that reduces the amount of infrastructure management required by the customer.

Think: The provider manages more of the underlying infrastructure while you focus more on your application or data.

SaaS — Software as a Service

SaaS delivers a complete software application that customers can use without managing the underlying infrastructure.

Example from the study material: Amazon WorkSpaces.

4. AWS Global Infrastructure

AWS Regions

An AWS Region is a geographical area containing AWS infrastructure. Organizations select regions based on factors such as latency, service availability, data requirements, and business needs.

Availability Zones

Availability Zones are isolated locations within an AWS Region. Deploying resources across multiple Availability Zones can improve availability and resilience.

Exam tip: A Region contains multiple Availability Zones.

High Availability with Availability Zones

If an application is deployed across multiple Availability Zones, failure of one Availability Zone does not necessarily make the entire application unavailable.

5. AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) controls who can access AWS resources and what actions they are allowed to perform.

IAM Users

An IAM user represents an identity that can be given permissions to interact with AWS resources.

IAM Groups

IAM groups allow permissions to be assigned to multiple users through a common group structure.

IAM Roles

IAM roles provide permissions that can be assumed temporarily by users, applications, or AWS services.

Least Privilege

The principle of least privilege means giving identities only the permissions they need to perform their required tasks.

Exam shortcut: Minimum required permissions = Least Privilege.

Multi-Factor Authentication (MFA)

MFA provides an additional authentication factor beyond a password, improving account security.

Temporary Credentials

IAM roles can provide temporary credentials, which are useful when applications or users need short-term access to AWS resources.

6. AWS Security Services Cheat Sheet

Service	Primary Purpose	Remember
AWS Shield	DDoS protection	Protects against Distributed Denial-of-Service attacks
AWS WAF	Web application protection	Helps protect against attacks such as SQL injection and XSS
Amazon GuardDuty	Threat detection	Detects potentially malicious or unauthorized activity
Amazon Inspector	Vulnerability assessment	Helps identify software vulnerabilities and security issues

Shield vs. WAF

Shield is primarily associated with DDoS protection, while WAF protects web applications from common web-based attacks.

Memory trick:

• Shield = DDoS
• WAF = Web attacks
• GuardDuty = Threat detection
• Inspector = Vulnerability assessment

7. AWS Encryption Basics

Encryption at Rest

Encryption at rest protects data while it is stored.

AWS service to remember: AWS Key Management Service (KMS).

Encryption in Transit

Encryption in transit protects data while it is moving between systems.

Common technologies: SSL/TLS and certificates managed through services such as AWS Certificate Manager (ACM).

Important S3 Example

When data is being uploaded to Amazon S3, it is in transit. Once the data is stored in S3, it is at rest.

Exam shortcut:

• Moving data = In Transit
• Stored data = At Rest

8. AWS Governance and Compliance Services

Service	What It Helps With
AWS Config	Resource configuration and configuration history
AWS CloudTrail	Tracking API and account activity, including who did what
AWS Artifact	Access to AWS compliance reports and related documentation
AWS Security Hub	Centralized view of security findings
AWS Audit Manager	Collecting and managing audit evidence

Config vs. CloudTrail

One of the important distinctions to remember is:

• Config: What is the configuration or state of the resource?
• CloudTrail: Who performed an action and what API activity occurred?

Memory trick: Config = configuration. CloudTrail = activity trail.

9. Amazon EC2 Pricing Models

On-Demand Instances

On-Demand pricing is suitable when you need flexibility and do not want to commit to a long-term pricing arrangement.

Best for: Unpredictable workloads and short-term or flexible usage.

Reserved Instances

Reserved pricing is designed for workloads with predictable, long-term usage requirements.

Best for: Stable and predictable workloads.

Spot Instances

Spot Instances can provide significant cost savings, but they can be interrupted when AWS needs the capacity back.

Best for: Flexible workloads that can tolerate interruptions.

Auto Scaling

AWS Auto Scaling helps automatically add or remove resources according to workload demand.

Exam shortcut: Automatically matching capacity to demand = Elasticity.

10. AWS Storage Services

Service	Storage Type	Key Concept
Amazon EBS	Block storage	Storage volumes commonly associated with EC2
Amazon EFS	File storage	Shared file system
Amazon S3	Object storage	Highly scalable object storage

EBS

Amazon Elastic Block Store (EBS) provides block storage volumes that can be attached to Amazon EC2 instances.

EFS

Amazon Elastic File System (EFS) provides file storage that can be shared across resources.

S3

Amazon Simple Storage Service (S3) is an object storage service designed for storing and retrieving objects at scale.

Memory trick:

• EBS = Block
• EFS = File
• S3 = Object

11. Amazon VPC and Networking Fundamentals

Amazon VPC

Amazon Virtual Private Cloud (VPC) provides an isolated virtual network where AWS resources can be deployed.

Public Subnet

A public subnet has a route that provides a path to an Internet Gateway, allowing resources configured appropriately to communicate with the internet.

Private Subnet

A private subnet does not have a direct route to the internet through an Internet Gateway.

Route Table

A route table determines where network traffic is directed.

Memory trick: Route table = the traffic director or GPS of the network.

Security Groups

A Security Group acts as a resource-level virtual firewall. It is stateful, meaning return traffic is automatically allowed when the corresponding connection is permitted.

Network ACLs

A Network Access Control List (NACL) operates at the subnet level and provides stateless traffic filtering.

Security Group vs. NACL

Feature	Security Group	NACL
Level	Resource/instance level	Subnet level
State	Stateful	Stateless
Purpose	Control traffic to resources	Control traffic at subnet boundary

Exam shortcut: Stateful = Security Group. Stateless = NACL.

12. AWS Database Services

Amazon RDS

Amazon Relational Database Service (RDS) is a managed relational database service. It reduces the operational work involved in managing database infrastructure.

Amazon Aurora

Amazon Aurora is a relational database engine available through Amazon RDS.

Amazon DynamoDB

Amazon DynamoDB is a NoSQL database service designed for flexible, scalable workloads.

Relational vs. NoSQL

• RDS/Aurora: Relational database workloads.
• DynamoDB: NoSQL workloads requiring flexible and scalable data models.

Exam shortcut: SQL/relational = RDS or Aurora. NoSQL = DynamoDB.

13. AWS Cost Management Tools

Service	Primary Purpose
AWS Cost Explorer	Analyze and understand AWS spending
AWS Budgets	Set budgets and receive alerts when spending or usage approaches defined thresholds
AWS Trusted Advisor	Provides recommendations across areas such as cost optimization, security, performance, and service limits

Cost Explorer vs. AWS Budgets

Think of Cost Explorer when the question asks you to analyze or understand existing spending.

Think of AWS Budgets when the question asks you to establish spending thresholds and receive alerts.

AWS Data Transfer Costs

AWS pricing can differ depending on the direction and type of data transfer. As a general exam concept, data transfer into AWS is often free, while data transfer out can incur charges depending on the service and destination.

Exam tip: Avoid assuming that every type of data transfer is always free. Always consider the specific service and transfer path described in the question.

14. AWS Support Plans

AWS support plans provide progressively different levels of technical support and guidance.

Support Plan	General Position
Basic	Entry-level support
Developer	Additional support for development environments
Business	More comprehensive production-oriented support
Enterprise	Highest level of direct and comprehensive support

Memory trick: Basic → Developer → Business → Enterprise.

15. Ultra-Fast AWS Service Recognition Table

When answering CLF-C02 questions, identifying the service from a short description can save valuable time. Use this table for rapid revision.

If the Question Says...	Think...
Virtual servers	Amazon EC2
Object storage	Amazon S3
Block storage	Amazon EBS
Shared file storage	Amazon EFS
Relational database	Amazon RDS / Aurora
NoSQL database	Amazon DynamoDB
User and permission management	AWS IAM
DDoS protection	AWS Shield
Web application attacks	AWS WAF
Threat detection	Amazon GuardDuty
Vulnerability assessment	Amazon Inspector
Encryption keys	AWS KMS
API/account activity	AWS CloudTrail
Resource configuration	AWS Config
Compliance reports	AWS Artifact
Centralized security findings	AWS Security Hub
Audit evidence	AWS Audit Manager
Analyze AWS costs	AWS Cost Explorer
Set cost thresholds and alerts	AWS Budgets
AWS recommendations	AWS Trusted Advisor

16. Most Important AWS Cloud Practitioner Exam Traps

Many CLF-C02 questions are designed to test whether you can distinguish between services that appear similar. The following comparisons are especially important.

Shield vs. WAF

Shield → DDoS protection.
WAF → Web application protection.

GuardDuty vs. Inspector

GuardDuty → Threat detection.
Inspector → Vulnerability assessment.

Config vs. CloudTrail

Config → Resource configuration and state.
CloudTrail → API and account activity.

Cost Explorer vs. AWS Budgets

Cost Explorer → Analyze spending.
AWS Budgets → Set thresholds and receive alerts.

EBS vs. EFS vs. S3

EBS → Block storage.
EFS → File storage.
S3 → Object storage.

Security Group vs. NACL

Security Group → Stateful, resource-level firewall.
NACL → Stateless, subnet-level firewall.

On-Demand vs. Reserved vs. Spot

On-Demand → Flexibility.
Reserved → Predictable long-term workloads.
Spot → Lower-cost capacity with interruption risk.

17. How to Use This Cheat Sheet Effectively

Reading a cheat sheet once is not enough to prepare effectively for the CLF-C02 exam. Use it as a revision framework and combine it with practice questions.

1. First pass: Read the entire cheat sheet to understand the major AWS concepts.
2. Second pass: Focus on the service recognition tables.
3. Third pass: Review confusing service pairs such as Shield vs. WAF and Config vs. CloudTrail.
4. Practice: Test your knowledge using full-length practice exams.
5. Final revision: Review the key differences shortly before the exam.

If you are preparing specifically for the AWS Certified Cloud Practitioner (CLF-C02) exam, you can reinforce these concepts with AWS Cloud Practitioner (CLF-C02) Practice Tests. The practice course includes full-length mock exams, practice questions, and coverage of the major CLF-C02 exam domains.

18. Final 60-Second Revision

Before entering the exam, make sure you can answer these questions quickly:

• What is the difference between CapEx and OpEx?
• What is elasticity?
• What is scalability?
• What is the difference between a Region and an Availability Zone?
• What does IAM control?
• What is least privilege?
• What is MFA?
• Which AWS service protects against DDoS attacks?
• Which service protects web applications?
• Which service detects threats?
• Which service assesses vulnerabilities?
• What is encryption at rest?
• What is encryption in transit?
• What does AWS KMS do?
• What does CloudTrail track?
• What does AWS Config track?
• What is the difference between EBS, EFS, and S3?
• What is the difference between a public and private subnet?
• What is the difference between a Security Group and a NACL?
• Which database service is relational?
• Which database service is NoSQL?
• When should you use On-Demand, Reserved, or Spot pricing?
• What does Cost Explorer do?
• What does AWS Budgets do?
• What does Trusted Advisor provide?

19. Continue Your AWS Certification Journey

The AWS Certified Cloud Practitioner certification is a useful starting point for understanding AWS cloud concepts. After building this foundation, you may want to move toward Associate, Professional, or Specialty-level AWS certifications.

Explore the AWS Certification Practice Tests collection for practice exams covering major AWS certification paths, including Associate, Professional, and Specialty-level certifications.

Conclusion

The AWS Cloud Practitioner exam is fundamentally about understanding cloud concepts and knowing which AWS service or pricing model best matches a given requirement. You do not need to memorize every AWS product. You need to recognize the core concepts and understand the differences between commonly tested services.

Focus especially on IAM, Regions and Availability Zones, security services, encryption, EC2 pricing, storage, VPC networking, databases, governance, and cost management.

Use this AWS Cloud Practitioner Cheat Sheet as your quick-reference guide, then validate your understanding through practice questions and mock exams. With consistent revision and enough scenario-based practice, you can approach the CLF-C02 exam with much greater confidence.