Cloud Computing AWS

This deck is a great starting point for anyone new to Amazon Web Services and cloud computing in general. It walks you through the core ideas that underpin the AWS platform, beginning with what cloud computing actually means and the three main service models. From there, it builds up your knowledge of essential building-block services like EC2 for virtual servers and S3 for object storage, along with the supporting concepts you'll need to make sense of them, such as Regions, Availability Zones, AMIs, Security Groups, and EBS Volumes.

The cards are well suited to beginners preparing for an AWS certification like the Cloud Practitioner exam, as well as developers, IT students, or professionals who simply want to understand how AWS works under the hood. Even if you already have some hands-on experience with AWS, running through these questions is a useful way to check whether your understanding of the fundamentals is solid and to fill in any gaps in terminology.

To get the most out of the deck, try to picture how each concept relates to the others. For example, when you review an EC2 question, mentally connect it to the security group, key pair, and AMI that would be involved in launching an instance. Spacing your study sessions over several days rather than cramming will help these definitions stick, and pairing the flashcards with some experimentation in the AWS Free Tier can turn abstract terms into practical knowledge.

Cloud computing is the on-demand delivery of IT resources over the internet with pay-as-you-go pricing, replacing the need to own and operate physical data centers. Major providers include AWS, Azure, and Google Cloud. The three main service models describe who manages what: in IaaS (Infrastructure as a Service), exemplified by Amazon EC2, the provider manages hardware while the customer manages the operating system, applications, and data; in PaaS (Platform as a Service), exemplified by Elastic Beanstalk, the provider manages the operating system and runtime while customers focus on code and data; and in SaaS (Software as a Service), exemplified by Gmail and Salesforce, the provider manages everything and users simply consume the application.

The AWS Shared Responsibility Model formalizes who secures what. AWS is responsible for security of the cloud, which covers hardware, networking, facilities, and managed services. The customer is responsible for security in the cloud, which covers data encryption, IAM policies, operating system patching, firewall rules, and application code. Misunderstanding this boundary is one of the most common sources of cloud security incidents.

AWS organizes its global infrastructure into Regions (such as us-east-1), each a separate geographic area containing multiple isolated data centers called Availability Zones. Each AZ has independent power, networking, and connectivity, and deploying across multiple AZs provides high availability and fault tolerance. EC2 Placement Groups refine this further: cluster placements pack instances close for low latency in HPC workloads, spread placements separate them across distinct hardware to limit correlated failures (up to seven per AZ), and partition placements spread instances across logical partitions for workloads like Hadoop and Kafka.

The AWS Well-Architected Framework describes six pillars for designing cloud workloads: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. The free AWS Well-Architected Tool and its domain-specific Lenses help teams review workloads against these pillars and track risks. Trusted Advisor analyzes accounts for Cost Optimization, Security, Fault Tolerance, Performance, and Service Limits, with full checks available on Business or Enterprise support. AWS Organizations centralizes management across multiple accounts via Organizational Units and Service Control Policies (SCPs), which act as permission boundaries rather than grants. AWS Control Tower automates the setup of secure multi-account environments with preventive and detective guardrails, while IAM Identity Center (formerly AWS SSO) replaces per-account IAM users for everyday human access across the organization. New accounts can explore services through the AWS Free Tier, which combines always-free monthly limits with twelve-month-free promotions and short trials, and can choose support tiers from Basic (free) through Developer and Business to Enterprise On-Ramp and Enterprise, which adds fifteen-minute response times and a designated Technical Account Manager.

AWS Identity and Access Management (IAM) controls who can access what in an account. Its four core components are Users (individual people or applications), Groups (collections of users with shared permissions), Roles (identities that can be assumed by trusted entities without permanent credentials), and Policies (JSON documents defining permissions with Effect, Action, and Resource fields). Policies can be identity-based (attached to users, groups, or roles) or resource-based (attached to resources like S3 buckets). The Principle of Least Privilege guides all IAM design: start with no permissions and grant only the minimum required, prefer managed policies over inline ones, enable MFA on all human users, rotate credentials regularly, and use IAM Access Analyzer to surface unused or unintended access.

IAM Roles shine in scenarios that need temporary, credential-free access: EC2 instance roles let workloads call AWS services securely, Lambda execution roles give functions their permissions, cross-account roles connect users in different accounts, and federation roles integrate external identity providers via SAML or OIDC. Roles always issue temporary credentials through the AWS Security Token Service (STS). When identity is established, encryption is the next concern. AWS Key Management Service (KMS) creates and controls the encryption keys used by S3, EBS, RDS, DynamoDB, Lambda, SQS, and many more services. AWS-managed keys are free and rotate automatically, while customer-managed CMKs give full control, all auditable through CloudTrail. KMS powers envelope encryption at scale, in which a data key encrypts the actual payload and that data key is itself encrypted by the KMS key, allowing huge objects to be protected without exhausting KMS API quotas. Secrets Manager adds automatic rotation (typically via Lambda) for RDS, Redshift, and DocumentDB credentials, while Systems Manager Parameter Store provides hierarchical configuration storage with a free Standard tier and an Advanced tier, where SecureString parameters use KMS for sensitive values.

Governance relies on configuration and event history. CloudTrail records every API call as an event, capturing who made it, when, from where, and what was requested, and delivers events to an S3 bucket or a CloudWatch Logs group for long-term retention. AWS Config maintains a detailed inventory of resources and tracks configuration changes over time, answering "what did my resource look like at point T?" while evaluating Config Rules for desired state. Security Hub aggregates findings from GuardDuty, Macie, Inspector, IAM Access Analyzer, and third-party products into a single pane of glass, running continuous automated checks against standards such as the CIS AWS Foundations Benchmark and PCI DSS. GuardDuty is the threat-detection workhorse, analyzing CloudTrail, VPC Flow Logs, and DNS logs with machine learning and threat intelligence to flag malicious activity and unauthorized behavior. Macie focuses on data security in S3, discovering and classifying PII, credentials, and financial information. For perimeter protection, AWS WAF inspects web requests and blocks common exploits via managed rule groups for SQL injection and XSS, IP allow/block lists, and rate-based rules, attaching to CloudFront, ALB, API Gateway, and Cognito. AWS Shield Standard protects every AWS customer from common DDoS attacks at no cost, while Shield Advanced adds 24/7 access to the DDoS Response Team, real-time visibility, and cost protection against scaling charges incurred during an attack.

Amazon Elastic Compute Cloud (EC2) provides resizable virtual servers called instances, billed by the second or hour. Customers choose an instance type from five main families: General Purpose (T, M series) for balanced workloads, Compute Optimized (C) for high-performance processors and batch processing, Memory Optimized (R, X) for fast access to large in-memory datasets, Storage Optimized (I, D, H) for high sequential read or write to local storage, and Accelerated Computing (P, G) for GPU workloads such as machine learning and graphics rendering. An Amazon Machine Image (AMI) supplies the software configuration—operating system, application server, and applications—and can come from AWS (Amazon Linux, Ubuntu, Windows), the AWS Marketplace, or a customer's own golden image. AMIs are region-specific but can be copied across regions. Security Groups act as stateful virtual firewalls attached at the instance (ENI) level, allowing only permissive rules and automatically permitting return traffic. Key Pairs combine a public key stored by AWS with a private key you download for SSH access; if the private key is lost, it cannot be recovered. Amazon Elastic Block Store (EBS) provides persistent block-level storage in types tuned for different workloads: General Purpose SSD (gp3/gp2), Provisioned IOPS SSD (io2/io1) for databases, Throughput Optimized HDD (st1) for big data, and Cold HDD (sc1) for infrequent access. EBS volumes are tied to a single AZ but can be snapshotted to S3 for backups.

EC2 Auto Scaling complements EC2 by adjusting the number of instances to match demand through launch templates, Auto Scaling Groups with min/max/desired capacity, and scaling policies (target tracking, step, or simple). Cooldown periods (default 300 seconds) prevent the rapid fluctuation known as thrashing by blocking additional launch or terminate decisions until metrics stabilize. AWS Elastic Beanstalk layers a PaaS experience on top of EC2 and friends: developers upload code and Beanstalk handles capacity provisioning, load balancing, health monitoring via CloudWatch, and patching, while leaving full control over the underlying resources available for those who need it.

AWS Lambda is the serverless counterpart: event-driven functions in Node.js, Python, Java, Go, .NET, or Ruby that scale from zero to thousands of concurrent executions, billed by the millisecond, with a maximum runtime of 15 minutes and up to 10 GB of memory. Common triggers include API Gateway for HTTP, S3 for object events, DynamoDB Streams for table changes, SQS for queue messages, EventBridge for scheduled or event-driven rules, and SNS for notification fanout. A cold start happens when Lambda must initialize a fresh execution environment; mitigation strategies include Provisioned Concurrency to keep instances warm, choosing lighter runtimes such as Python or Node.js over Java, minimizing deployment package size, and warming functions with scheduled pings. Lambda Layers are ZIP archives of shared libraries that promote code reuse and keep deployment packages small, with up to five layers per function and a combined unzipped size limit of 250 MB. Other Lambda constraints worth remembering include the 50 MB compressed limit for direct zip upload (250 MB via S3), the 10 GB limit for container images, the 1,000 concurrent execution default quota (raised via Reserved Concurrency caps and Provisioned Concurrency warmth), the 512 MB ephemeral /tmp disk, the 4 KB environment variable budget, and the well-known VPC cold start penalty that AWS mitigates through shared ENIs in Hyperplane.

Container workloads run on Amazon Elastic Container Service (ECS) or Amazon Elastic Kubernetes Service (EKS), each supporting both EC2-based and fully managed Fargate compute. ECS uses Task Definitions, Services, and Clusters, while EKS runs the Kubernetes control plane across multiple AZs and supports EKS Add-ons, EKS Anywhere for on-prem, and the EKS Connector for hybrid visibility. Fargate defines CPU and memory per task or pod, charging per vCPU/GB-hour consumed without any EC2 to manage. Amazon Elastic Container Registry (ECR) hosts OCI images with IAM-controlled access, vulnerability scanning (Basic on push or Enhanced continuous), and at-rest encryption with KMS. Beyond instances and containers, AWS Batch dynamically provisions EC2, Spot, or Fargate resources to run Docker batch jobs with priority-based scheduling. Amazon Lightsail offers VPS-style bundles under five dollars per month for simple sites and learning. AWS Outposts brings native AWS hardware into on-prem data centers for low-latency and data-residency use cases, AWS Local Zones place compute and storage close to population centers that lack a Region for sub-ten-millisecond latency, and AWS Wavelength embeds AWS at telecom 5G edges to serve single-digit-millisecond applications like AR/VR and IoT.

Amazon Simple Storage Service (S3) is the foundational object storage service in AWS, offering virtually unlimited storage with eleven nines of durability and objects up to 5 TB in size, accessed via HTTP and HTTPS APIs. Data lives as objects inside buckets whose names must be globally unique across all AWS accounts, three to sixty-three characters, lowercase, with no underscores, and capped at one hundred buckets per account by default. Each bucket is created in a specific Region, and objects inside it are identified by a key representing the full path. S3 supports a range of storage classes for different cost and access profiles: S3 Standard for frequently accessed data, S3 Intelligent-Tiering that automatically moves objects between tiers based on access patterns, S3 Standard-IA and One Zone-IA for infrequent access with retrieval fees (the latter confined to a single AZ and therefore cheaper), S3 Glacier Instant Retrieval for archival with millisecond access, and S3 Glacier Deep Archive for the lowest cost with 12-hour retrieval.

S3 lifecycle policies automate transitions between storage classes and expirations by defining rules based on prefixes or tags that target current or previous versions. Versioning, when enabled, keeps every variant of an object after each overwrite or delete, marks deletes with a recoverable delete marker, and once activated can only be suspended, never disabled; it is also a prerequisite for Cross-Region Replication and for S3 Object Lock. Object Lock adds WORM (write once, read many) semantics in either Governance mode, where users with special IAM permissions can bypass the lock, or Compliance mode, where no one including the root account can delete or overwrite an object before the retention period elapses. S3 Replication asynchronously copies objects across buckets, either cross-region (CRR) for disaster recovery and low-latency access, or same-region (SRR) for compliance or data sovereignty. Replication requires versioning on both ends and only copies new objects by default; S3 Batch Replication backfills existing objects. S3 Batch Operations in general can run large-scale one-time actions across billions of objects.

For large or repeated uploads, Multipart Upload splits a single object into parts of 5 MB to 5 GB, with up to ten thousand parts, allowing parallel uploads, resume from failed parts, and faster transfers for files larger than 100 MB. Pre-signed URLs grant temporary, time-limited access to private objects (default 15 minutes, maximum 7 days), and S3 Transfer Acceleration routes uploads through CloudFront edge locations across the AWS backbone for faster long-distance transfers. S3 Event Notifications fire when objects are created, deleted, restored, or change redundancy class, and can be delivered to SQS, SNS, or Lambda (with at-least-once semantics that require idempotent consumers). S3 Storage Lens delivers thirty-plus organization-wide metrics through an interactive dashboard with daily S3 exports, and S3 Select and S3 Glacier Select run simple SQL expressions to filter data inside an object or archive without downloading the whole payload.

For Linux workloads needing shared file storage, Amazon Elastic File System (EFS) provides a managed, elastic NFS file system that scales to petabytes and can be mounted by EC2, ECS, Lambda, and on-premises hosts through Direct Connect, with Standard and Infrequent Access tiers. Amazon FSx brings third-party file systems to AWS: FSx for Windows File Server with SMB, NTFS, and Active Directory integration; FSx for Lustre for high-performance computing and S3 integration; FSx for NetApp ONTAP for enterprise NFS and SMB; and FSx for OpenZFS for NFS with snapshots and cloning. AWS Storage Gateway bridges on-premises and cloud with three appliance types: File Gateway exposes NFS or SMB files backed by S3, Volume Gateway provides iSCSI block storage with EBS snapshots in the cloud, and Tape Gateway presents a virtual tape library backed by S3 Glacier for traditional backup workflows.

Every workload that runs in a VPC ultimately relies on a small set of networking primitives. An Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network scoped to a Region, defined by a CIDR block (for example, 10.0.0.0/16) and subdivided into subnets, route tables, and gateways. Every AWS account automatically gets a default VPC in each Region. Subnets are either public—with a route to an Internet Gateway and resources using public IPs that can both send and receive internet traffic—or private, with no direct internet route and resources relying on a NAT Gateway placed in a public subnet for outbound-only connectivity (think software updates). A typical multi-tier application puts web servers in public subnets and databases in private ones. Traffic protection happens in two complementary layers: Security Groups at the ENI level are stateful with only allow rules, while Network ACLs (NACLs) at the subnet level are stateless, support both allow and deny rules, and evaluate in numeric order; using both provides defense in depth.

Connecting VPCs together without traversing the public internet relies on several building blocks. VPC Peering creates private IP links between two VPCs across accounts or regions with no transitive routing and no overlapping CIDR blocks, and the route tables on both sides must be updated to take advantage of the link. AWS Transit Gateway acts as a central hub that connects VPCs, VPNs, and Direct Connect gateways, scaling to five thousand attachments and eliminating the complexity of full-mesh peering. AWS PrivateLink extends private connectivity to AWS services, SaaS offerings, and other VPCs through Interface VPC Endpoints (ENIs in your subnets), keeping traffic on the AWS backbone. The endpoints themselves come in two flavors: gateway endpoints, free and limited to S3 and DynamoDB with a route-table entry, and interface endpoints that support most services and charge per hour plus per gigabyte.

Hybrid networking pairs Site-to-Site VPN, which creates encrypted IPsec tunnels over the public internet (two tunnels per connection for redundancy, often paired with Direct Connect as a backup), with AWS Direct Connect, a dedicated private connection from one gigabit to one hundred gigabits offering consistent performance and lower bandwidth costs. AWS Client VPN uses OpenVPN-based clients so remote users can reach AWS and on-premises resources through mutual TLS or SAML-based single sign-on, ideal for distributed workforces.

Routing and content delivery use Amazon Route 53, the AWS DNS service named after port 53, which supports domain registration, public and private hosted zones, and routing policies including Simple (single resource), Weighted (traffic split by percentage), Latency-based (lowest latency region), Failover (primary plus standby), Geolocation (user location driven), Geoproximity (resource location with bias), and Multivalue Answer (multiple IPs with health checks). Health checks monitor endpoints from multiple global probes and integrate with failover and multivalue policies to remove unhealthy targets. Elastic Load Balancing distributes traffic across multiple targets through three flavors: the Application Load Balancer (ALB) at Layer 7 for HTTP and HTTPS with path- and host-based routing, the Network Load Balancer (NLB) at Layer 4 for TCP and UDP with ultra-low latency and millions of requests per second, and the Classic Load Balancer (CLB), retained for legacy workloads. Target Groups route requests to registered EC2 instances, IP addresses, Lambda functions (ALB only), or other ALBs, performing health checks and sending traffic only to healthy targets.

Amazon CloudFront is AWS's global content delivery network with more than six hundred Points of Presence that route users to the nearest edge via DNS and Anycast IPs, cache responses by TTL and cache key, and forward cache misses to origins such as S3, ALB, EC2, MediaStore, or custom endpoints, with origin failover through origin groups. Each Cache Behavior in a distribution defines which origin, viewer protocol policy, cache policy, and origin request policy apply to a URL pattern. CloudFront Functions are sub-millisecond JavaScript at the edge for viewer request and response events, ideal for URL rewrites and cache key normalization, while Lambda@Edge offers Node.js or Python with access to all four request lifecycle phases (viewer request, viewer response, origin request, origin response) for richer tasks such as A/B testing, header rewrites, and lightweight authentication. Signed URLs and signed cookies gate private content using a trusted key group or AWS account, with signed cookies especially useful for HLS and DASH streaming. For private S3 origins, Origin Access Control (OAC) replaces the older OAI, keeps the bucket private, and supports SSE-KMS plus dynamic requests.

Managed relational databases on AWS start with Amazon Relational Database Service (RDS), supporting MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Amazon Aurora (which is MySQL or PostgreSQL compatible and up to five times faster). RDS handles provisioning, patching, backups, and replication so applications focus on data rather than operations. Multi-AZ deployments add a synchronous standby replica in a different Availability Zone for automatic failover (DNS flips to the standby in sixty to one hundred twenty seconds) and high availability, but the standby is not readable, and the goal is resilience rather than read scaling. Read scaling comes from Read Replicas, which use asynchronous replication, can live in different regions, and are explicitly readable. Automated backups are enabled by default with one- to thirty-five-day retention and point-in-time recovery roughly every five minutes; manual snapshots persist indefinitely until deleted, can be shared across accounts, and are copied across regions. Both kinds of backup are stored in S3.

Amazon DynamoDB delivers single-digit-millisecond performance at any scale as a fully managed NoSQL key-value and document database. Tables require a partition key plus an optional sort key, run serverless without infrastructure to manage, and offer both on-demand and provisioned capacity modes (the latter specifies Read and Write Capacity Units with optional Auto Scaling), and you can switch between modes once every twenty-four hours. Global Secondary Indexes use a different partition key and sort key, can be created or modified at any time, and have their own throughput; Local Secondary Indexes share the base table's partition key with a different sort key and must be created at table-creation time, sharing throughput with the base table. Global Tables replicate DynamoDB across regions for active-active workloads.

For messaging and decoupling, Amazon Simple Queue Service (SQS) is a fully managed message queue with Standard queues offering nearly unlimited throughput with at-least-once delivery and best-effort ordering, and FIFO queues providing exactly-once processing with strict ordering and up to three thousand messages per second when batching. Messages persist up to fourteen days (default four). The Visibility Timeout (default thirty seconds, maximum twelve hours) hides a message from other consumers while it is being processed; set it longer than the worst-case processing time to avoid duplicate processing. Long Polling enables ReceiveMessage to wait up to twenty seconds for messages and reduces empty responses and API cost. DelaySeconds hides a message for up to fifteen minutes, perfect for deferred tasks or short retries. Dead Letter Queues receive messages that fail processing after a configurable maxReceiveCount, isolating poison messages so the main queue keeps flowing. Amazon Simple Notification Service (SNS) is the pub/sub counterpart: publishers send to topics, subscribers receive through email, SMS, HTTP, SQS queues, or Lambda functions, and message filtering routes only relevant events. Combining SNS to SQS delivers fan-out with persistence and per-consumer scaling. Amazon EventBridge is a serverless event bus with built-in sources for AWS services, SaaS apps (Datadog, Zendesk, and others), and custom apps, routing based on content filtering rules to Lambda, SQS, SNS, Step Functions, Kinesis, and more, and replacing CloudWatch Events with additional features such as the schema registry.

Real-time analytics flow through Amazon Kinesis Data Streams, which delivers real-time, durable, ordered records to shards processed by Lambda or KCL applications with sub-second latency, with replay up to three hundred sixty-five days through extended retention; Kinesis Data Firehose loads streaming data into S3, Redshift, OpenSearch, or custom HTTP endpoints with near-real-time delivery (lowest around sixty seconds) and optional Lambda transformations, but lacks replay, and Managed Service for Apache Flink (formerly Kinesis Data Analytics) lets you author SQL or Flink code to transform streams end to end. AWS Glue is the serverless data integration service, built around the Hive-compatible Glue Data Catalog, Crawlers that auto-detect schemas, Glue Jobs that run Apache Spark in Python or Scala, and a visual Glue Studio. Amazon Athena queries data in S3 using standard SQL with pricing of five dollars per terabyte scanned, dramatically reduced by partitioning and columnar formats such as Parquet and ORC. Amazon Redshift is the managed cloud data warehouse using columnar storage and massively parallel processing; Redshift Serverless bills by RPU-second, and Spectrum extends queries directly to S3 without loading. Amazon EMR runs Apache Spark, Hadoop, Hive, Presto, Flink, and HBase on EC2 or EKS (with an EMR Serverless option), handling provisioning and scaling for large ETL, ML, and log analytics workloads. AWS Lake Formation centralizes data lake permissions (table- and column-level) atop S3 and the Glue Catalog, while Amazon QuickSight provides serverless business intelligence with ML Insights and pay-per-session pricing. Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) covers full-text search and log analytics with multi-AZ domains, fine-grained access control, and integrations into Kinesis Firehose and CloudWatch Logs. AWS Step Functions coordinates distributed components through Amazon States Language JSON state machines in two flavors: Standard for long-running workflows up to one year with exactly-once execution, and Express for short-lived workloads up to five minutes with at-least-once semantics and high throughput.

The application-facing services at AWS make it easier to expose APIs, authenticate users, and build full-stack experiences. Amazon API Gateway creates, publishes, maintains, monitors, and secures REST, HTTP, and WebSocket APIs, with REST APIs offering the richest features (request validation, usage plans, API keys) and HTTP APIs offering a cheaper, lower-latency fit for Lambda-backed serverless backends. Throttling protects backends with a steady-state limit of ten thousand requests per second per account and a five-thousand-request-per-second burst, returning HTTP 429 when exceeded; per-method rate and burst limits and API-key-based quotas are configured on REST APIs. Amazon Cognito provides authentication, authorization, and user management through User Pools (user directories with sign-in, MFA, and SAML/OIDC federation) and Identity Pools (which exchange IdP tokens for temporary AWS credentials), issuing ID, access, and refresh JWTs and acting as an OIDC identity provider for API Gateway and ALB. AWS Amplify is a set of tools and services for building full-stack web and mobile apps, with Amplify Studio's visual UI builder, the Amplify CLI for backend resources (Auth, Storage, Functions, GraphQL), and Amplify Hosting for Git-based CI/CD with CloudFront, branch previews, and custom domains. AWS AppSync is a managed GraphQL service that delivers a single endpoint to securely query and mutate data from multiple sources such as DynamoDB, Aurora, Lambda, OpenSearch, and HTTP endpoints, including real-time subscriptions over WebSockets and offline data sync.

Observability centers on Amazon CloudWatch, which provides metrics (AWS service metrics retained for fifteen months at no cost, custom metrics via the PutMetricData API, and application metrics through the CloudWatch Agent or SDK) at one-minute resolution by default and one-second resolution for detailed monitoring on supported services. CloudWatch Alarms watch a single metric and trigger actions such as SNS notifications, Auto Scaling, EC2 recovery, or Lambda invocations when thresholds are crossed, with three states (OK, ALARM, INSUFFICIENT_DATA) and composite alarms that combine multiple alarms using AND/OR logic. Anomaly Detection applies machine learning to a metric's history to create expected bands and reduces false positives from static thresholds on spiky or seasonal workloads. CloudWatch Logs centralizes log ingestion from EC2, Lambda, ECS, Route 53, VPC Flow Logs, and on-premises sources; Logs Insights is an interactive query language for searching and aggregating log events; metric filters turn log patterns into metrics; and subscription filters stream logs to Kinesis, Lambda, or OpenSearch. Logs persist indefinitely unless a retention policy is set. CloudWatch Synthetics runs canaries-configurable scripts that follow user paths in an application around the clock, checking availability and latency, capturing screenshots, and writing to Logs. AWS X-Ray provides distributed tracing that captures requests as they travel through services such as Lambda, ECS, EC2, API Gateway, and DynamoDB, showing a service map and surfacing latency breakdown; instrumentation can use the X-Ray SDK or AWS Distro for OpenTelemetry (ADOT), a secure AWS-supported OpenTelemetry distribution with auto-instrumentation for Java, Python, .NET, and Go that exports to CloudWatch, X-Ray, or any OTLP backend. Amazon Managed Service for Prometheus (AMP) provides a serverless Prometheus-compatible metrics backend that integrates with ADOT, EKS, ECS, and EC2 and dashboards through Amazon Managed Grafana, a fully managed Grafana service with SSO via IAM Identity Center, Okta, or Auth0 and fine-grained access controls.

Infrastructure as Code on AWS covers declarative, imperative, and serverless flavors. AWS CloudFormation defines resources in JSON or YAML templates: a Template describes desired resources, a Stack is a running collection of those resources, a Change Set previews updates before applying, and Drift Detection identifies manual changes made outside CloudFormation. AWS CDK is an open-source framework that uses familiar programming languages (TypeScript, Python, Java, Go, .NET) to define infrastructure through reusable constructs, which synthesize into CloudFormation and deploy via the cdk deploy command. AWS SAM (Serverless Application Model) extends CloudFormation with simplified syntax for Lambda, API Gateway, DynamoDB, SQS, and Step Functions; the SAM CLI powers sam local, sam build, sam deploy, and pipeline-driven CI/CD. AWS CodeBuild runs managed continuous integration by compiling, testing, and packaging code in ephemeral Docker containers according to a buildspec.yml with pay-per-build-minute pricing; AWS CodeDeploy automates application deployments to EC2, ECS, Lambda, and on-premises servers with In-place and Blue/Green strategies (the latter enabling traffic shifting via ALB and Route 53 plus fast rollback); AWS CodePipeline orchestrates source, build, test, and deploy stages with parallel execution and manual approvals, integrating source from CodeCommit, S3, ECR, GitHub, or Bitbucket. Note that CodeCommit is being closed to new customers, so most teams now use GitHub, GitLab, or CodeCatalyst. AWS Service Catalog centrally manages and governs approved IT services as CloudFormation-backed products that end users self-service launch within launch constraints; AWS Proton offers template-driven deployment for platform engineers with environment and service templates that developers use to self-serve versioned infrastructure. AWS App Runner is a fully managed way to deploy containerized web apps and APIs from source code or a container image with automatic scaling, load balancing, and TLS, perfect for simple services that do not need complex networking.

Amazon SageMaker is the fully managed machine learning platform covering every stage of the ML lifecycle: labeling, data preparation, training through built-in algorithms, BYO frameworks, or JumpStart, hyperparameter tuning, deployment, and monitoring. SageMaker Studio is the integrated IDE for the entire workflow, and inference can run as real-time endpoints, asynchronous inference, batch transform, or serverless endpoints depending on the workload's latency and traffic shape.

Pre-built AI services deliver high-quality models through simple APIs for common tasks. Amazon Rekognition analyzes images and video for object, scene, and text detection, face analysis and comparison, celebrity recognition, liveness checks, and unsafe content moderation including PPE detection, charged per image or per minute of video. Amazon Comprehend applies natural language processing to text, returning sentiment, entities, key phrases, language, syntax, topic models, and custom entity recognition, with a Comprehend Medical variant for clinical text. Amazon Translate delivers neural machine translation across dozens of languages with custom terminology, formality, and profanity masking controls. Amazon Polly turns text into lifelike speech with many voices and languages, supporting Neural TTS for higher quality, SSML markup, and lexicons for custom pronunciation; output formats include MP3, OGG, and PCM. Amazon Lex builds conversational interfaces for chatbots and voice bots using the same automatic speech recognition and natural language understanding that powers Alexa, with Lambda for fulfillment and Cognito for authentication, easily integrating with Amazon Connect and many messaging channels. Amazon Transcribe converts audio to text in real time or batch, with speaker identification, custom vocabulary, and language identification, including Transcribe Medical for clinical conversations and timestamped JSON output. Amazon Textract goes beyond OCR to extract printed text, handwriting, and structured data such as tables and form fields with spatial context, with pre-trained APIs for expense and identity documents.

The IoT services in AWS let fleets of devices connect to the cloud and to each other. AWS IoT Core is the managed cloud service for connecting, managing, and interacting with billions of devices: the Device Gateway ingests traffic over MQTT and HTTPS, the Message Broker handles publish-subscribe delivery, Device Shadow keeps a virtual state for each device that is synchronized even when the device is offline, the Rules Engine routes events to Lambda, Kinesis, SNS, and more, and Device Defender monitors security posture across the fleet. AWS IoT Greengrass extends AWS to edge devices, running Lambda functions and Docker containers on local hardware with offline operation and synchronizing state with the cloud; it supports machine learning inference at the edge by deploying models trained in the cloud and running them locally.