Learn Amazon Web Services

AWS is split into isolated Regions, each made of several Availability Zones, plus edge locations for content delivery.

An AWS account is the billing and security boundary; lock away its all-powerful root user and know what AWS secures versus what you secure.

Install AWS CLI v2, sign in with IAM Identity Center profiles, and shape output with --query and --output.

Use boto3 clients, the credential chain, paginators, waiters and ClientError handling to automate AWS from Python.

IAM decides who can call which AWS API: principals authenticate, and policies attached to them authorize each request.

Read and write JSON policies: Effect, Action, Resource and Condition, identity versus resource policies, and how deny wins.

A role pairs a trust policy (who may assume it) with permission policies; STS hands out temporary credentials when it is assumed.

Encrypt data with KMS keys and envelope encryption, and keep credentials in Secrets Manager instead of code or config.

How AWS combines SCPs, RCPs, resource policies, identity policies, permission boundaries and session policies into one decision.

Key policies, grants, encryption context, Bucket Keys, multi-Region keys and request quotas: what breaks KMS at scale.

Launch virtual servers from AMIs, choose an instance type, configure them with user data and connect without opening SSH.

Spread traffic across healthy targets in several AZs with an Application Load Balancer (HTTP) or Network Load Balancer (TCP/UDP).

Run a self-healing, elastic fleet: launch templates, Auto Scaling groups across AZs, target tracking and instance refresh.

Run Docker images on AWS with ECR, ECS task definitions and services, using Fargate so there are no servers to manage.

Run Kubernetes with a managed control plane: node options, VPC CNI networking, access entries, Pod Identity and load balancer integration.

A VPC is your private network in a Region: carve its CIDR into per-AZ subnets and use route tables to make them public or private.

Security groups are stateful, allow-only firewalls on network interfaces; NACLs are stateless rules on subnets.

Give private subnets outbound internet with NAT gateways, reach S3 and DynamoDB privately with gateway endpoints, and keep egress costs sane.

Host DNS zones, point names at AWS resources with alias records, and steer traffic with weighted, latency and failover routing.

Serve content from edge locations with caching, HTTPS and private S3 origins via Origin Access Control.

Store any amount of data as objects in buckets, pick storage classes by access pattern, and automate tiering with lifecycle rules.

Attach EBS volumes to instances for disks, snapshot them for backups, and use EFS when many machines need a shared file system.

Run PostgreSQL, MySQL and other engines with managed backups, patching, Multi-AZ failover and read replicas.

Keep buckets private with Block Public Access and bucket policies, encrypt by default, and share objects safely with presigned URLs.

Model tables with partition and sort keys, read with GetItem and Query instead of Scan, and pick on-demand or provisioned capacity.

Understand Aurora's shared distributed storage, cluster endpoints, fast failover, Serverless v2 scaling and cloning.

Design from access patterns: single-table layouts, GSIs, hot-partition avoidance, conditional writes, transactions and Streams.

Run code without servers: write a handler, give it an execution role, and let events invoke it, paying only per request and duration.

Expose Lambda functions and other back ends as HTTPS APIs with routes, authorizers, throttling and custom domains.

Decouple services with SQS queues (visibility timeout, DLQs, FIFO) and fan out events with SNS topics and filter policies.

Route JSON events from AWS services, SaaS and your apps to targets with content-based rules, and schedule work with EventBridge Scheduler.

Control concurrency, tame cold starts, process SQS batches with partial failures, and make functions idempotent.

Understand the billing dimensions (compute time, storage, requests, data transfer), set budgets, and find what is costing money.

Collect metrics and logs, query logs with Logs Insights, and alarm on what matters.

Record who did what, when and from where with CloudTrail trails, data events and organization-wide logging.

Describe infrastructure in YAML templates and let CloudFormation create, update and roll back stacks, previewing changes with change sets.

Define stacks with constructs in Python or TypeScript, use L2 constructs and grant methods, and deploy via synthesized CloudFormation.

Cut spend with rightsizing, Savings Plans, Spot, Graviton, storage tiering and data-transfer-aware architecture, and catch anomalies early.

Design clients that survive AWS throttling and quotas: backoff with jitter, retry budgets, timeouts, idempotency tokens and eventual consistency.

Apply the six Well-Architected pillars and pick a disaster-recovery strategy from RPO and RTO targets.

Structure many accounts into OUs, apply guardrails with SCPs, centralise identity and logging, and vend accounts with Control Tower.

Connect many VPCs, accounts and on-premises networks through a regional hub with segmented routing.

Expose and consume services privately across VPCs and accounts with interface endpoints and NLB-backed endpoint services.

Replicate data across Regions, route users with Route 53 and recovery controls, and fail over (and back) without split brain.