AWS Cloud Overview

AWS Global Infrastructure

Amazon Web Services operates the world's most comprehensive cloud infrastructure, spanning 33 geographic Regions with 105 Availability Zones (AZs) as of 2024. Each Region contains multiple isolated AZs connected by low-latency fiber links, typically 2-10ms apart.

Region Selection Criteria

• Compliance: Data residency requirements (e.g., EU data must stay in eu-west-1)
• Latency: Proximity to end users
• Service availability: Not all services exist in all Regions
• Pricing: Costs vary by Region

Availability Zones

Each AZ is one or more discrete data centers with independent power, networking, and connectivity. They are physically separated by miles but connected via dedicated private fiber.

Edge Locations

AWS operates 600+ edge locations worldwide for CloudFront CDN and Route 53 DNS caching. These extend AWS infrastructure closer to end users.

AWS Local Zones

Local Zones extend a Region to metropolitan areas, providing single-digit millisecond latency. Available in cities like Los Angeles, Tokyo, and London.

# List available AWS Regions/aws ec2 describe-regions --query 'Regions[*].[RegionName,Endpoint]' --output table

# Get your current region
aws configure get region

Core AWS Service Categories

AWS offers 200+ services organized into major categories. Understanding these categories helps you architect solutions effectively.

Compute Services

Storage Services

Database Services

Networking

• VPC: Isolated virtual network
• Route 53: DNS service
• CloudFront: Content delivery network
• ELB: Load balancing across instances

# List all available services
aws ssm get-parameters-by-path --path /aws/service/global-infrastructure/regions --query 'Parameters[*].Name' --output table

# Check service availability in a region
aws ec2 describe-vpcs --region us-east-1

AWS Management Console and CLI

Management Console

The AWS Management Console is a web-based interface for managing AWS resources. Key sections:

• Dashboard: Overview of recently visited services and alerts
• Services: Browse all AWS services by category
• Search: Find services, features, and documentation
• Region selector: Top-right corner to switch regions

AWS CLI Setup

# Install AWS CLI (Linux)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Install AWS CLI (macOS)
brew install awscli

# Configure credentials
aws configure
# AWS Access Key ID: YOUR_ACCESS_KEY
# AWS Secret Access Key: YOUR_SECRET_KEY
# Default region name: us-east-1
# Default output format: json

# Verify configuration
aws sts get-caller-identity

Common CLI Commands

# List EC2 instances
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType]' --output table

# List S3 buckets
aws s3 ls

# Create an S3 bucket
aws s3 mb s3://my-unique-bucket-name --region us-east-1

# Upload a file to S3
aws s3 cp myfile.txt s3://my-bucket/path/myfile.txt

# Get help on any service
aws ec2 help

AWS Pricing Models and Billing

Pay-As-You-Go

Pay only for what you use with no upfront commitments. All AWS services follow this model.

Reserved Instances (RI)

Commit to 1 or 3 years for up to 75% discount compared to on-demand pricing.

# Purchase a Reserved Instance
aws ec2 purchase-reserved-instances-offering \
  --instance-count 1 \
  --instance-type m5.large \
  --reserved-instances-offering-id \
  --duration 31536000

# List your Reserved Instances
aws ec2 describe-reserved-instances --filters Name=state,Values=active

Spot Instances

Bid on unused EC2 capacity for up to 90% discount. Instances can be terminated with 2 minutes notice.

Savings Plans

Commit to a consistent usage amount (e.g., $10/hour) for 1 or 3 years across instance families.

Free Tier

New accounts get 12 months of free usage for popular services:

• EC2: 750 hours/month of t2.micro or t3.micro
• S3: 5 GB standard storage
• Lambda: 1M free requests/month
• RDS: 750 hours/month of db.t2.micro

Cost Management Tools

# Get current month costs
aws ce get-cost-and-usage --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity MONTHLY --metrics UnblendedCost

# Set up a billing alarm (via CLI)
aws cloudwatch put-metric-alarm \
  --alarm-name "MonthlyBillAlarm" \
  --namespace "AWS/Billing" \
  --metric-name "EstimatedCharges" \
  --threshold 100 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1

AWS Shared Responsibility Model

AWS operates a shared responsibility model for security and compliance.

Customer Responsibilities (Security IN the Cloud)

• Data encryption and access management
• Operating system patches (EC2)
• Application-level security
• Network configuration (security groups, NACLs)
• IAM user and role management

AWS Responsibilities (Security OF the Cloud)

• Physical data center security
• Network infrastructure
• Hypervisor and host OS
• Hardware lifecycle management
• Compliance certifications (SOC, PCI, HIPAA)

Best Practices Checklist

1. Enable MFA on all root accounts
2. Use IAM roles instead of access keys where possible
3. Enable CloudTrail for audit logging
4. Use AWS Config for compliance monitoring
5. Implement least-privilege access policies
6. Enable encryption at rest and in transit
7. Use VPC endpoints to keep traffic off public internet

# Check root account access key usage
aws iam get-account-summary

# Enable CloudTrail
aws cloudtrail create-trail --name my-trail --s3-bucket-name my-log-bucket
aws cloudtrail start-logging --name my-trail

# List IAM policies
aws iam list-policies --scope Local

Setting Up Your First AWS Environment

Step-by-Step Environment Setup

# Step 1: Create an S3 bucket for state management
aws s3 mb s3://my-terraform-state-$(date +%s)

# Step 2: Create a VPC aws ec2 create-vpc --cidr-block 10.0.0.0/16
# Note the VpcId from output

# Step 3: Create a subnet
aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.0.1.0/24 --availability-zone us-east-1a

# Step 4: Create an Internet Gateway
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway --internet-gateway-id igw-xxx --vpc-id vpc-xxx

# Step 5: Create a security group
aws ec2 create-security-group --group-name web-sg --description "Web server SG" --vpc-id vpc-xxx
aws ec2 authorize-security-group-ingress --group-id sg-xxx --protocol tcp --port 80 --cidr 0.0.0.0/0

Architecture Diagram

                    ┌─────────────────────────────┐
                    │        Internet             │
                    └──────────────┬──────────────┘
                                   │
                    ┌──────────────▼──────────────┐
                    │      Internet Gateway       │
                    └──────────────┬──────────────┘
                                   │
                    ┌──────────────▼──────────────┐
                    │         VPC 10.0.0.0/16      │
                    │  ┌────────────────────────┐  │
                    │  │   Public Subnet        │  │
                    │  │   10.0.1.0/24          │  │
                    │  │   ┌──────┐ ┌──────┐    │  │
                    │  │   │ EC2  │ │ EC2  │    │  │
                    │  │   └──────┘ └──────┘    │  │
                    │  └────────────────────────┘  │
                    │  ┌────────────────────────┐  │
                    │  │   Private Subnet       │  │
                    │  │   10.0.2.0/24          │  │
                    │  │   ┌──────┐             │  │
                    │  │   │ RDS  │             │  │
                    │  │   └──────┘             │  │
                    │  └────────────────────────┘  │
                    └─────────────────────────────┘

Cost Optimization Tips

• Use the AWS Pricing Calculator before launching resources
• Start with free tier eligible instance types (t2.micro, t3.micro)
• Set up billing alerts immediately
• Tag all resources with Project, Environment, and Owner

# Tag an EC2 instance
aws ec2 create-tags --resources i-xxx --tags Key=Project,Value=MyApp Key=Environment,Value=Dev

# List resources by tag
aws ec2 describe-instances --filters "Name=tag:Environment,Values=Prod"