1. AWS 服务全景图

Amazon Web Services（AWS）是全球最大的云平台，提供超过 200 种服务，覆盖计算、存储、数据库、网络、安全、分析、机器学习等领域。理解核心服务及其组合方式是构建可靠、可扩展云架构的基础。

2. EC2：弹性计算的基石

Amazon EC2（Elastic Compute Cloud）提供按需、可调整大小的计算能力。从单台开发服务器到数千台高性能计算节点，EC2 都能满足需求。理解实例类型、定价模型和自动伸缩是控制成本和保证性能的关键。

实例类型选择

EC2 定价模型对比

Auto Scaling 配置示例

# EC2 Auto Scaling Group — CloudFormation snippet
AutoScalingGroup:
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    LaunchTemplate:
      LaunchTemplateId: !Ref MyLaunchTemplate
      Version: !GetAtt MyLaunchTemplate.LatestVersionNumber
    MinSize: 2
    MaxSize: 10
    DesiredCapacity: 2
    VPCZoneIdentifier:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2
    TargetGroupARNs:
      - !Ref MyTargetGroup
    HealthCheckType: ELB
    HealthCheckGracePeriod: 300

ScalingPolicy:
  Type: AWS::AutoScaling::ScalingPolicy
  Properties:
    AutoScalingGroupName: !Ref AutoScalingGroup
    PolicyType: TargetTrackingScaling
    TargetTrackingConfiguration:
      PredefinedMetricSpecification:
        PredefinedMetricType: ASGAverageCPUUtilization
      TargetValue: 60.0

3. S3：无限扩展的对象存储

Amazon S3（Simple Storage Service）提供行业领先的持久性（99.999999999%）、可用性和安全性。S3 存储桶可存储从字节到 5TB 的任意数量对象，广泛用于静态网站托管、数据湖、备份和媒体分发。

S3 存储类别与成本

S3 生命周期策略示例

# AWS CLI — S3 lifecycle configuration
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-data-lake \
  --lifecycle-configuration '{
    "Rules": [
      {
        "ID": "ArchiveOldLogs",
        "Status": "Enabled",
        "Filter": { "Prefix": "logs/" },
        "Transitions": [
          { "Days": 30,  "StorageClass": "STANDARD_IA" },
          { "Days": 90,  "StorageClass": "GLACIER" },
          { "Days": 365, "StorageClass": "DEEP_ARCHIVE" }
        ],
        "Expiration": { "Days": 2555 }
      }
    ]
  }'

4. RDS 与 DynamoDB：关系型 vs NoSQL

数据库选择是架构决策中最重要的一环。AWS 提供全托管关系型数据库（RDS/Aurora）和 NoSQL 数据库（DynamoDB），各有其最佳应用场景。

RDS / Aurora 概览

Amazon RDS 支持 MySQL、PostgreSQL、MariaDB、Oracle 和 SQL Server。Aurora 是 AWS 自研的 MySQL/PostgreSQL 兼容引擎，性能是标准 MySQL 的 5 倍、PostgreSQL 的 3 倍，存储自动扩展至 128TB。

# Create a Multi-AZ PostgreSQL RDS instance
aws rds create-db-instance \
  --db-instance-identifier myapp-db \
  --db-instance-class db.r6g.xlarge \
  --engine postgres \
  --engine-version 15.4 \
  --master-username admin \
  --master-user-password "\${SECURE_PASSWORD}" \
  --allocated-storage 100 \
  --storage-type gp3 \
  --multi-az \
  --vpc-security-group-ids sg-0abc1234 \
  --db-subnet-group-name myapp-db-subnets \
  --backup-retention-period 7 \
  --storage-encrypted

DynamoDB 关键概念

DynamoDB 是完全无服务器的键值和文档数据库，提供个位数毫秒响应。核心概念包括分区键（Partition Key）、排序键（Sort Key）、全局二级索引（GSI）和本地二级索引（LSI）。容量模式分为按需（On-Demand）和预配置（Provisioned）。

# DynamoDB table with GSI — CloudFormation
OrdersTable:
  Type: AWS::DynamoDB::Table
  Properties:
    TableName: Orders
    BillingMode: PAY_PER_REQUEST    # On-Demand
    AttributeDefinitions:
      - AttributeName: PK
        AttributeType: S
      - AttributeName: SK
        AttributeType: S
      - AttributeName: GSI1PK
        AttributeType: S
    KeySchema:
      - AttributeName: PK
        KeyType: HASH
      - AttributeName: SK
        KeyType: RANGE
    GlobalSecondaryIndexes:
      - IndexName: GSI1
        KeySchema:
          - AttributeName: GSI1PK
            KeyType: HASH
          - AttributeName: SK
            KeyType: RANGE
        Projection:
          ProjectionType: ALL
    PointInTimeRecoverySpecification:
      PointInTimeRecoveryEnabled: true

RDS vs DynamoDB 决策矩阵

5. Lambda：事件驱动无服务器计算

AWS Lambda 让你无需管理服务器即可运行代码。上传代码，Lambda 自动分配计算资源、执行并伸缩。你只为实际使用的计算时间付费（按毫秒计费），空闲时零成本。

Lambda 函数最佳实践

# Python Lambda with best practices
import json
import boto3
import os
from aws_lambda_powertools import Logger, Tracer, Metrics
from aws_lambda_powertools.utilities.typing import LambdaContext

# Initialize outside handler (reused across invocations)
logger = Logger()
tracer = Tracer()
metrics = Metrics()
dynamodb = boto3.resource("dynamodb")
table = dynamodb.Table(os.environ["TABLE_NAME"])

@logger.inject_lambda_context
@tracer.capture_lambda_handler
@metrics.log_metrics(capture_cold_start_metric=True)
def handler(event, context: LambdaContext):
    """Process API Gateway request."""
    try:
        body = json.loads(event["body"])
        order_id = body["order_id"]

        # Single-table design query
        response = table.get_item(
            Key={"PK": f"ORDER#{order_id}", "SK": "METADATA"}
        )

        if "Item" not in response:
            return {"statusCode": 404, "body": "Not found"}

        metrics.add_metric(name="OrderLookup", unit="Count", value=1)
        return {
            "statusCode": 200,
            "headers": {"Content-Type": "application/json"},
            "body": json.dumps(response["Item"], default=str)
        }
    except Exception as e:
        logger.exception("Failed to process request")
        return {"statusCode": 500, "body": "Internal error"}

Lambda 关键限制：最大执行时间 15 分钟、部署包 250MB（解压后）、内存 128MB-10GB、并发默认 1000（可请求提升）。冷启动延迟取决于运行时和包大小——使用 Provisioned Concurrency 或 SnapStart（Java）来消除冷启动。

6. ECS 与 EKS：容器编排

当工作负载超出 Lambda 的限制（长时间运行、大内存、自定义运行时），容器是下一个选择。AWS 提供两种编排服务：ECS（AWS 原生）和 EKS（托管 Kubernetes）。两者都支持 Fargate 无服务器启动模式。

ECS vs EKS 对比

ECS Fargate 任务定义

# ECS Fargate Task Definition — CloudFormation
TaskDefinition:
  Type: AWS::ECS::TaskDefinition
  Properties:
    Family: myapp-api
    Cpu: "512"
    Memory: "1024"
    NetworkMode: awsvpc
    RequiresCompatibilities: [FARGATE]
    ExecutionRoleArn: !GetAtt ECSExecutionRole.Arn
    TaskRoleArn: !GetAtt ECSTaskRole.Arn
    ContainerDefinitions:
      - Name: api
        Image: !Sub "\${AWS::AccountId}.dkr.ecr.\${AWS::Region}.amazonaws.com/myapp:latest"
        PortMappings:
          - ContainerPort: 8080
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group: /ecs/myapp-api
            awslogs-region: !Ref AWS::Region
            awslogs-stream-prefix: ecs
        Environment:
          - Name: NODE_ENV
            Value: production
        Secrets:
          - Name: DB_PASSWORD
            ValueFrom: !Ref DbPasswordSecret

7. CloudFront 与 Route 53：全球内容分发与 DNS

CloudFront 是 AWS 的 CDN 服务，在全球 400+ 边缘站点缓存内容，将延迟降至个位数毫秒。Route 53 是高可用的 DNS 服务，提供域名注册、DNS 路由和健康检查三合一功能。

Route 53 路由策略

CloudFront 分发配置

# CloudFront with S3 origin — CloudFormation
CloudFrontDistribution:
  Type: AWS::CloudFront::Distribution
  Properties:
    DistributionConfig:
      Origins:
        - Id: S3Origin
          DomainName: !GetAtt MyBucket.RegionalDomainName
          S3OriginConfig:
            OriginAccessIdentity: ""
          OriginAccessControlId: !Ref OAC
      DefaultCacheBehavior:
        TargetOriginId: S3Origin
        ViewerProtocolPolicy: redirect-to-https
        CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized
        Compress: true
      ViewerCertificate:
        AcmCertificateArn: !Ref Certificate
        SslSupportMethod: sni-only
        MinimumProtocolVersion: TLSv1.2_2021
      Enabled: true
      HttpVersion: http2and3
      PriceClass: PriceClass_100

8. IAM：身份与访问管理

IAM 是 AWS 安全的基础。它控制谁（身份）可以对哪些资源执行什么操作。IAM 策略是 JSON 文档，定义 Effect（Allow/Deny）、Action、Resource 和可选 Condition。遵循最小权限原则是安全运营的第一要务。

IAM 最佳实践清单

1) 为 root 账户启用 MFA 并锁定——日常不使用。2) 为每个人/服务创建独立 IAM 用户或角色。3) 使用 IAM 角色（而非 Access Key）为 EC2/Lambda 授权。4) 策略附加到组而非用户。5) 使用 AWS Organizations + SCP 实现跨账户治理。6) 定期使用 IAM Access Analyzer 审计权限。7) 使用 aws-vault 或 SSO 管理本地凭据。

# Least-privilege IAM policy example
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-app-data",
        "arn:aws:s3:::my-app-data/*"
      ]
    },
    {
      "Sid": "AllowDynamoDBCRUD",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders",
      "Condition": {
        "ForAllValues:StringEquals": {
          "dynamodb:LeadingKeys": ["\${aws:PrincipalTag/tenant_id}"]
        }
      }
    }
  ]
}

9. VPC：网络隔离与架构

VPC（Virtual Private Cloud）是 AWS 中的隔离虚拟网络。一个生产级 VPC 通常包含多个可用区中的公有子网和私有子网、Internet 网关、NAT 网关、安全组和网络 ACL。正确的 VPC 设计是安全和可用性的基础。

安全组 vs 网络 ACL

生产级 VPC 架构

# Three-tier VPC architecture — Terraform
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.5.0"

  name = "production-vpc"
  cidr = "10.0.0.0/16"

  azs              = ["us-east-1a", "us-east-1b", "us-east-1c"]
  public_subnets   = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets  = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
  database_subnets = ["10.0.21.0/24", "10.0.22.0/24", "10.0.23.0/24"]

  enable_nat_gateway     = true
  single_nat_gateway     = false  # One per AZ for HA
  one_nat_gateway_per_az = true

  enable_dns_hostnames = true
  enable_dns_support   = true

  # VPC Flow Logs
  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_iam_role             = true

  tags = {
    Environment = "production"
    Terraform   = "true"
  }
}

10. SQS 与 SNS：异步消息与通知

微服务架构的关键原则是松耦合。SQS（消息队列）和 SNS（发布/订阅）是 AWS 中实现异步通信的两大核心服务。它们经常配合使用：SNS 扇出到多个 SQS 队列，实现并行处理。

SQS 标准队列 vs FIFO 队列

SNS + SQS 扇出模式

# SNS topic fans out to multiple SQS queues
# — CloudFormation snippet
OrderTopic:
  Type: AWS::SNS::Topic
  Properties:
    TopicName: order-events

PaymentQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: payment-processing
    VisibilityTimeout: 300
    RedrivePolicy:
      deadLetterTargetArn: !GetAtt PaymentDLQ.Arn
      maxReceiveCount: 3

InventoryQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: inventory-update
    VisibilityTimeout: 300

NotificationQueue:
  Type: AWS::SQS::Queue
  Properties:
    QueueName: customer-notification

# Subscribe all queues to the topic
PaymentSub:
  Type: AWS::SNS::Subscription
  Properties:
    TopicArn: !Ref OrderTopic
    Protocol: sqs
    Endpoint: !GetAtt PaymentQueue.Arn
    FilterPolicy:
      event_type: [order_placed, order_updated]

11. CloudWatch：全栈可观测性

CloudWatch 提供指标、日志、告警和仪表盘，是 AWS 的统一可观测性平台。结合 X-Ray 进行分布式链路追踪，CloudTrail 进行 API 操作审计，构成完整的可观测性三件套。

自定义指标与告警

# Python — publish custom CloudWatch metric
import boto3
from datetime import datetime

cloudwatch = boto3.client("cloudwatch")

def publish_order_metric(order_total: float, region: str):
    cloudwatch.put_metric_data(
        Namespace="MyApp/Orders",
        MetricData=[
            {
                "MetricName": "OrderValue",
                "Dimensions": [
                    {"Name": "Region", "Value": region},
                ],
                "Timestamp": datetime.utcnow(),
                "Value": order_total,
                "Unit": "None",
                "StorageResolution": 60   # standard (1-min)
            }
        ]
    )

CloudWatch Alarm 配置

# CloudWatch Alarm — CloudFormation
HighCPUAlarm:
  Type: AWS::CloudWatch::Alarm
  Properties:
    AlarmName: high-cpu-api-cluster
    AlarmDescription: "CPU > 80% for 5 minutes"
    Namespace: AWS/ECS
    MetricName: CPUUtilization
    Dimensions:
      - Name: ClusterName
        Value: !Ref ECSCluster
      - Name: ServiceName
        Value: !GetAtt ECSService.Name
    Statistic: Average
    Period: 300
    EvaluationPeriods: 1
    Threshold: 80
    ComparisonOperator: GreaterThanThreshold
    AlarmActions:
      - !Ref OpsNotificationTopic
    OKActions:
      - !Ref OpsNotificationTopic

CloudWatch Logs Insights 提供类 SQL 查询语言，可在海量日志中快速定位问题。示例查询：

# Find top 10 slowest API requests in the last hour
fields @timestamp, @message
| filter @message like /duration/
| parse @message "duration=* ms" as duration_ms
| sort duration_ms desc
| limit 10

12. 成本优化：从账单中削减 40-60%

成本优化不是一次性工作——它是持续的运营实践。AWS 提供多种工具和策略来帮助你在不牺牲性能的情况下大幅降低支出。以下是经过验证的成本优化策略清单。

计算成本优化

存储与数据传输优化

存储优化策略：1) 使用 S3 Intelligent-Tiering 自动迁移访问模式不确定的数据。2) 启用 S3 生命周期策略将旧数据迁移到 Glacier。3) 使用 gp3 替代 gp2 EBS 卷（同等性能，节省 20%）。4) 定期清理未挂载的 EBS 卷和过期快照。5) 使用 CloudFront 减少数据传输费用——边缘传输比从 S3/EC2 直接传输便宜得多。

AWS 成本管理工具

# Set up a monthly budget alert with AWS CLI
aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{
    "BudgetName": "MonthlySpend",
    "BudgetLimit": {
      "Amount": "1000",
      "Unit": "USD"
    },
    "BudgetType": "COST",
    "TimeUnit": "MONTHLY"
  }' \
  --notifications-with-subscribers '[
    {
      "Notification": {
        "NotificationType": "ACTUAL",
        "ComparisonOperator": "GREATER_THAN",
        "Threshold": 80,
        "ThresholdType": "PERCENTAGE"
      },
      "Subscribers": [
        {
          "SubscriptionType": "EMAIL",
          "Address": "ops-team@example.com"
        }
      ]
    }
  ]'

成本优化检查清单

13. AWS Well-Architected 参考架构

AWS Well-Architected Framework 定义了五大支柱：卓越运营、安全性、可靠性、性能效率和成本优化。以下是一个典型的三层 Web 应用架构，综合运用了本指南介绍的核心服务。

# Three-tier architecture overview
#
# Internet
#   |-- Route 53 (DNS, latency-based routing)
#   |-- CloudFront (CDN, static assets + API caching)
#   |-- WAF (rate limiting, SQL injection protection)
#   |
# VPC (10.0.0.0/16)
#   |
#   |-- Public Subnets (3 AZs)
#   |     |-- ALB (Application Load Balancer)
#   |     |-- NAT Gateways
#   |
#   |-- Private Subnets (3 AZs)
#   |     |-- ECS Fargate / EKS (app containers)
#   |     |-- Lambda (async processing)
#   |     |-- SQS queues + SNS topics
#   |
#   |-- Database Subnets (3 AZs)
#         |-- Aurora PostgreSQL (Multi-AZ)
#         |-- ElastiCache Redis (cluster mode)
#         |-- DynamoDB (session store)
#
# Observability:
#   CloudWatch Metrics + Logs + Alarms
#   X-Ray distributed tracing
#   CloudTrail API audit logging
#
# Security:
#   IAM roles (least privilege)
#   KMS encryption (at rest + in transit)
#   Secrets Manager (DB creds, API keys)
#   GuardDuty (threat detection)

五大支柱快速参考

总结

AWS 生态系统庞大但有章可循。从计算（EC2/Lambda/ECS）到存储（S3）、数据库（RDS/DynamoDB）、网络（VPC/CloudFront/Route 53）、安全（IAM）、消息（SQS/SNS）到监控（CloudWatch），每个服务都有其最佳使用场景。关键是根据工作负载特征选择合适的服务组合，遵循 Well-Architected Framework 的五大支柱，并持续优化成本。从小处着手，按需扩展，善用托管服务——这就是 AWS 云架构的核心理念。

常见问题