Cloud
AWS
The largest cloud platform, with hundreds of services from virtual machines and storage to databases, queues and ML.
What it is
AWS (Amazon Web Services) launched in 2006 with S3 (object storage) and EC2 (virtual machines). Today it has the broadest catalog of cloud services: compute, networking, databases, queues, analytics, ML.
You pay for what you use. Resources live in regions and availability zones (several data centers inside one region) and are managed through the console, CLI, SDKs or infrastructure as code (Terraform, CloudFormation, CDK).
Access is controlled by IAM: users, roles and policies. It is the core of AWS security, and IAM mistakes are the most common cause of incidents.
Use it when
- You need the widest choice of managed services and a mature enterprise ecosystem.
- Load is variable and you must scale up and down on demand.
- Compliance requirements and regions in specific countries.
- The team already knows AWS, and hiring people is easier than for smaller platforms.
Avoid it when
- A small project with steady load: a VPS at Hetzner or DigitalOcean will be several times cheaper.
- You have no time to learn the pricing model: egress traffic and NAT Gateway can produce surprise bills.
- You want simple frontend deploys without configuring networking and IAM.
Key concepts
- Region / AZ
- A region is a geography (eu-central-1), an availability zone is a separate data center inside it. Spread resources across zones for fault tolerance.
- IAM
- Identities, roles and access policies. Least privilege: grant only the permissions that are really needed.
- EC2 / S3
- EC2 is virtual machines, S3 is highly durable object storage. These are the two foundation services of the platform.
- VPC
- An isolated virtual network with subnets, route tables and security groups.
- Shared responsibility
- AWS is responsible for security of the cloud (hardware, hypervisor), you for security in the cloud (data, access, configuration).
Example
Cheat sheet
| Command or code | What it does |
|---|---|
aws configure | Set up keys and region |
aws sts get-caller-identity | Who am I now: account and user |
aws s3 ls | List S3 buckets |
aws s3 cp file.txt s3://my-bucket/ | Upload a file to a bucket |
aws s3 sync ./dist s3://my-bucket --delete | Sync a folder with a bucket |
aws ec2 describe-instances | List EC2 instances |
aws lambda invoke --function-name fn out.json | Invoke a Lambda function |
aws logs tail /aws/lambda/fn --follow | Follow CloudWatch logs |
aws iam list-users | List IAM users |
aws --profile dev s3 ls | Run a command with another profile |
How to learn it
- Create an AWS account, enable MFA on root, set a budget alert and work through an IAM user, not root.
- Learn IAM: users, roles, policies, the least privilege principle.
- Launch an EC2 instance with SSH, open a port in a security group and deploy a simple app.
- Store files in S3, set access permissions and serve a static site.
- Create a database in RDS and connect the app, and learn VPCs, subnets and security groups.
- Try serverless: Lambda with API Gateway and a queue in SQS.
- Install the AWS CLI and describe resources with Terraform or CDK instead of clicking in the console.
- Add logs and metrics in CloudWatch, Route 53 for DNS and learn what the bill is made of.
Interview questions
1. What is the difference between a region and an availability zone?
A region is a separate geographic area, and an availability zone is one or more isolated data centers inside it. For high availability you deploy across several zones of one region, for disaster recovery across several regions.
2. What is an IAM role and why is it better than access keys?
A role is a set of permissions that a service or user assumes temporarily. It issues short-lived credentials, so the leak risk is lower than with static keys in code or environment variables.
3. How does S3 differ from EBS?
S3 is object storage accessed over an HTTP API, cheap and nearly unlimited. EBS is a block disk attached to a single EC2 instance like a regular volume.
4. Where do surprise AWS bills come from?
Most often from egress traffic, NAT Gateway, forgotten instances and snapshot storage. Budgets and alerts in Billing, resource tags and regular Cost Explorer reviews help.
Interview questions from the bank
Comparisons with this technology
Related technologies
- Google CloudGoogle's cloud with strong data, analytics, Kubernetes (GKE) and ML services.
- Microsoft AzureMicrosoft's cloud, most convenient for .NET, Windows environments and companies on Microsoft 365 and Entra ID.
- AWS LambdaAn AWS service that runs functions in response to events and bills only for execution time.
- TerraformTerraform is an infrastructure as code tool: you describe cloud resources in configuration and it creates and changes them.
- KubernetesKubernetes is a container orchestration system that deploys, scales and heals applications across a cluster of servers.
- Amazon SQSAmazon SQS is a fully managed message queue from AWS that scales automatically and needs no servers.
- Amazon DynamoDBA fully managed AWS key-value and document database with predictable latency and automatic scaling.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).