AWS Crash Course#

Table of Contents#

1. 1. AWS Global Infrastructure: Regions & AZs
2. 2. IAM: Users, Roles, Policies & Least Privilege
3. 3. Amazon EC2: Virtual Compute Instances
4. 4. AWS Lambda: Serverless Event-Driven Functions
5. 5. Containers on AWS: Amazon ECS & Amazon EKS
6. 6. Amazon S3: Object Storage & Presigned URLs
7. 7. Amazon VPC: Subnets, NAT & Security Groups
8. 8. Amazon RDS & Aurora Relational Databases
9. 9. Amazon API Gateway: REST & HTTP APIs
10. 10. Asynchronous Messaging: SQS & SNS
11. 11. AWS Secrets Manager & SSM Parameter Store
12. 12. Amazon CloudWatch: Logs, Metrics & Alarms
13. 13. Developer AWS Quick Reference & CLI

1. AWS Global Infrastructure: Regions & AZs#

Amazon Web Services (AWS) powers cloud infrastructure globally across three geographic tiers:

2. IAM: Users, Roles, Policies & Least Privilege#

AWS Identity and Access Management (IAM) controls authentication (who you are) and authorization (what you can do) across all AWS services. The foundational rule for software developers is the Principle of Least Privilege.

// Example IAM Policy: Read-only access to a specific S3 bucket
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::techtoday-uploads",
        "arn:aws:s3:::techtoday-uploads/*"
      ]
    }
  ]
}

Never Hardcode AWS Keys: Do not bake AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY into source code or Docker images! Instead, attach an IAM Role (Instance Profile) to your EC2 instance, ECS task, or Lambda function. The AWS SDK retrieves temporary rotating credentials automatically.

3. Amazon EC2: Virtual Compute Instances#

Amazon Elastic Compute Cloud (EC2) provides resizable virtual machine compute capacity in the cloud.

• Instance Types: Categorized by workload profile (e.g. t4g.micro / t3.medium for general dev, c7i for compute-heavy APIs, r7g for memory-heavy Redis/databases).
• AMI (Amazon Machine Image): Pre-configured OS templates (Amazon Linux 2023, Ubuntu 24.04).
• Security Groups: Virtual stateful firewalls controlling inbound/outbound ports (e.g. Port 22 SSH, Port 80 HTTP, Port 443 HTTPS).
• User Data: Bootstrap bash shell scripts executed once on initial instance boot to install Docker, clone code, and start services.

4. AWS Lambda: Serverless Event-Driven Functions#

AWS Lambda executes code without provisioning or managing servers. You pay strictly for execution duration (billed per millisecond) and number of requests.

// Modern Node.js Lambda Handler
export const handler = async (event) => {
  console.log("Received event:", JSON.stringify(event));

  const body = JSON.parse(event.body || "{}");
  const userId = body.userId;

  return {
    statusCode: 200,
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      message: "Processing completed successfully",
      userId
    })
  };
};

5. Containers on AWS: Amazon ECS & Amazon EKS#

Containers bridge the gap between virtual machines (Amazon EC2) and serverless functions (AWS Lambda). They package your application code, system binaries, and runtime dependencies together, ensuring consistent behavior from local development to production without the 15-minute runtime ceiling of Lambda.

1. Amazon ECS (Elastic Container Service)

Amazon ECS is AWS's native, highly scalable container orchestration service. It is designed for operational simplicity and deep integration with AWS primitives (Application Load Balancer, CloudWatch, IAM, and Secrets Manager).

• Task Definition: A declarative JSON blueprint describing one or more containers (Docker image, vCPU, memory limits, port mappings, environment variables, and log configuration).
• Task: An individual running instantiation of a Task Definition.
• Service: A manager that runs and maintains a specified number of task instances, orchestrates rolling updates with zero downtime, and handles dynamic registration with an Application Load Balancer (ALB).
• Launch Types:
  • AWS Fargate (Serverless): Run containers on demand without provisioning, configuring, or scaling EC2 worker instances. You pay strictly for the vCPU and memory allocated per second.
  • EC2 Launch Type: Manage your own cluster of EC2 instances with the ECS container agent. Best for GPU acceleration, predictable baselines, and optimizing costs with EC2 Spot instances.

// Example: Minimal Amazon ECS Task Definition (JSON)
{
  "family": "api-service",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789012:role/ecsTaskAppRole",
  "containerDefinitions": [
    {
      "name": "web-api",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/web-api:v1.0.0",
      "portMappings": [{ "containerPort": 8080, "protocol": "tcp" }],
      "essential": true,
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/web-api",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        }
      }
    }
  ]
}

2. Amazon EKS (Elastic Kubernetes Service)

Amazon EKS provides managed upstream Kubernetes across multiple Availability Zones. AWS manages the availability, scalability, and security of the Kubernetes control plane (API server, etcd), while you deploy standard Kubernetes workloads.

• Open Standards & Portability: Deploy with standard Kubernetes manifests, Helm charts, Ingress controllers, and GitOps tools (ArgoCD, Flux). Perfect for multi-cloud or hybrid enterprise architectures.
• Worker Compute Options:
  • Managed Node Groups: AWS automatically provisions, updates, and scales EC2 worker nodes in an Auto Scaling Group.
  • Karpenter Autoscaling: Fast, open-source node autoscaler designed for Kubernetes that dynamically provisions right-sized compute nodes in seconds based on pending pod workload requests.
  • AWS Fargate for EKS: Serverless execution of Kubernetes pods with pod-level isolation and zero node management.
• EKS Pod Identity & IRSA: Connect AWS IAM roles directly to Kubernetes ServiceAccount resources so microservice pods access AWS resources (S3, DynamoDB) without requiring node-level permissions.

6. Amazon S3: Object Storage & Presigned URLs#

Amazon Simple Storage Service (S3) is scalable, durable (99.999999999% 11 9's), high-availability object storage for files, media assets, backups, and static websites.

Generating Presigned URLs (Secure Direct Uploads)

Instead of streaming large video or PDF uploads through your backend web server (which exhausts server memory and network connections), generate an S3 Presigned URL so the browser uploads directly to S3:

// Node.js AWS SDK v3: Generating Presigned Upload URL
import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3 = new S3Client({ region: "us-east-1" });

export async function getUploadUrl(filename, contentType) {
  const command = new PutObjectCommand({
    Bucket: "my-app-uploads",
    Key: `avatars/${filename}`,
    ContentType: contentType
  });

  // Client has 15 minutes to upload directly to S3
  return await getSignedUrl(s3, command, { expiresIn: 900 });
}

7. Amazon VPC: Subnets, NAT & Security Groups#

Every cloud application runs within a Virtual Private Cloud (VPC):

1. Public Subnet: Connected to an Internet Gateway (IGW). Houses public-facing load balancers (ALB) and public ingress.
2. Private Subnet: No direct Internet route. Houses application servers, containers, and databases.
3. NAT Gateway: Lives in the public subnet; gives private instances outbound-only Internet access (for security patches or external API calls) while blocking external inbound connections.

8. Amazon RDS & Aurora Relational Databases#

Amazon Relational Database Service (RDS) automates hardware provisioning, database setup, patching, and backups for PostgreSQL, MySQL, and MariaDB.

• Multi-AZ Deployment: Synchronous replication to a standby instance in another Availability Zone for automatic failover with zero data loss.
• Read Replicas: Asynchronous replicas offloading heavy read traffic (analytics, dashboards) from the primary writer node.
• Amazon Aurora: Cloud-native relational database engineered by AWS. Delivers up to 5x throughput of standard MySQL and 3x of PostgreSQL, with instant storage autoscaling.

9. Amazon API Gateway: REST & HTTP APIs#

Amazon API Gateway is a fully managed service that makes it easy for developers to create, publish, maintain, monitor, and secure APIs at any scale.

10. Asynchronous Messaging: SQS & SNS#

Monolithic request-response chains fail when downstream services slow down. Decouple services using asynchronous messaging queues:

1. Amazon SQS (Queue • 1-to-1): A message queue where worker pools pull jobs. Features Visibility Timeout (prevents other workers from processing the same job) and Dead-Letter Queues (DLQ) for jobs that repeatedly fail.
2. Amazon SNS (Pub/Sub • 1-to-Many): A publisher sends a message to an SNS topic; SNS fans it out simultaneously to multiple subscribers (SQS queues, HTTP webhooks, Lambda functions, emails).

11. AWS Secrets Manager & SSM Parameter Store#

Decouple secrets and configuration values from source code:

• SSM Parameter Store: Hierarchical storage for non-sensitive configuration keys (e.g. /app/production/api_url) with free standard parameters.
• AWS Secrets Manager: Encrypted key-value store for passwords, API tokens, and database credentials with automated credential rotation.

12. Amazon CloudWatch: Logs, Metrics & Alarms#

Amazon CloudWatch collects monitoring and operational data in the form of logs, metrics, and events:

# CloudWatch Logs Insights Query: Find top 10 error traces in the last hour
fields @timestamp, @message
| filter @message like /ERROR/ or @message like /Exception/
| sort @timestamp desc
| limit 10

13. Developer AWS Quick Reference & CLI#

# Check current authenticated caller identity
aws sts get-caller-identity

# ECR & Container Push
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com
docker build -t web-api .
docker tag web-api:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/web-api:v1.0.0
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/web-api:v1.0.0

# ECS Operations
aws ecs list-clusters
aws ecs list-tasks --cluster production
aws ecs update-service --cluster production --service web-api --force-new-deployment

# EKS Operations
aws eks update-kubeconfig --region us-east-1 --name production-cluster
kubectl get nodes
kubectl get pods -A

# S3 File Operations
aws s3 ls
aws s3 cp app.zip s3://my-bucket/builds/app.zip
aws s3 sync ./dist s3://my-static-website --delete

# Lambda Operations
aws lambda list-functions
aws lambda invoke --function-name process-payment response.json

# Retrieve Secret Value
aws secretsmanager get-secret-value --secret-id app/prod/db

Next Steps: Advance to production architectures, DynamoDB single-table design, and advanced ECS & EKS patterns in the AWS Detailed Course. Return to the TechToday Homepage.