Amazon Web Services (AWS)
AWS reference covering accounts, regions, IAM, networking, compute, storage, databases, serverless, messaging, observability, security, reliability, cost, infrastructure as code, and incident readiness.
Accounts, Regions & Identity
Organizations, Accounts, Regions & AZs
Use multiple accounts as strong isolation boundaries, choose regions for users/compliance/services, and spread production across Availability Zones.
IAM Roles, Policies & Federation
Prefer short-lived federated sessions and workload roles. Evaluate identity policy, resource policy, boundaries, SCPs, and explicit denies together.
| Mechanism | Use | Credential Model |
|---|---|---|
| IAM Identity Center | Human workforce access | Federated short-lived sessions |
| IAM role | AWS workload/service access | Temporary STS credentials |
| Resource policy | Cross-account/service delegation | Attached to resource |
| IAM user | Exceptional legacy/service case | Long-lived unless federated; minimize |
Least privilege requires both narrow allows and organization guardrails. Never embed long-lived access keys in code, images, or repositories.
Networking & Compute
VPC, Subnets, Routing & Endpoints
Routes decide reachability; security groups are stateful resource firewalls; NACLs are stateless subnet filters. Private subnets still need explicit egress/service paths.
EC2, ECS, EKS & Lambda
Select compute by control needs, workload shape, team maturity, startup/latency, portability, and operational burden.
| Service | Best Fit | You Operate |
|---|---|---|
| Lambda | Event-driven, bursty, short-lived functions | Code, limits, dependencies |
| ECS/Fargate | Container services without node management | Task/service definitions and app |
| EKS | Kubernetes ecosystem and platform needs | Clusters, add-ons, workloads |
| EC2 | OS/kernel/control or specialized hosts | Instances, patching, scaling |
Storage, Databases & Messaging
S3, EBS & EFS
S3 is regional object storage; EBS is block storage attached within an AZ; EFS is managed shared POSIX file storage.
Design around whole-object operations, keys, versioning, lifecycle, checksums, multipart upload, and request semantics.
RDS/Aurora, DynamoDB, ElastiCache, SQS & SNS
Choose relational databases for constraints/joins, DynamoDB for known key access at scale, ElastiCache for disposable acceleration, SQS for durable queues, and SNS/EventBridge for fan-out/routing.
At-least-once delivery means duplicates are normal. Define visibility timeouts, retries, poison-message handling, and DLQ redrive.
Reliability, Security, Cost & Delivery
CloudWatch, CloudTrail, Backups & Resilience
Centralize metrics/logs/traces, retain audit trails, encrypt data, test restore, design multi-AZ first, and choose multi-region only from explicit recovery objectives.
Infrastructure as Code, Cost & Production Checklist
Use reviewed IaC and progressive delivery; tag ownership; budget and anomaly-alert costs; remove idle resources; model quotas and regional dependencies.
Separate accounts, federate access, enforce least privilege, use multi-AZ, encrypt, centralize logs, test backups, set budgets/quotas, scan IaC, pin artifacts by digest, and rehearse incidents.