AWS Cloud Fundamentals

This deck introduces the foundational concepts of Amazon Web Services, covering the building blocks you need to understand before working with the AWS cloud. You'll explore core ideas like cloud computing basics, the main service models, and the AWS Global Infrastructure, including regions, availability zones, and edge locations. It also walks through essential topics such as the Shared Responsibility Model, AWS accounts, AWS Organizations, and the basics of Identity and Access Management, including users, roles, and policies.

It's a great starting point if you're new to AWS, preparing for an entry-level certification like the Cloud Practitioner exam, or simply want a clear, organized overview of how AWS is structured. Even if you have some hands-on experience, these cards can help reinforce the terminology and mental models that show up again and again in AWS documentation and conversations.

To get the most out of your study sessions, try reviewing a small batch of cards each day rather than cramming everything at once, since spaced repetition works best for retaining technical definitions. As you work through the deck, try connecting each concept to a real-world scenario or example in your own words, which helps move the material from short-term memory into something you can actually apply. Good luck on your cloud journey!

Cloud computing is the on-demand delivery of IT resources over the internet with pay-as-you-go pricing, replacing the traditional approach of buying, owning, and maintaining physical data centers and servers. This model lets organizations provision compute, storage, and networking capacity in minutes, paying only for what they actually use rather than for infrastructure that may sit idle most of the time. Amazon Web Services, commonly known as AWS, is Amazon's comprehensive cloud computing platform, offering more than two hundred fully featured services from data centers located all around the world.

AWS delivers a wide range of benefits that explain its popularity with businesses of every size. These benefits include agility in deploying new workloads, the ability to scale capacity up or down on demand, elasticity that matches resources to real-time usage, and a global reach that places infrastructure close to users everywhere. Customers also benefit from pay-as-you-go pricing, strong security features, and high reliability backed by redundant infrastructure. Because AWS takes on the heavy lifting of running hardware and facilities, teams can focus their time and budget on building applications rather than operating data centers.

The cloud industry generally groups services into three main service models that define who manages what. Infrastructure as a Service, or IaaS, provides virtualized computing resources such as servers and storage that customers configure themselves. Platform as a Service, or PaaS, offers a managed development platform where developers deploy code without worrying about the underlying operating system or runtime. Software as a Service, or SaaS, delivers ready-to-use applications over the internet. AWS supports all three models, with examples ranging from EC2 for IaaS-style virtual servers to fully managed databases and end-user applications that resemble SaaS offerings.

The AWS Global Infrastructure is the physical foundation that supports every service in the cloud. It is built from three layered building blocks: Regions, Availability Zones, and Edge Locations, with more than fifty-four Regions, one hundred seventy Availability Zones, and over four hundred Edge Locations spread across the globe. Together, these components give customers the ability to run workloads close to their users, meet local data residency requirements, and recover quickly from disasters by failing over to other locations.

An AWS Region is a geographic area that contains multiple isolated Availability Zones. Each Region is independent of every other Region, and AWS customers choose a Region based on factors such as latency, compliance, and cost. Within a Region, an Availability Zone, or AZ, is an isolated location made up of one or more data centers. AZs have independent power, cooling, and networking so that a failure in one AZ does not affect the others. By placing resources across multiple AZs in the same Region, applications can achieve high availability and tolerate the loss of an entire data center.

Edge Locations sit at the outermost layer of the AWS network and serve as endpoints for services such as CloudFront and Route 53. They are designed to cache content close to end users, which dramatically reduces latency for web traffic and DNS resolution. While Regions and Availability Zones are best suited for running applications and storing data, Edge Locations exist specifically to accelerate content delivery and improve the user experience. Together, these three layers form a global platform that supports everything from small websites to enterprise-scale, multi-region deployments.

Security in AWS is governed by the Shared Responsibility Model, which divides responsibilities between AWS and the customer. AWS is responsible for the security of the cloud, meaning it protects the underlying infrastructure, hardware, and foundational software that run all services. The customer, on the other hand, is responsible for security in the cloud, which includes protecting data, configuring operating systems and applications, managing identity and access, and applying network controls. Understanding where AWS responsibility ends and customer responsibility begins is essential to building a secure environment.

Access to AWS resources is controlled through AWS Identity and Access Management, or IAM. IAM lets administrators create identities such as users, groups, and roles, and attach policies that define exactly what actions each identity is allowed or denied to perform. An IAM User represents a person or application that needs long-term access to AWS and is associated with credentials like access keys or passwords. An IAM Role, by contrast, is a temporary identity that can be assumed by users, services, or applications, making it ideal for short-lived tasks or for granting permissions across accounts without sharing long-term credentials.

Permissions in IAM are expressed through IAM Policies, which are JSON documents listing actions, resources, and effects such as allow or deny. A guiding principle when writing policies is least privilege, which means granting only the permissions necessary for a user or role to perform its tasks. Beyond IAM, AWS provides additional security services. AWS Shield protects against distributed denial-of-service attacks, with a Standard tier that is automatic and free and an Advanced tier that adds enhanced mitigation and support. AWS WAF, the Web Application Firewall, filters malicious web requests such as SQL injection and cross-site scripting using customizable rules. AWS Key Management Service, or KMS, creates and manages cryptographic keys used to encrypt data across many AWS services. Together, these tools help customers fulfill their side of the Shared Responsibility Model.

For larger organizations, AWS Organizations provides centralized governance across multiple AWS accounts. It enables consolidated billing, grouping of accounts into organizational units, and the application of Service Control Policies, or SCPs, that set permission guardrails across the entire organization. Multiple accounts separated by team, project, or environment improve isolation, simplify billing, and make security boundaries easier to enforce at scale.

Compute is at the heart of most cloud workloads, and AWS offers a wide range of options to match different application needs. Amazon Elastic Compute Cloud, or EC2, is the foundational service for compute in AWS. It provides resizable virtual servers called instances that can run a variety of operating systems and be customized with different combinations of CPU, memory, storage, and networking capacity. EC2 is well suited to traditional applications, lift-and-shift migrations, and any workload that requires full control over the underlying virtual machine.

EC2 instances are launched from Amazon Machine Images, or AMIs, which are templates containing the operating system, application server, and any data needed to start a fully configured instance. AWS also categorizes instances into families based on their intended use. General Purpose instances, such as the M5 family, balance compute, memory, and networking for everyday workloads. Compute Optimized instances like the C5 family are tuned for CPU-intensive tasks such as batch processing and gaming servers. Memory Optimized families such as R5 are designed for workloads that need large amounts of RAM, including in-memory databases and real-time analytics. Choosing the right instance type is an important step in balancing performance and cost.

Beyond virtual servers, AWS offers serverless and container-based compute models. AWS Lambda runs code in response to events without requiring customers to provision or manage servers, charging only for the compute time actually consumed. This serverless approach removes much of the operational burden of capacity planning, patching, and scaling. For containerized workloads, Amazon Elastic Container Service, or ECS, is a managed service that orchestrates Docker containers using either the Fargate launch type for a fully serverless experience or the EC2 launch type for more control. Amazon Elastic Kubernetes Service, or EKS) similarly manages Kubernetes clusters, integrating with AWS networking, identity, and monitoring services to simplify operations.

To handle variable demand, AWS Auto Scaling automatically adjusts the number of EC2 instances in response to changing load. Scaling policies are typically tied to CloudWatch metrics such as CPU utilization or request counts, allowing capacity to grow during traffic spikes and shrink during quiet periods. Auto Scaling helps optimize cost while maintaining performance and availability, and it works hand in hand with load balancing to distribute traffic across the available instances.

Networking in AWS centers on the Virtual Private Cloud, or VPC, which lets customers provision a logically isolated section of the AWS cloud. Within a VPC, customers define IP address ranges, create subnets, configure route tables, and attach gateways to control how resources communicate. Because a VPC is logically isolated, traffic between resources in different VPCs is separated just as it would be in different on-premises networks, which gives customers strong control over their network architecture.

A subnet is a range of IP addresses within a VPC and is always associated with a single Availability Zone. Subnets are typically classified as public or private depending on whether they have a route to an Internet Gateway. An Internet Gateway is a horizontally scaled, redundant component that connects a VPC to the public internet, enabling resources in public subnets to send outbound traffic and accept inbound connections. For resources in private subnets that need occasional outbound access, such as for downloading software updates, a NAT Gateway provides Network Address Translation. A NAT Gateway allows instances in a private subnet to reach the internet while preventing unsolicited inbound connections, preserving the security of the private environment.

Elastic Load Balancing, or ELB, automatically distributes incoming application traffic across multiple targets such as EC2 instances, containers, and IP addresses. AWS offers three main types of load balancers, each tuned for a specific use case. The Application Load Balancer, or ALB, operates at the HTTP and HTTPS level and is ideal for web applications that need content-based routing. The Network Load Balancer, or NLB, handles TCP, UDP, and TLS traffic at extreme scale and very low latency. The Gateway Load Balancer, or GWLB, is designed for deploying and scaling third-party virtual appliances such as firewalls and intrusion detection systems.

Beyond the VPC, two services handle global traffic management and content delivery. Amazon Route 53 is a scalable Domain Name System, or DNS, web service that supports domain registration, health checks, and traffic routing policies such as latency-based routing and geolocation routing. Amazon CloudFront is a content delivery network that caches static and dynamic web content at Edge Locations around the world, reducing latency for end users and offloading traffic from origin servers. Together, Route 53 and CloudFront form the outer layer of an AWS network architecture, directing users to the closest, healthiest entry point for an application.

AWS provides a rich portfolio of storage and database services, each designed for specific access patterns and workloads. Amazon Simple Storage Service, or S3, is the foundational object storage service. It is built to store and retrieve any amount of data from anywhere on the web, offering eleven nines of durability and virtually unlimited scalability. S3 supports features such as versioning, which keeps multiple variants of an object in the same bucket, and lifecycle policies that automatically transition objects to cheaper storage classes or expire them after a defined period.

S3 offers several storage classes that allow customers to balance cost against access frequency. S3 Standard is designed for frequently accessed data, while S3 Intelligent-Tiering automatically moves objects between tiers based on changing access patterns. For long-term archives, services such as S3 Glacier provide very low-cost storage with retrieval times ranging from minutes to hours. One Zone-IA is a lower-cost option for infrequently accessed data that does not require the multi-AZ resilience of other classes. For block-level storage that attaches directly to EC2 instances, Amazon Elastic Block Store, or EBS, provides persistent, high-performance volumes with snapshot capabilities for backup and recovery. For shared file storage, Amazon Elastic File System, or EFS, delivers a scalable NFS file system that can be mounted by multiple EC2 instances across multiple Availability Zones.

On the database side, AWS offers both relational and non-relational managed services. Amazon Relational Database Service, or RDS, supports popular engines such as MySQL, PostgreSQL, MariaDB, Oracle, and Microsoft SQL Server. RDS automates routine tasks like backups, patching, and failover, and Multi-AZ deployments provide high availability by replicating data synchronously to a standby instance in another Availability Zone. For applications that need a non-relational model, Amazon DynamoDB is a fully managed NoSQL database that delivers single-digit millisecond latency at any scale. DynamoDB includes features such as global tables for multi-region replication and automatic scaling of throughput capacity. To accelerate read-heavy workloads, Amazon ElastiCache provides in-memory caching using Redis or Memcached engines, offloading traffic from primary databases and reducing overall latency.

Operating applications in the cloud requires visibility into both infrastructure performance and user activity. AWS addresses these needs through a set of monitoring and messaging services. Amazon CloudWatch is the central monitoring service, collecting metrics, logs, and events from AWS resources and applications. CloudWatch provides dashboards for visualization, alarms that trigger when metrics cross thresholds, and automated actions that can respond to those alarms, such as invoking an Auto Scaling policy or invoking a Lambda function. With CloudWatch, operators gain a unified view of system health and can detect and respond to issues in near real time.

While CloudWatch focuses on performance and operational telemetry, AWS CloudTrail focuses on auditing and governance. CloudTrail records every API call made in an AWS account, capturing who made the request, when it was made, which service was called, and which resources were affected. These event histories are stored in log files and can be used for compliance reporting, security analysis, change tracking, and troubleshooting. Together, CloudWatch and CloudTrail offer complementary perspectives: CloudWatch shows how systems behave, while CloudTrail shows who did what and when.

Many modern applications are built as collections of decoupled services that communicate through messaging. Amazon Simple Notification Service, or SNS, implements a publish-subscribe model in which publishers send messages to a topic and multiple subscribers receive them. SNS is well suited to fan-out scenarios such as sending notifications via email, SMS, or HTTP endpoints. Amazon Simple Queue Service, or SQS, provides message queuing for distributed systems and microservices. Producers place messages into a queue, and consumers retrieve them asynchronously, which helps smooth out bursts in demand and ensures that work is not lost even if a consumer temporarily fails. Combining SNS and SQS lets teams design reliable, event-driven architectures that scale independently and recover gracefully from component failures.

Understanding how AWS pricing works is essential for controlling costs and getting the most value from the platform. AWS offers several pricing models that suit different usage patterns. On-Demand pricing charges customers by the hour or by the second with no long-term commitment, making it a good fit for short-term or unpredictable workloads. Reserved Instances provide a significant discount in exchange for a one- or three-year commitment to a specific instance type, which is useful for steady-state workloads. Savings Plans offer similar discounts but with more flexibility, applying automatically across instance families and Regions. Spot Instances let customers bid for spare EC2 capacity at deeply discounted prices, making them attractive for fault-tolerant, interruptible jobs such as batch processing and rendering.

Several tools help customers monitor, forecast, and optimize their spending. The AWS Free Tier offers limited free usage of more than one hundred services for either twelve months or indefinitely, depending on the service, which is ideal for learning and prototyping. AWS Cost Explorer visualizes historical costs and usage, generates forecasts, and provides recommendations such as identifying underutilized Reserved Instances that could be purchased for additional savings. AWS Support plans range from Basic, which is free and gives access to documentation and service health dashboards, through Developer and Business tiers, up to Enterprise, which adds features such as a dedicated Technical Account Manager, proactive guidance, and the fastest response times.

Beyond pricing and support, AWS provides architectural guidance through the AWS Well-Architected Framework. This framework describes best practices across six pillars: Operational Excellence, which focuses on running and monitoring systems to deliver business value; Security, which protects information, systems, and assets; Reliability, which ensures workloads perform their intended functions and recover from failures; Performance Efficiency, which uses computing resources efficiently to meet system requirements; Cost Optimization, which delivers business value at the lowest price point; and Sustainability, which minimizes the environmental impact of cloud workloads. By reviewing architectures against these pillars, teams can identify risks, apply improvements, and build solutions that are secure, efficient, and resilient as they grow.