AWS: Core Services, Architecture & Best Practices

Q: What's the difference between a Region and an Availability Zone?

A Region is a geographic area (e.g. us-east-1 in N. Virginia); an Availability Zone is one of several isolated data centers within that region. Deploy across multiple AZs so a single data-center failure doesn't take you down. Resources are region-scoped — they don't automatically exist or replicate across regions.

Q: When should I use Lambda vs ECS/Fargate vs EC2?

Use Lambda for event-driven, short-lived, spiky workloads with no server management. Use ECS/Fargate for containerized services that run continuously without Kubernetes overhead. Use EC2 when you need full OS control, specialized hardware (GPUs), or long-running stateful processes. Many teams over-reach for Kubernetes (EKS) when Lambda or Fargate would suffice.

AWS (Amazon Web Services)

AWS is the world's largest cloud computing platform, offering 200+ services spanning compute, storage, databases, networking, and machine learning. It provides on-demand infrastructure that scales with demand and bills pay-as-you-go, eliminating the need to buy and run physical servers.

The problem it solves: before cloud, launching an app meant buying servers, leasing data-center space, and managing hardware — weeks of lead time and heavy capital. AWS provisions equivalent infrastructure in minutes with no upfront cost. Amazon built massive capacity for its own retail peaks, then rented it out; launched in 2006 with S3 and EC2, AWS pioneered Infrastructure-as-a-Service and holds roughly a third of the cloud market.

Where it fits: AWS is the foundational infrastructure layer. Applications run on AWS compute (EC2, Lambda), store data in AWS databases (RDS, DynamoDB), and connect through AWS networking (VPC, CloudFront) — integrating with virtually every language and framework.

TL;DR

A pay-as-you-go utility for computing — provision infrastructure in minutes.
Organized into Regions and Availability Zones; resources are region-scoped.
Core building blocks: EC2 (compute), S3 (storage), RDS (databases), VPC (networking), IAM (access).
Security is a shared responsibility — AWS secures the cloud, you secure what's in it.

Quick Example

The AWS CLI is the fastest way to touch real resources:

Core Concepts & Terminology

Key terms

Region — a geographic area with multiple isolated data centers (us-east-1, eu-west-1).
Availability Zone (AZ) — an isolated data center within a region; deploy across AZs for high availability.
EC2 — Elastic Compute Cloud; configurable virtual servers.
S3 — Simple Storage Service; object storage for files, backups, static assets.
IAM — Identity and Access Management; controls who can do what.
VPC — Virtual Private Cloud; the isolated network your resources run in.
Lambda — serverless compute; run code without managing servers.
RDS — managed relational databases (PostgreSQL, MySQL, etc.).

Common acronyms

ARN (Amazon Resource Name) · EBS (Elastic Block Store, EC2 disks) · ALB/ELB (load balancers) · ECS/EKS (container/Kubernetes services) · SNS/SQS (notification/queue) · CDK (Cloud Development Kit, IaC in real languages).

Mental models

Think of AWS as a utility company for computing — like electricity, you don't generate your own; you plug in and pay for what you use. Regions and AZs are like cities and neighborhoods: resources in the same region talk fast; AZs within a region are isolated but linked for redundancy; cross-region is farther apart.

What beginners misunderstand

Free Tier has limits — exceeding thresholds triggers charges.
Regions are separate — a resource in us-east-1 is invisible in us-west-2.
Stopped EC2 still costs — attached EBS volumes keep billing.
S3 is not a filesystem — object storage, no real folders or in-place append.
IAM is not optional — it's foundational to AWS security.

How AWS Works (Conceptual Architecture)

A typical setup: an internet-facing load balancer in public subnets routes to compute (EC2/ECS) in private subnets, which talks to a managed database (RDS), with S3 for storage, CloudWatch for monitoring, and IAM governing all access — spread across multiple AZs for resilience.

Where complexity arises

IAM policies — least-privilege and the policy language take practice.
Networking — VPC design, subnets, route tables, security groups vs NACLs.
Cost management — surprise charges and many pricing models.
Service selection — overlapping options (Lambda vs ECS vs EC2).
Multi-region — replication, failover, and latency.

Subcategories & Variants

Compute

EC2 — full-control VMs; any OS, any configuration.
Lambda — serverless functions; pay per invocation, no servers.
ECS/Fargate — container orchestration without Kubernetes complexity.
EKS — managed Kubernetes for teams already invested in K8s.

Storage

S3 — object storage; effectively unlimited, high durability, static hosting.
EBS — block storage; disks for EC2.
EFS — shared file system across many EC2 instances.
Glacier — cheap archival for rarely accessed data.

Databases

RDS — managed relational (PostgreSQL, MySQL, SQL Server).
Aurora — AWS-optimized relational; high performance, auto-scaling.
DynamoDB — NoSQL key-value; single-digit-ms latency at any scale.
ElastiCache — managed Redis/Memcached caching.

Networking & CDN

VPC — private network; subnets, routing, security groups.
CloudFront — CDN caching content at global edge locations.
Route 53 — DNS and domain registration.
API Gateway — managed REST and WebSocket API layer.

Tooling & Ecosystem

AWS services are proprietary, but much of the tooling is open source: Terraform (multi-cloud IaC), LocalStack (local AWS emulator), the AWS CDK, and the Serverless Framework.

Performance, Scalability & Tradeoffs

Bottlenecks — Lambda cold starts, API throttling, cross-region latency, RDS connection limits, S3 key-prefix design.
Cost levers — EC2 on-demand vs Reserved vs Spot; egress/data-transfer charges; S3 storage tiers; hidden costs like NAT Gateway and CloudWatch logs; right-sizing and Savings Plans.
Scaling challenges — stateful databases are harder to scale horizontally; Lambda at scale needs provisioned concurrency; multi-region adds complexity; optimization becomes critical as usage grows.

Security: the shared responsibility model

AWS secures the cloud (hardware, global infrastructure); you secure what runs in the cloud. That means least-privilege IAM, encryption at rest (KMS) and in transit (TLS), network controls (security groups, NACLs, private subnets), and audit logging (CloudTrail). See Secrets Management and Encryption.

Comparison to Related Platforms

AWS wins for breadth of services, cloud-native startups, and ecosystem depth. Azure wins in Microsoft shops (O365, Active Directory, Windows hybrid). GCP wins for ML/AI, data analytics, and Kubernetes-first teams. Versus on-premise, AWS trades complete control for zero upfront cost and minutes-not-months scaling — on-prem still wins for steady high-volume workloads and strict data-sovereignty needs.

Best Practices

Never use the root account for daily work — create IAM users/roles with least privilege.
Set billing alerts on day one; review Cost Explorer regularly.
Use Infrastructure as Code (CDK/CloudFormation/Terraform) — no manual console drift.
Deploy across multiple AZs for high availability.
Block public access on S3 by default; lock down security groups (no open 0.0.0.0/0).
Right-size and clean up unused resources; use Savings Plans for steady load.

Common Mistakes

Hardcoding credentials

Accidentally public S3 buckets

FAQ

What's the difference between a Region and an Availability Zone?

A Region is a geographic area (e.g. us-east-1 in N. Virginia); an Availability Zone is one of several isolated data centers within that region. Deploy across multiple AZs so a single data-center failure doesn't take you down. Resources are region-scoped — they don't automatically exist or replicate across regions.

When should I use Lambda vs ECS/Fargate vs EC2?

Use Lambda for event-driven, short-lived, spiky workloads with no server management. Use ECS/Fargate for containerized services that run continuously without Kubernetes overhead. Use EC2 when you need full OS control, specialized hardware (GPUs), or long-running stateful processes. Many teams over-reach for Kubernetes (EKS) when Lambda or Fargate would suffice.

Why is my AWS bill higher than expected?

Common culprits: stopped EC2 instances still billing for attached EBS volumes, NAT Gateway hourly + data-processing charges, cross-region/internet egress, idle load balancers, and CloudWatch log retention. Set AWS Budgets alerts, use Cost Explorer to attribute spend, and right-size or delete unused resources.

Do I really need IAM and a custom VPC for a small project?

IAM, yes — at minimum stop using the root account and create a least-privilege user/role; it's foundational security. A custom VPC is optional for the smallest projects (the default VPC works), but understanding subnets and security groups quickly becomes necessary as soon as you add private databases or multi-tier networking.