AWS Refresher

Setup & Environment

Before working with AWS, you need the CLI configured and ideally a local sandbox. LocalStack lets you iterate fast without incurring costs.

Install & Configure AWS CLI

# Install via Homebrew (macOS)
brew install awscli

# Verify installation
aws --version
# aws-cli/2.x.x Python/3.x.x ...

# Interactive configuration wizard
aws configure
# AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
# Default region name [None]: us-east-1
# Default output format [None]: json

# View stored config
cat ~/.aws/config
cat ~/.aws/credentials

# Use named profiles for multiple accounts
aws configure --profile staging
aws s3 ls --profile staging

# Set environment variables (useful in CI/CD)
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/...
export AWS_DEFAULT_REGION=us-east-1

LocalStack for Local Development

# Run LocalStack via Docker
docker run -d \
  --name localstack \
  -p 4566:4566 \
  -e SERVICES=s3,sqs,sns,lambda,dynamodb,iam \
  localstack/localstack

# Verify it's running
docker ps | grep localstack
curl http://localhost:4566/_localstack/health

# Point AWS CLI at LocalStack with --endpoint-url
aws --endpoint-url=http://localhost:4566 s3 ls
aws --endpoint-url=http://localhost:4566 s3 mb s3://my-test-bucket
aws --endpoint-url=http://localhost:4566 s3 ls

# Create an alias so you don't repeat the flag
alias awslocal='aws --endpoint-url=http://localhost:4566'
awslocal sqs create-queue --queue-name my-queue
awslocal dynamodb list-tables

# docker-compose.yml for persistent LocalStack setup
version: '3.8'
services:
  localstack:
    image: localstack/localstack:latest
    ports:
      - "4566:4566"
    environment:
      - SERVICES=s3,sqs,sns,lambda,dynamodb,secretsmanager
      - DEBUG=1
      - DATA_DIR=/tmp/localstack/data
    volumes:
      - "./localstack-data:/tmp/localstack/data"
      - "/var/run/docker.sock:/var/run/docker.sock"

Core Concepts

AWS organizes its infrastructure around geographic and logical boundaries. Understanding these concepts is prerequisite knowledge for every other service.

Regions, Availability Zones, and Edge Locations

Global vs. Regional Services

ARNs — Amazon Resource Names

Every AWS resource has a unique ARN. Understanding the format matters when writing IAM policies and CloudFormation templates.

# ARN format
arn:partition:service:region:account-id:resource-type/resource-id

# Examples
arn:aws:s3:::my-bucket                          # S3 bucket (global, no region/account)
arn:aws:s3:::my-bucket/path/to/object           # S3 object
arn:aws:iam::123456789012:user/alice             # IAM user (global, no region)
arn:aws:iam::123456789012:role/MyRole            # IAM role
arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0
arn:aws:lambda:us-east-1:123456789012:function:my-function
arn:aws:sqs:us-east-1:123456789012:my-queue
arn:aws:dynamodb:us-east-1:123456789012:table/Users

Shared Responsibility Model

AWS and the customer share security responsibilities. Knowing the boundary prevents misconfigurations.

IAM — Identity and Access Management

IAM is the access control system for all of AWS. It is global (not region-scoped). Mistakes here are the most common source of both security breaches and confusing permission errors.

Principals: Users, Groups, and Roles

Policy Structure

Policies are JSON documents. Every policy statement contains: Effect, Action, Resource, and optionally Condition.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnMyBucket",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-app-bucket",
        "arn:aws:s3:::my-app-bucket/*"
      ]
    },
    {
      "Sid": "DenyDeleteFromProd",
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::prod-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    }
  ]
}

Assume Role

Roles are assumed via STS (Security Token Service), which returns temporary credentials valid for 15 minutes to 12 hours.

# Assume a role from the CLI
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/DeployRole \
  --role-session-name deploy-session

# Returns: AccessKeyId, SecretAccessKey, SessionToken
# Export them to use in subsequent commands
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...

# Verify which identity you're using
aws sts get-caller-identity

// Trust policy — allows EC2 to assume this role
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

// Cross-account trust — allows account 987654321098 to assume this role
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::987654321098:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

Instance Profiles

An instance profile is a container for an IAM role that gets attached to an EC2 instance. The instance automatically retrieves temporary credentials from the instance metadata endpoint.

# From inside an EC2 instance, credentials are available at:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
# Returns the role name, then:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRoleName

# SDKs and CLI automatically use instance profile credentials — no config needed
# This is why you should NEVER put access keys on EC2 instances

Compute: EC2

EC2 (Elastic Compute Cloud) provides resizable virtual machines. It is the foundation of most AWS compute architectures, even when you are using higher-level services that run on top of it.

Instance Type Families

Pricing Models

Launching an Instance (CLI)

# Find the latest Amazon Linux 2023 AMI
aws ec2 describe-images \
  --owners amazon \
  --filters "Name=name,Values=al2023-ami-*" "Name=architecture,Values=x86_64" \
  --query 'sort_by(Images, &CreationDate)[-1].ImageId' \
  --output text

# Launch an instance
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.micro \
  --key-name my-key-pair \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-12345678 \
  --iam-instance-profile Name=MyInstanceProfile \
  --user-data file://bootstrap.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-server}]'

# Check instance status
aws ec2 describe-instances \
  --filters "Name=tag:Name,Values=web-server" \
  --query 'Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress]' \
  --output table

# SSH into instance
aws ec2-instance-connect send-ssh-public-key \
  --instance-id i-1234567890abcdef0 \
  --instance-os-user ec2-user \
  --ssh-public-key file://~/.ssh/id_rsa.pub

User Data Script

User data runs once at first boot as root. Use it to install software, configure the instance, and start services.

#!/bin/bash
# bootstrap.sh — runs at first launch as root
set -e
yum update -y

# Install Docker
yum install -y docker
systemctl enable docker
systemctl start docker
usermod -aG docker ec2-user

# Install application
yum install -y git
git clone https://github.com/myorg/myapp /opt/myapp
cd /opt/myapp

# Start with systemd
cat > /etc/systemd/system/myapp.service <<EOF
[Unit]
Description=My Application
After=network.target

[Service]
WorkingDirectory=/opt/myapp
ExecStart=/usr/bin/python3 app.py
Restart=always
User=ec2-user

[Install]
WantedBy=multi-user.target
EOF

systemctl enable myapp
systemctl start myapp

Compute: Lambda

Lambda is AWS's serverless compute service. You upload code, define a handler function, and AWS manages everything else: servers, OS, scaling, high availability. You pay only for compute time consumed — down to 1ms granularity.

The Serverless Model

Python Handler Example

import json
import logging
import boto3
from botocore.exceptions import ClientError

logger = logging.getLogger()
logger.setLevel(logging.INFO)

# Initialize outside handler — reused across warm invocations
dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('Users')


def lambda_handler(event, context):
    """
    Processes an API Gateway proxy event.

    Args:
        event: API Gateway event dict with httpMethod, path, body, headers, etc.
        context: Lambda context with function_name, aws_request_id, etc.

    Returns:
        API Gateway response dict with statusCode, headers, body.
    """
    logger.info("Request ID: %s", context.aws_request_id)
    logger.info("Event: %s", json.dumps(event))

    http_method = event.get('httpMethod', 'GET')
    path_params = event.get('pathParameters') or {}
    user_id = path_params.get('userId')

    if not user_id:
        return _response(400, {'error': 'userId path parameter is required'})

    try:
        if http_method == 'GET':
            result = table.get_item(Key={'userId': user_id})
            user = result.get('Item')
            if not user:
                return _response(404, {'error': 'User not found'})
            return _response(200, user)

        elif http_method == 'DELETE':
            table.delete_item(Key={'userId': user_id})
            return _response(204, {})

        else:
            return _response(405, {'error': f'Method {http_method} not allowed'})

    except ClientError as e:
        error_code = e.response['Error']['Code']
        logger.error("DynamoDB error: %s", error_code)
        return _response(500, {'error': 'Internal server error'})


def _response(status_code: int, body: dict) -> dict:
    return {
        'statusCode': status_code,
        'headers': {
            'Content-Type': 'application/json',
            'Access-Control-Allow-Origin': '*',
        },
        'body': json.dumps(body),
    }

Common Triggers

Key Configuration

# Deploy a function
aws lambda create-function \
  --function-name my-api \
  --runtime python3.12 \
  --handler handler.lambda_handler \
  --role arn:aws:iam::123456789012:role/LambdaExecRole \
  --zip-file fileb://function.zip \
  --timeout 30 \
  --memory-size 512 \
  --environment Variables='{TABLE_NAME=Users,LOG_LEVEL=INFO}'

# Update code
aws lambda update-function-code \
  --function-name my-api \
  --zip-file fileb://function.zip

# Set concurrency limit (protect downstream services)
aws lambda put-function-concurrency \
  --function-name my-api \
  --reserved-concurrent-executions 100

# Enable provisioned concurrency (eliminate cold starts)
aws lambda put-provisioned-concurrency-config \
  --function-name my-api \
  --qualifier LIVE \
  --provisioned-concurrent-executions 10

# Invoke synchronously
aws lambda invoke \
  --function-name my-api \
  --payload '{"httpMethod":"GET","pathParameters":{"userId":"abc123"}}' \
  --cli-binary-format raw-in-base64-out \
  response.json
cat response.json

Storage: S3

S3 (Simple Storage Service) is object storage with 11 nines (99.999999999%) of durability. Objects are stored in buckets, are addressed by key, and can range from 0 bytes to 5 TB.

Storage Classes

Common S3 CLI Commands

# Create a bucket (bucket names are globally unique)
aws s3 mb s3://my-unique-bucket-name --region us-east-1

# Upload a file
aws s3 cp ./local-file.txt s3://my-bucket/remote-path/file.txt

# Upload with specific storage class
aws s3 cp ./archive.zip s3://my-bucket/archives/ \
  --storage-class GLACIER

# Sync a directory (only uploads changed/new files)
aws s3 sync ./build/ s3://my-bucket/static/ \
  --delete \
  --cache-control "max-age=86400"

# Download
aws s3 cp s3://my-bucket/file.txt ./downloaded.txt
aws s3 sync s3://my-bucket/data/ ./local-data/

# List objects
aws s3 ls s3://my-bucket/
aws s3 ls s3://my-bucket/ --recursive --human-readable --summarize

# Delete
aws s3 rm s3://my-bucket/old-file.txt
aws s3 rm s3://my-bucket/old-prefix/ --recursive

# Generate a presigned URL (valid for 1 hour)
aws s3 presign s3://my-bucket/private-file.pdf --expires-in 3600

Bucket Policies vs ACLs

// Bucket policy: allow public read of all objects (for static site hosting)
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PublicReadGetObject",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-static-site/*"
    }
  ]
}

// Bucket policy: enforce HTTPS only
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNonHTTPS",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Lifecycle Policies & Versioning

// Lifecycle policy: transition to cheaper storage, then expire
{
  "Rules": [
    {
      "ID": "archive-and-expire",
      "Status": "Enabled",
      "Filter": { "Prefix": "logs/" },
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "STANDARD_IA"
        },
        {
          "Days": 90,
          "StorageClass": "GLACIER"
        }
      ],
      "Expiration": {
        "Days": 365
      },
      "NoncurrentVersionExpiration": {
        "NoncurrentDays": 30
      }
    }
  ]
}

# Enable versioning
aws s3api put-bucket-versioning \
  --bucket my-bucket \
  --versioning-configuration Status=Enabled

# List all versions of an object
aws s3api list-object-versions --bucket my-bucket --prefix my-file.txt

# Restore a specific version
aws s3api get-object \
  --bucket my-bucket \
  --key my-file.txt \
  --version-id abc123def456 \
  restored.txt

Databases

AWS offers multiple managed database services. Choosing the right one is a critical architectural decision driven by data model, access patterns, and consistency requirements.

RDS — Relational Database Service

RDS manages common relational databases: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora. AWS handles backups, patching, replication, and failover.

# Create a PostgreSQL RDS instance
aws rds create-db-instance \
  --db-instance-identifier prod-postgres \
  --db-instance-class db.t3.medium \
  --engine postgres \
  --engine-version 16.1 \
  --master-username admin \
  --master-user-password supersecret \
  --db-name myapp \
  --allocated-storage 100 \
  --storage-type gp3 \
  --multi-az \
  --backup-retention-period 7 \
  --no-publicly-accessible \
  --vpc-security-group-ids sg-12345678

# Create a read replica
aws rds create-db-instance-read-replica \
  --db-instance-identifier prod-postgres-read \
  --source-db-instance-identifier prod-postgres

DynamoDB — Key-Value / Document Store

DynamoDB is a fully managed NoSQL database with single-digit millisecond performance at any scale. The data model centers on a partition key and optional sort key.

# Create a table with composite key
aws dynamodb create-table \
  --table-name Orders \
  --attribute-definitions \
    AttributeName=userId,AttributeType=S \
    AttributeName=orderId,AttributeType=S \
    AttributeName=createdAt,AttributeType=S \
  --key-schema \
    AttributeName=userId,KeyType=HASH \
    AttributeName=orderId,KeyType=RANGE \
  --billing-mode PAY_PER_REQUEST \
  --global-secondary-indexes '[
    {
      "IndexName": "CreatedAtIndex",
      "KeySchema": [
        {"AttributeName": "userId", "KeyType": "HASH"},
        {"AttributeName": "createdAt", "KeyType": "RANGE"}
      ],
      "Projection": {"ProjectionType": "ALL"}
    }
  ]'

# Put an item
aws dynamodb put-item \
  --table-name Orders \
  --item '{
    "userId": {"S": "user#abc"},
    "orderId": {"S": "order#001"},
    "createdAt": {"S": "2026-02-23T10:00:00Z"},
    "status": {"S": "pending"},
    "total": {"N": "49.99"}
  }'

# Query items by partition key + sort key condition
aws dynamodb query \
  --table-name Orders \
  --key-condition-expression "userId = :uid AND begins_with(orderId, :prefix)" \
  --expression-attribute-values '{
    ":uid": {"S": "user#abc"},
    ":prefix": {"S": "order#"}
  }'

ElastiCache

Managed in-memory caching. Two engines: Redis (data structures, persistence, pub/sub, clustering) and Memcached (simple key-value, multi-threaded, no persistence).

# Create a Redis cluster
aws elasticache create-replication-group \
  --replication-group-id my-redis \
  --replication-group-description "App cache" \
  --engine redis \
  --engine-version 7.0 \
  --cache-node-type cache.t3.micro \
  --num-cache-clusters 2 \
  --automatic-failover-enabled \
  --at-rest-encryption-enabled \
  --transit-encryption-enabled

Networking: VPC

A VPC (Virtual Private Cloud) is your isolated network within AWS. Every EC2 instance, RDS database, and Lambda (when VPC-attached) lives inside a VPC. Understanding VPC design is critical for security and connectivity.

Core VPC Components

Three-Tier VPC Design

# Typical 3-tier VPC: public / private app / private data
# CIDR: 10.0.0.0/16
#
# Public subnets (load balancers, NAT GW, bastion host)
#   10.0.1.0/24  us-east-1a
#   10.0.2.0/24  us-east-1b
#
# Private app subnets (EC2, ECS, Lambda)
#   10.0.10.0/24  us-east-1a
#   10.0.11.0/24  us-east-1b
#
# Private data subnets (RDS, ElastiCache — no outbound internet needed)
#   10.0.20.0/24  us-east-1a
#   10.0.21.0/24  us-east-1b

# Create VPC
aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications \
  'ResourceType=vpc,Tags=[{Key=Name,Value=my-vpc}]'

# Create public subnet
aws ec2 create-subnet \
  --vpc-id vpc-12345678 \
  --cidr-block 10.0.1.0/24 \
  --availability-zone us-east-1a

# Enable auto-assign public IP for public subnet
aws ec2 modify-subnet-attribute \
  --subnet-id subnet-12345678 \
  --map-public-ip-on-launch

# Create and attach Internet Gateway
aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway \
  --vpc-id vpc-12345678 \
  --internet-gateway-id igw-12345678

# Add route to IGW in public route table
aws ec2 create-route \
  --route-table-id rtb-12345678 \
  --destination-cidr-block 0.0.0.0/0 \
  --gateway-id igw-12345678

Security Groups vs NACLs

Messaging & Queues

Asynchronous messaging decouples producers from consumers, enabling fault tolerance, load leveling, and fan-out patterns.

SQS — Simple Queue Service

# Create a queue with dead-letter queue
aws sqs create-queue --queue-name my-dlq
aws sqs get-queue-attributes --queue-url ... --attribute-names QueueArn

aws sqs create-queue \
  --queue-name my-queue \
  --attributes '{
    "VisibilityTimeout": "30",
    "MessageRetentionPeriod": "86400",
    "RedrivePolicy": "{\"deadLetterTargetArn\":\"arn:aws:sqs:us-east-1:123456789012:my-dlq\",\"maxReceiveCount\":\"3\"}"
  }'

# Send a message
aws sqs send-message \
  --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue \
  --message-body '{"orderId": "abc123", "action": "process"}'

# Receive and process messages
aws sqs receive-message \
  --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue \
  --max-number-of-messages 10 \
  --wait-time-seconds 20  # Long polling — reduce empty receives

# Delete after processing
aws sqs delete-message \
  --queue-url ... \
  --receipt-handle "AQEBwJ..."

SNS — Simple Notification Service

SNS is a pub/sub service. Publishers send to a topic; subscribers (SQS, Lambda, HTTP, email, SMS) receive a copy. This enables fan-out: one event triggers many parallel consumers.

# Create a topic
aws sns create-topic --name order-events

# Subscribe an SQS queue to the topic
aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:order-events \
  --protocol sqs \
  --notification-endpoint arn:aws:sqs:us-east-1:123456789012:order-processing

# Subscribe a Lambda function
aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:order-events \
  --protocol lambda \
  --notification-endpoint arn:aws:lambda:us-east-1:123456789012:function:send-email

# Publish a message
aws sns publish \
  --topic-arn arn:aws:sns:us-east-1:123456789012:order-events \
  --message '{"orderId": "abc123", "status": "placed"}' \
  --subject "Order Placed"

EventBridge

EventBridge is a serverless event bus. More powerful than SNS for routing: supports content-based routing via rules, schema registry, event replays, and cross-account event buses.

# Create a rule to trigger Lambda when an EC2 instance stops
aws events put-rule \
  --name ec2-stopped \
  --event-pattern '{
    "source": ["aws.ec2"],
    "detail-type": ["EC2 Instance State-change Notification"],
    "detail": {"state": ["stopped"]}
  }' \
  --state ENABLED

# Add Lambda as target
aws events put-targets \
  --rule ec2-stopped \
  --targets 'Id=1,Arn=arn:aws:lambda:us-east-1:123456789012:function:notify-ops'

Containers on AWS

AWS offers multiple layers for running containers: ECR for image storage, ECS for container orchestration (AWS-native), and EKS for Kubernetes.

ECR — Elastic Container Registry

# Authenticate Docker to your ECR registry
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin \
  123456789012.dkr.ecr.us-east-1.amazonaws.com

# Create a repository
aws ecr create-repository --repository-name my-app

# Build, tag, and push
docker build -t my-app .
docker tag my-app:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest

# Enable image scanning on push (checks for CVEs)
aws ecr put-image-scanning-configuration \
  --repository-name my-app \
  --image-scanning-configuration scanOnPush=true

ECS — Elastic Container Service

ECS has two key concepts: Task Definitions (what to run — image, CPU, memory, environment, ports) and Services (how many copies, load balancer integration, auto-scaling).

// ECS Task Definition (simplified)
{
  "family": "my-app",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "executionRoleArn": "arn:aws:iam::123456789012:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123456789012:role/myAppTaskRole",
  "containerDefinitions": [
    {
      "name": "my-app",
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest",
      "portMappings": [
        { "containerPort": 8080, "protocol": "tcp" }
      ],
      "environment": [
        { "name": "ENV", "value": "production" }
      ],
      "secrets": [
        { "name": "DB_PASSWORD", "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:db-password" }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/my-app",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        }
      },
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3
      }
    }
  ]
}

# Register task definition
aws ecs register-task-definition --cli-input-json file://task-def.json

# Create a service (runs 2 tasks behind a load balancer)
aws ecs create-service \
  --cluster my-cluster \
  --service-name my-app-svc \
  --task-definition my-app:1 \
  --desired-count 2 \
  --launch-type FARGATE \
  --network-configuration 'awsvpcConfiguration={
    subnets=[subnet-aaa,subnet-bbb],
    securityGroups=[sg-12345678],
    assignPublicIp=DISABLED
  }' \
  --load-balancers 'targetGroupArn=arn:aws:elasticloadbalancing:...,containerName=my-app,containerPort=8080'

# Force new deployment (rolling update)
aws ecs update-service \
  --cluster my-cluster \
  --service my-app-svc \
  --force-new-deployment

EKS — Elastic Kubernetes Service

EKS is managed Kubernetes. AWS runs the control plane (API server, etcd, scheduler). You manage worker nodes (or use Fargate for pods).

# Create a cluster (takes ~10 min)
eksctl create cluster \
  --name my-cluster \
  --region us-east-1 \
  --nodegroup-name workers \
  --node-type m5.large \
  --nodes 3 \
  --nodes-min 1 \
  --nodes-max 5 \
  --managed

# Update kubeconfig
aws eks update-kubeconfig --region us-east-1 --name my-cluster

# Verify
kubectl get nodes
kubectl get pods --all-namespaces

Monitoring & Logging

Observability on AWS centers on three tools: CloudWatch for metrics and logs, CloudTrail for API audit trails, and X-Ray for distributed tracing.

CloudWatch

# Create an alarm: alert when Lambda error rate > 1%
aws cloudwatch put-metric-alarm \
  --alarm-name lambda-errors-high \
  --metric-name Errors \
  --namespace AWS/Lambda \
  --dimensions Name=FunctionName,Value=my-api \
  --statistic Sum \
  --period 300 \
  --evaluation-periods 2 \
  --threshold 5 \
  --comparison-operator GreaterThanThreshold \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:ops-alerts \
  --treat-missing-data notBreaching

# Publish a custom metric
aws cloudwatch put-metric-data \
  --namespace MyApp \
  --metric-name OrdersProcessed \
  --value 42 \
  --unit Count

# Query logs with Log Insights
aws logs start-query \
  --log-group-name /aws/lambda/my-api \
  --start-time $(date -v-1H +%s) \
  --end-time $(date +%s) \
  --query-string 'fields @timestamp, @message
    | filter @message like /ERROR/
    | sort @timestamp desc
    | limit 20'

CloudTrail

CloudTrail records every AWS API call (who, what, when, from where) across your account. It is the primary tool for security investigations and compliance auditing.

# Create a trail that writes to S3 (best practice: multi-region trail)
aws cloudtrail create-trail \
  --name my-audit-trail \
  --s3-bucket-name my-audit-logs-bucket \
  --include-global-service-events \
  --is-multi-region-trail \
  --enable-log-file-validation

aws cloudtrail start-logging --name my-audit-trail

# Look up recent events for a specific user
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=alice \
  --max-results 10

# Find who deleted an S3 object
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteObject

X-Ray — Distributed Tracing

X-Ray traces requests as they flow through your application, across Lambda, EC2, ECS, API Gateway, and more. It produces service maps and identifies latency bottlenecks.

import boto3
from aws_xray_sdk.core import xray_recorder, patch_all

# Instrument all boto3 clients automatically
patch_all()

@xray_recorder.capture('process_order')
def process_order(order_id: str) -> dict:
    # This creates a subsegment in the trace
    with xray_recorder.in_subsegment('validate') as subsegment:
        subsegment.put_annotation('orderId', order_id)
        result = validate_order(order_id)

    with xray_recorder.in_subsegment('persist'):
        save_to_dynamodb(result)

    return result

Infrastructure as Code

IaC treats infrastructure definitions as source code: version-controlled, repeatable, reviewable. On AWS, the native tool is CloudFormation; Terraform is the most popular third-party alternative.

CloudFormation

CloudFormation templates describe a stack — a collection of AWS resources. CloudFormation provisions, updates, and deletes them as a unit.

# cloudformation/api-stack.yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Serverless API stack with Lambda, API Gateway, and DynamoDB

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
    Description: Deployment environment
  LambdaMemory:
    Type: Number
    Default: 512
    MinValue: 128
    MaxValue: 10240

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  # DynamoDB Table
  UsersTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Retain
    Properties:
      TableName: !Sub '${Environment}-Users'
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: userId
          AttributeType: S
      KeySchema:
        - AttributeName: userId
          KeyType: HASH
      PointInTimeRecoverySpecification:
        PointInTimeRecoveryEnabled: !If [IsProd, true, false]
      Tags:
        - Key: Environment
          Value: !Ref Environment

  # IAM Execution Role
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: DynamoDBAccess
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                  - dynamodb:DeleteItem
                  - dynamodb:Query
                Resource: !GetAtt UsersTable.Arn

  # Lambda Function
  ApiFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-users-api'
      Runtime: python3.12
      Handler: handler.lambda_handler
      Role: !GetAtt LambdaExecutionRole.Arn
      MemorySize: !Ref LambdaMemory
      Timeout: 30
      Environment:
        Variables:
          TABLE_NAME: !Ref UsersTable
          ENVIRONMENT: !Ref Environment
      Code:
        ZipFile: |
          def lambda_handler(event, context):
              return {'statusCode': 200, 'body': 'ok'}

  # API Gateway
  ApiGateway:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub '${Environment}-users-api'
      EndpointConfiguration:
        Types: [REGIONAL]

Outputs:
  ApiEndpoint:
    Description: API Gateway endpoint URL
    Value: !Sub 'https://${ApiGateway}.execute-api.${AWS::Region}.amazonaws.com/prod'
    Export:
      Name: !Sub '${AWS::StackName}-ApiEndpoint'

  UsersTableArn:
    Description: DynamoDB table ARN
    Value: !GetAtt UsersTable.Arn
    Export:
      Name: !Sub '${AWS::StackName}-UsersTableArn'

# Validate template syntax
aws cloudformation validate-template --template-body file://api-stack.yaml

# Create/update stack (create-or-update)
aws cloudformation deploy \
  --template-file api-stack.yaml \
  --stack-name my-api-dev \
  --parameter-overrides Environment=dev LambdaMemory=256 \
  --capabilities CAPABILITY_IAM \
  --no-fail-on-empty-changeset

# Preview changes before applying (changeset)
aws cloudformation create-change-set \
  --stack-name my-api-dev \
  --change-set-name preview \
  --template-body file://api-stack.yaml \
  --capabilities CAPABILITY_IAM

aws cloudformation describe-change-set \
  --stack-name my-api-dev \
  --change-set-name preview

# Describe stack events (debug failed deployments)
aws cloudformation describe-stack-events \
  --stack-name my-api-dev \
  --query 'StackEvents[?ResourceStatus==`CREATE_FAILED`]'

# Delete stack
aws cloudformation delete-stack --stack-name my-api-dev

SAM — Serverless Application Model

SAM extends CloudFormation with shorthand for Lambda, API Gateway, and DynamoDB — saving 80% of the boilerplate for serverless apps.

# template.yaml (SAM)
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Globals:
  Function:
    Runtime: python3.12
    Timeout: 30
    Environment:
      Variables:
        TABLE_NAME: !Ref UsersTable

Resources:
  UsersFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: handler.lambda_handler
      CodeUri: src/
      MemorySize: 512
      Policies:
        - DynamoDBCrudPolicy:
            TableName: !Ref UsersTable
      Events:
        GetUser:
          Type: Api
          Properties:
            Path: /users/{userId}
            Method: GET
        CreateUser:
          Type: Api
          Properties:
            Path: /users
            Method: POST

  UsersTable:
    Type: AWS::Serverless::SimpleTable
    Properties:
      PrimaryKey:
        Name: userId
        Type: String

# Install SAM CLI
brew tap aws/tap
brew install aws-sam-cli

# Build and run locally
sam build
sam local start-api          # Starts local API Gateway
sam local invoke UsersFunction --event event.json

# Deploy
sam deploy --guided         # First time: creates samconfig.toml
sam deploy                  # Subsequent deploys

Common Architecture Patterns

These are the building blocks that appear repeatedly in production AWS architectures.

Three-Tier Web Application

# Layer 1: Public-facing (Load Balancer in public subnet)
#   ALB → health checks, SSL termination, routing rules
#
# Layer 2: Application (ECS/EC2 in private app subnet)
#   Auto Scaling Group or ECS Service
#   No public IPs — only ALB can reach them via security group rule
#
# Layer 3: Data (RDS + ElastiCache in private data subnet)
#   Only application layer security group can connect
#
# Traffic flow:
#   Internet → Route 53 → CloudFront (optional CDN) → ALB
#             → ECS tasks → RDS (reads from replica, writes to primary)
#                         → ElastiCache (cache layer)
#
# Outbound from private subnets:
#   App/Data subnet → NAT Gateway (public subnet) → Internet Gateway → Internet

# Key security group rules:
# ALB SG: inbound 443 from 0.0.0.0/0
# App SG: inbound 8080 from ALB SG only
# DB SG:  inbound 5432 from App SG only

Serverless API Pattern

# API Gateway + Lambda + DynamoDB
#
# Request flow:
#   Client → API Gateway → Lambda → DynamoDB
#
# API Gateway handles:
#   - TLS termination
#   - Request throttling (e.g., 10,000 RPS)
#   - API key management
#   - Request/response transformation
#   - Caching (optional)
#
# Lambda handles:
#   - Business logic
#   - Input validation
#   - Auth (via Lambda authorizer or Cognito)
#
# DynamoDB handles:
#   - Data persistence
#   - Single-digit ms read/write at any scale
#
# Cost characteristics:
#   - Zero cost at zero traffic (pay per invocation)
#   - Auto-scales to millions of RPS without config
#   - No servers to manage or patch

Event-Driven Fan-Out (SNS + SQS)

# Pattern: one event triggers multiple independent consumers
#
# SNS Topic: order-events
#   ├── SQS Queue: order-fulfillment   → Lambda: reserve inventory
#   ├── SQS Queue: order-email         → Lambda: send confirmation email
#   └── SQS Queue: order-analytics     → Lambda: update business metrics
#
# Why SNS → SQS (not SNS → Lambda directly)?
#   - SQS acts as a buffer: Lambda invocations are throttled by SQS batch size
#   - Dead-letter queues on SQS catch failures without losing events
#   - Each consumer scales independently
#   - Consumer can be paused (stop polling) without losing messages
#
# CloudFormation snippet for the fan-out:

# Producer publishes ONE message to SNS
aws sns publish \
  --topic-arn arn:aws:sns:us-east-1:123456789012:order-events \
  --message '{"orderId":"abc123","userId":"user456","total":99.99}'

# All three SQS queues receive a copy simultaneously
# Each Lambda processes independently, at its own pace

Static Site (S3 + CloudFront)

# Architecture:
#   GitHub Actions → Build (npm run build) → S3 upload → CloudFront invalidation
#
# S3: hosts built static files (HTML/CSS/JS)
# CloudFront: CDN — caches at edge locations globally, serves HTTPS

# 1. Create S3 bucket for static hosting
aws s3 mb s3://my-static-site --region us-east-1
aws s3 website s3://my-static-site \
  --index-document index.html \
  --error-document 404.html

# 2. Create CloudFront distribution pointing to S3 origin
# (typically done via console or CloudFormation — CLI is verbose)

# 3. Deploy: sync build output, then invalidate CDN cache
aws s3 sync ./dist/ s3://my-static-site/ \
  --delete \
  --cache-control "public, max-age=31536000, immutable"

# Invalidate CloudFront cache (HTML files should not be cached long)
aws cloudfront create-invalidation \
  --distribution-id ABCDEFGHIJKLMN \
  --paths "/*"

# 4. Custom domain: Route 53 alias record → CloudFront distribution
aws route53 change-resource-record-sets \
  --hosted-zone-id ZONE123 \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "www.example.com",
        "Type": "A",
        "AliasTarget": {
          "HostedZoneId": "Z2FDTNDATAQYW2",
          "DNSName": "d111111abcdef8.cloudfront.net",
          "EvaluateTargetHealth": false
        }
      }
    }]
  }'

# Lambda canary via alias weighted routing
aws lambda update-alias \
  --function-name my-api \
  --name LIVE \
  --function-version 5 \
  --routing-config AdditionalVersionWeights={"4"=0.1}
# 10% to version 4 (old), 90% to version 5 (new)

# After validating:
aws lambda update-alias \
  --function-name my-api \
  --name LIVE \
  --function-version 5
# 100% to version 5