Cloud & Infrastructure
Amazon Web Services (AWS)
The world's most comprehensive and broadly adopted cloud platform.
AWS provides on-demand compute, managed relational databases, object storage, and secure virtual private clouds. Mastering IAM policies, S3 lifecycle rules, EC2 compute configurations, and VPC subnets forms the backbone of cloud architecture.
Virtual Lab Ready
Automated testing sandbox running in your browser.
Launch First Lab ⚡No local installation required
Hands-on Practice
Interactive Terminal Labs
Real environment tasks with automated validation. Write real commands, verify state, and debug errors.
Verify Your AWS Identity
Topic: Identity & Access
Before touching any AWS service, always confirm who the CLI is acting as. Misconfigured credentials are the #1 cause of 'why can't I access anything'.
Key Checks:
- Directory ~/report exists
- File ~/report/account.txt exists and contains the AWS account ID
Create a Bucket and Upload an Object
Topic: S3 — Object Storage
S3 is the storage everything else leans on: backups, static sites, Terraform state, ML datasets. Create a bucket, upload a file into it and list what's inside.
Key Checks:
- A bucket named learner-demo-bucket exists
- The bucket contains an uploaded object
Launch an EC2 Instance
Topic: EC2 — Virtual Machines
EC2 is AWS's virtual machine service. Launch an instance from an AMI, confirm it's running, then terminate it — the full lifecycle in one task.
Key Checks:
- An EC2 instance from ami-0abcdef1234567890 is running
Upload a Build Artifact
Topic: Object Uploads
Every CI run produces things worth keeping — test reports, build logs, binaries. Write a build report to disk, create a bucket for artifacts and upload the file with aws s3 cp.
Key Checks:
- File ~/build-report.txt exists with the build result
- Bucket learner-build-artifacts exists
Write a Least-Privilege IAM Policy
Topic: IAM & Least Privilege
AdministratorAccess is not a starting point. Write a policy that grants exactly two S3 read actions on one bucket and nothing else.
Key Checks:
- Directory ~/aws exists
- File ~/aws/iam-policy.json exists
Document a Key Rotation Runbook
Topic: IAM & Least Privilege
Keys outlive the people who created them. Write the script that creates a replacement key, deploys it and revokes the old one - in that order.
Key Checks:
- Directory ~/aws exists
- File ~/aws/rotate-keys.sh exists
System Design
Global Infrastructure & VPC Networking
Understand how this tool operates internally before running production workloads.
Internal Mechanics
AWS regions contain isolated Availability Zones (AZs) connected through low-latency fiber. Virtual Private Clouds (VPCs) segment network CIDR blocks across public and private subnets with internet and NAT gateways.
Mental Model Rule of Thumb
Never treat Amazon Web Services (AWS) as a black box. Understanding its boundary with the kernel, filesystem, and network stack prevents 90% of production outages.
Core Architectural Subsystems
IAM (Identity & Access)
Zero-trust identity boundary evaluating least-privilege JSON policy actions.
Amazon S3
Object store providing 99.999999999% durability with tiering and bucket policies.
Amazon EC2
Elastic virtual servers with EBS block volumes and security group firewalls.
VPC & Route Tables
Isolated virtual networks controlling routing between subnets and gateways.
Developer Reference
Command Reference & Cheatsheet
Curated commands, flags, and one-liners tested for everyday operational productivity.
aws sts get-caller-identityVerify active AWS account ID, IAM ARN and role credentials
aws s3 ls && aws s3 sync ./dist s3://my-bucket/ --deleteSynchronize local build output to target S3 bucket
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress]'List EC2 instances, state and public IPs
aws logs tail /aws/lambda/my-func --followLive stream CloudWatch logs from a serverless function
aws iam simulate-principal-policy --policy-source-arn <arn> --action s3:PutObjectSimulate IAM policy evaluation against specific action
Fundamental Primitives
Key Terminology & Primitives
Core abstractions you must master to communicate and build with confidence.
IAM Roles vs Users
Users represent humans with long-lived keys. Roles are assumed dynamically by EC2/Lambda with temporary STS credentials.
Public vs Private Subnets
Public subnets route 0.0.0.0/0 to an Internet Gateway. Private subnets route outbound traffic via a NAT Gateway.
Security Groups vs NACLs
Security groups are stateful host firewalls. Network ACLs are stateless subnet-level packet filters.
S3 Storage Classes
Standard, Infrequent Access, and Glacier Deep Archive for automated cost optimization.
Production War-Stories
Common Pitfalls & Debugging Playbook
The exact errors that take down production systems and how to diagnose and resolve them.
Access Denied (HTTP 403) on S3 upload
Symptom
An error occurred (AccessDenied) when calling the PutObject operation.
Resolution
Check IAM policy permissions for s3:PutObject, verify S3 bucket policy restrictions, and inspect 'Block Public Access' settings.
EC2 instance unreachable via SSH
Symptom
Connection timed out on port 22.
Resolution
Ensure Security Group allows inbound TCP port 22 from your IP, the subnet route table points to an Internet Gateway, and instance has a public IP.
Reliability Standards
Production Readiness Checklist
Review this checklist before deploying workloads to staging or production clusters.
- ✓Enforce Multi-Factor Authentication (MFA) on all root and human IAM accounts.
- ✓Eliminate hardcoded access keys — use IAM Roles and AWS Secrets Manager.
- ✓Enable AWS CloudTrail across all regions for audit compliance.
- ✓Implement S3 bucket versioning and default KMS server-side encryption.
- ✓Set AWS Budgets and cost anomaly detection alerts.
Full Curriculum Track
Master Amazon Web Services (AWS) as part of the DevOps Engineer path
Tools do not exist in isolation. Learn how Amazon Web Services (AWS) connects with other systems, CI/CD pipelines, and infrastructure patterns.