1. AWS Services Landscape

Amazon Web Services (AWS) is the world's largest cloud platform, offering over 200 services spanning compute, storage, databases, networking, security, analytics, machine learning, and more. Understanding core services and how they compose together is the foundation for building reliable, scalable cloud architectures.

2. EC2: The Foundation of Elastic Compute

Amazon EC2 (Elastic Compute Cloud) provides on-demand, resizable compute capacity. From a single development server to thousands of HPC nodes, EC2 scales to meet any demand. Understanding instance types, pricing models, and auto-scaling is the key to controlling costs and guaranteeing performance.

Instance Type Selection

EC2 Pricing Models Compared

Auto Scaling Configuration Example

# EC2 Auto Scaling Group — CloudFormation snippet
AutoScalingGroup:
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    LaunchTemplate:
      LaunchTemplateId: !Ref MyLaunchTemplate
      Version: !GetAtt MyLaunchTemplate.LatestVersionNumber
    MinSize: 2
    MaxSize: 10
    DesiredCapacity: 2
    VPCZoneIdentifier:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    TargetGroupARNs:
      - !Ref MyTargetGroup
    HealthCheckType: ELB
    HealthCheckGracePeriod: 300

ScalingPolicy:
  Type: AWS::AutoScaling::ScalingPolicy
  Properties:
    AutoScalingGroupName: !Ref AutoScalingGroup
    PolicyType: TargetTrackingScaling
    TargetTrackingConfiguration:
      PredefinedMetricSpecification:
        PredefinedMetricType: ASGAverageCPUUtilization
      TargetValue: 60.0

3. S3: Infinitely Scalable Object Storage

Amazon S3 (Simple Storage Service) delivers industry-leading durability (99.999999999%), availability, and security. S3 buckets store any number of objects from bytes to 5TB, widely used for static website hosting, data lakes, backups, and media distribution.

S3 Storage Classes & Cost

S3 Lifecycle Policy Example

# AWS CLI — S3 lifecycle configuration
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-data-lake \
  --lifecycle-configuration '{
    "Rules": [
      {
        "ID": "ArchiveOldLogs",
        "Status": "Enabled",
        "Filter": { "Prefix": "logs/" },
        "Transitions": [
          { "Days": 30,  "StorageClass": "STANDARD_IA" },
          { "Days": 90,  "StorageClass": "GLACIER" },
          { "Days": 365, "StorageClass": "DEEP_ARCHIVE" }
        ],
        "Expiration": { "Days": 2555 }
      }
    ]
  }'

4. RDS vs DynamoDB: Relational vs NoSQL

Database selection is one of the most critical architecture decisions. AWS offers fully managed relational databases (RDS/Aurora) and NoSQL databases (DynamoDB), each with distinct strengths.

RDS / Aurora Overview

Amazon RDS supports MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. Aurora is AWS's custom MySQL/PostgreSQL-compatible engine delivering 5x MySQL and 3x PostgreSQL performance, with storage auto-scaling to 128TB.

# Create a Multi-AZ PostgreSQL RDS instance
aws rds create-db-instance \
  --db-instance-identifier myapp-db \
  --db-instance-class db.r6g.xlarge \
  --engine postgres \
  --engine-version 15.4 \
  --master-username admin \
  --master-user-password "\${SECURE_PASSWORD}" \
  --allocated-storage 100 \
  --storage-type gp3 \
  --multi-az \
  --vpc-security-group-ids sg-0abc1234 \
  --db-subnet-group-name myapp-db-subnets \
  --backup-retention-period 7 \
  --storage-encrypted

DynamoDB Key Concepts

DynamoDB is a fully serverless key-value and document database delivering single-digit millisecond responses. Core concepts include Partition Key, Sort Key, Global Secondary Indexes (GSI), and Local Secondary Indexes (LSI). Capacity modes are On-Demand and Provisioned.

# DynamoDB table with GSI — CloudFormation
OrdersTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: Orders
    BillingMode: PAY_PER_REQUEST    # On-Demand
    AttributeDefinitions:
      - AttributeName: PK
        AttributeType: S
      - AttributeName: SK
        AttributeType: S
      - AttributeName: GSI1PK
        AttributeType: S
    KeySchema:
      - AttributeName: PK
        KeyType: HASH
      - AttributeName: SK
        KeyType: RANGE
    GlobalSecondaryIndexes:
      - IndexName: GSI1
        KeySchema:
          - AttributeName: GSI1PK
            KeyType: HASH
          - AttributeName: SK
            KeyType: RANGE
        Projection:
          ProjectionType: ALL
    PointInTimeRecoverySpecification:
      PointInTimeRecoveryEnabled: true

RDS vs DynamoDB Decision Matrix

5. Lambda: Event-Driven Serverless Compute

AWS Lambda runs your code without provisioning or managing servers. Upload your code, and Lambda handles compute allocation, execution, and scaling. You pay only for actual compute time (billed per millisecond) with zero cost when idle.

Lambda Function Best Practices

# Python Lambda with best practices
import json
import boto3
import os
from aws_lambda_powertools import Logger, Tracer, Metrics
from aws_lambda_powertools.utilities.typing import LambdaContext

# Initialize outside handler (reused across invocations)
logger = Logger()
tracer = Tracer()
metrics = Metrics()
dynamodb = boto3.resource("dynamodb")
table = dynamodb.Table(os.environ["TABLE_NAME"])

@logger.inject_lambda_context
@tracer.capture_lambda_handler
@metrics.log_metrics(capture_cold_start_metric=True)
def handler(event, context: LambdaContext):
    """Process API Gateway request."""
    try:
        body = json.loads(event["body"])
        order_id = body["order_id"]

        # Single-table design query
        response = table.get_item(
            Key={"PK": f"ORDER#{order_id}", "SK": "METADATA"}
        )

        if "Item" not in response:
            return {"statusCode": 404, "body": "Not found"}

        metrics.add_metric(name="OrderLookup", unit="Count", value=1)
        return {
            "statusCode": 200,
            "headers": {"Content-Type": "application/json"},
            "body": json.dumps(response["Item"], default=str)
        }
    except Exception as e:
        logger.exception("Failed to process request")
        return {"statusCode": 500, "body": "Internal error"}

Lambda key limits: 15-minute max execution, 250MB deployment package (unzipped), 128MB-10GB memory, 1000 default concurrency (increase on request). Cold start latency depends on runtime and package size — use Provisioned Concurrency or SnapStart (Java) to eliminate cold starts.

6. ECS & EKS: Container Orchestration

When workloads outgrow Lambda limits (long-running, large memory, custom runtimes), containers are the next step. AWS offers two orchestrators: ECS (AWS-native) and EKS (managed Kubernetes). Both support Fargate serverless launch type.

ECS vs EKS Comparison

ECS Fargate Task Definition

# ECS Fargate Task Definition — CloudFormation
TaskDefinition:
  Type: AWS::ECS::TaskDefinition
  Properties:
    Family: myapp-api
    Cpu: "512"
    Memory: "1024"
    NetworkMode: awsvpc
    RequiresCompatibilities: [FARGATE]
    ExecutionRoleArn: !GetAtt ECSExecutionRole.Arn
    TaskRoleArn: !GetAtt ECSTaskRole.Arn
    ContainerDefinitions:
      - Name: api
        Image: !Sub "\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/myapp:latest"
        PortMappings:
          - ContainerPort: 8080
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group: /ecs/myapp-api
            awslogs-region: !Ref AWS::Region
            awslogs-stream-prefix: ecs
        Environment:
          - Name: NODE_ENV
            Value: production
        Secrets:
          - Name: DB_PASSWORD
            ValueFrom: !Ref DbPasswordSecret

7. CloudFront & Route 53: Global CDN & DNS

CloudFront is AWS's CDN with 400+ edge locations worldwide, caching content to reduce latency to single-digit milliseconds. Route 53 is a highly available DNS service combining domain registration, DNS routing, and health checking.

Route 53 Routing Policies

CloudFront Distribution Setup

# CloudFront with S3 origin — CloudFormation
CloudFrontDistribution:
  Type: AWS::CloudFront::Distribution
  Properties:
    DistributionConfig:
      Origins:
        - Id: S3Origin
          DomainName: !GetAtt MyBucket.RegionalDomainName
          S3OriginConfig:
            OriginAccessIdentity: ""
          OriginAccessControlId: !Ref OAC
      DefaultCacheBehavior:
        TargetOriginId: S3Origin
        ViewerProtocolPolicy: redirect-to-https
        CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized
        Compress: true
      ViewerCertificate:
        AcmCertificateArn: !Ref Certificate
        SslSupportMethod: sni-only
        MinimumProtocolVersion: TLSv1.2_2021
      Enabled: true
      HttpVersion: http2and3
      PriceClass: PriceClass_100

8. IAM: Identity & Access Management

IAM is the foundation of AWS security. It controls who (identity) can perform what actions on which resources. IAM policies are JSON documents defining Effect (Allow/Deny), Action, Resource, and optional Condition. Following the principle of least privilege is the top security priority.

IAM Best Practices Checklist

1) Enable MFA on root and lock it down — never use for daily tasks. 2) Create individual IAM users or roles for every person/service. 3) Use IAM roles (not access keys) for EC2/Lambda. 4) Attach policies to groups, not individual users. 5) Use AWS Organizations + SCPs for cross-account governance. 6) Audit with IAM Access Analyzer regularly. 7) Use aws-vault or SSO for local credential management.

# Least-privilege IAM policy example
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-app-data",
        "arn:aws:s3:::my-app-data/*"
      ]
    },
    {
      "Sid": "AllowDynamoDBCRUD",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": ["\${aws:PrincipalTag/tenant_id}"]
        }
      }
    }
  ]
}

9. VPC: Network Isolation & Architecture

A VPC (Virtual Private Cloud) is an isolated virtual network within AWS. A production-grade VPC typically spans multiple Availability Zones with public and private subnets, Internet Gateway, NAT Gateway, Security Groups, and Network ACLs. Proper VPC design is the foundation for security and availability.

Security Groups vs Network ACLs

Production VPC Architecture

# Three-tier VPC architecture — Terraform
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.5.0"

  name = "production-vpc"
  cidr = "10.0.0.0/16"

  azs              = ["us-east-1a", "us-east-1b", "us-east-1c"]
  public_subnets   = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets  = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
  database_subnets = ["10.0.21.0/24", "10.0.22.0/24", "10.0.23.0/24"]

  enable_nat_gateway     = true
  single_nat_gateway     = false  # One per AZ for HA
  one_nat_gateway_per_az = true

  enable_dns_hostnames = true
  enable_dns_support   = true

  # VPC Flow Logs
  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_iam_role             = true

  tags = {
    Environment = "production"
    Terraform   = "true"
  }
}

10. SQS & SNS: Async Messaging & Notifications

Loose coupling is a key principle in microservices. SQS (message queue) and SNS (publish/subscribe) are the two core AWS services for asynchronous communication. They are often used together: SNS fans out to multiple SQS queues for parallel processing.

SQS Standard vs FIFO Queues

SNS + SQS Fan-Out Pattern

# SNS topic fans out to multiple SQS queues
# — CloudFormation snippet
OrderTopic:
  Type: AWS::SNS::Topic
  Properties:
    TopicName: order-events

PaymentQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: payment-processing
    VisibilityTimeout: 300
    RedrivePolicy:
      deadLetterTargetArn: !GetAtt PaymentDLQ.Arn
      maxReceiveCount: 3

InventoryQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: inventory-update
    VisibilityTimeout: 300

NotificationQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: customer-notification

# Subscribe all queues to the topic
PaymentSub:
  Type: AWS::SNS::Subscription
  Properties:
    TopicArn: !Ref OrderTopic
    Protocol: sqs
    Endpoint: !GetAtt PaymentQueue.Arn
    FilterPolicy:
      event_type: [order_placed, order_updated]

11. CloudWatch: Full-Stack Observability

CloudWatch provides metrics, logs, alarms, and dashboards as AWS's unified observability platform. Combined with X-Ray for distributed tracing and CloudTrail for API audit trails, they form the complete observability trinity.

Custom Metrics & Alarms

# Python — publish custom CloudWatch metric
import boto3
from datetime import datetime

cloudwatch = boto3.client("cloudwatch")

def publish_order_metric(order_total: float, region: str):
    cloudwatch.put_metric_data(
        Namespace="MyApp/Orders",
        MetricData=[
            {
                "MetricName": "OrderValue",
                "Dimensions": [
                    {"Name": "Region", "Value": region},
                ],
                "Timestamp": datetime.utcnow(),
                "Value": order_total,
                "Unit": "None",
                "StorageResolution": 60   # standard (1-min)
            }
        ]
    )

CloudWatch Alarm Configuration

# CloudWatch Alarm — CloudFormation
HighCPUAlarm:
  Type: AWS::CloudWatch::Alarm
  Properties:
    AlarmName: high-cpu-api-cluster
    AlarmDescription: "CPU > 80% for 5 minutes"
    Namespace: AWS/ECS
    MetricName: CPUUtilization
    Dimensions:
      - Name: ClusterName
        Value: !Ref ECSCluster
      - Name: ServiceName
        Value: !GetAtt ECSService.Name
    Statistic: Average
    Period: 300
    EvaluationPeriods: 1
    Threshold: 80
    ComparisonOperator: GreaterThanThreshold
    AlarmActions:
      - !Ref OpsNotificationTopic
    OKActions:
      - !Ref OpsNotificationTopic

CloudWatch Logs Insights provides a SQL-like query language for rapidly searching massive log volumes. Example query:

# Find top 10 slowest API requests in the last hour
fields @timestamp, @message
| filter @message like /duration/
| parse @message "duration=* ms" as duration_ms
| sort duration_ms desc
| limit 10

12. Cost Optimization: Cutting 40-60% Off Your Bill

Cost optimization is not a one-time activity — it is an ongoing operational practice. AWS provides multiple tools and strategies to help dramatically reduce spending without sacrificing performance. Here is a proven cost optimization playbook.

Compute Cost Optimization

Storage & Data Transfer Optimization

Storage optimization strategies: 1) Use S3 Intelligent-Tiering for data with unknown access patterns. 2) Enable S3 lifecycle policies to transition old data to Glacier. 3) Use gp3 instead of gp2 EBS volumes (same performance, 20% cheaper). 4) Regularly clean up unattached EBS volumes and expired snapshots. 5) Use CloudFront to reduce data transfer costs — edge transfer is much cheaper than direct S3/EC2 transfer.

AWS Cost Management Tools

# Set up a monthly budget alert with AWS CLI
aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "MonthlySpend",
    "BudgetLimit": {
      "Amount": "1000",
      "Unit": "USD"
    },
    "BudgetType": "COST",
    "TimeUnit": "MONTHLY"
  }' \
  --notifications-with-subscribers '[
    {
      "Notification": {
        "NotificationType": "ACTUAL",
        "ComparisonOperator": "GREATER_THAN",
        "Threshold": 80,
        "ThresholdType": "PERCENTAGE"
      },
      "Subscribers": [
        {
          "SubscriptionType": "EMAIL",
          "Address": "ops-team@example.com"
        }
      ]
    }
  ]'

Cost Optimization Checklist

13. AWS Well-Architected Reference Architecture

The AWS Well-Architected Framework defines five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization. Below is a typical three-tier web application architecture combining the core services covered in this guide.

# Three-tier architecture overview
#
# Internet
#   |-- Route 53 (DNS, latency-based routing)
#   |-- CloudFront (CDN, static assets + API caching)
#   |-- WAF (rate limiting, SQL injection protection)
#   |
# VPC (10.0.0.0/16)
#   |
#   |-- Public Subnets (3 AZs)
#   |     |-- ALB (Application Load Balancer)
#   |     |-- NAT Gateways
#   |
#   |-- Private Subnets (3 AZs)
#   |     |-- ECS Fargate / EKS (app containers)
#   |     |-- Lambda (async processing)
#   |     |-- SQS queues + SNS topics
#   |
#   |-- Database Subnets (3 AZs)
#         |-- Aurora PostgreSQL (Multi-AZ)
#         |-- ElastiCache Redis (cluster mode)
#         |-- DynamoDB (session store)
#
# Observability:
#   CloudWatch Metrics + Logs + Alarms
#   X-Ray distributed tracing
#   CloudTrail API audit logging
#
# Security:
#   IAM roles (least privilege)
#   KMS encryption (at rest + in transit)
#   Secrets Manager (DB creds, API keys)
#   GuardDuty (threat detection)

Five Pillars Quick Reference

Conclusion

The AWS ecosystem is vast but follows clear patterns. From compute (EC2/Lambda/ECS) to storage (S3), databases (RDS/DynamoDB), networking (VPC/CloudFront/Route 53), security (IAM), messaging (SQS/SNS), and monitoring (CloudWatch), each service has its optimal use case. The key is choosing the right service combination for your workload characteristics, following the Well-Architected Framework's five pillars, and continuously optimizing costs. Start small, scale on demand, leverage managed services — that is the core philosophy of AWS cloud architecture.

Frequently Asked Questions