AWS Cloud Engineering

Learn what AWS is in simple terms, how Regions and Availability Zones work, what the Free Tier covers and how DevOps teams use AWS to build and run systems.

Learn how AWS is laid out: Regions, Availability Zones, Local Zones and edge locations. Choose a Region and see why cross-AZ traffic costs money.

Prepare a new AWS environment before you build: pick an account structure, harden root, set up identity, add billing guardrails, enable CloudTrail, tag early.

Secure a new AWS account: lock down the root user with MFA, set billing alarms, turn on CloudTrail and fix the settings that are painful to change later.

Navigate the AWS Console quickly: use the search bar, avoid Region mistakes, open CloudShell, find resources with Tag Editor and know when to skip it.

Install the AWS CLI and set it up with SSO instead of long-lived access keys. Create named profiles, learn the credential chain and stay in the right account.

Learn how AWS IAM decides who can do what: users, groups, roles and policies, policy anatomy, the evaluation order behind AccessDenied and least privilege.

Learn how IAM users and groups work, why AWS recommends against IAM users for people, how to keep access keys safe and how to move to IAM Identity Center.

Understand IAM roles and policies: trust vs permission policies, assuming roles with STS, managed vs inline policies, boundaries and AssumeRole errors.

Harden IAM: replace IAM users with Identity Center, drop long-lived CI keys, lock down root, reach least privilege from usage data and set boundaries.

Learn how EC2 works: instance families and sizing, pricing models, EBS vs instance store, IMDSv2, Session Manager instead of SSH, and stop vs terminate.

Launch an EC2 instance properly: pick an AMI without hardcoding IDs, use a launch template and user data, enforce IMDSv2 and debug a bad start.

Read an EC2 instance type name, learn what each family is for, understand burstable credits and Graviton savings, and size instances from data, not guesses.

Learn how EC2 security groups work as stateful firewalls: rule structure, referencing groups instead of CIDRs, default outbound rules and blocked traffic.

Learn how EC2 key pairs work, create one for SSH, recover an instance after losing the key, and see why Session Manager is a better default than SSH.

Build an AWS VPC step by step: CIDR and subnet sizing, public vs private subnets, NAT gateway costs, VPC endpoints, security groups vs NACLs and flow logs.

Design VPC subnets properly: what makes a subnet public, CIDR sizing and the five reserved IPs, one subnet per AZ, required tags and running out of addresses.

How VPC route tables route traffic: the local route, longest prefix match, the main route table trap, one table per AZ and debugging no connectivity.

See what an AWS NAT gateway does, why it is often the largest networking cost on your bill, and how VPC endpoints and design changes reduce it.

Learn how Amazon S3 works: buckets and keys, storage classes, lifecycle rules, encryption, public access, versioning, presigned URLs and cost control.

Create and configure an S3 bucket correctly: naming rules, the us-east-1 exception, settings to apply at creation, Object Lock and deleting a stuck bucket.

Understand how S3 decides access: IAM vs bucket policies, Block Public Access, disabled ACLs, cross-account access, presigned URLs and debugging AccessDenied.

Enable S3 versioning to survive overwrites and deletes. Learn how delete markers work, hidden storage costs, lifecycle rules, MFA delete and Object Lock.

Learn Amazon RDS: Multi-AZ vs read replicas, backups and point-in-time recovery, settings you cannot change later, why Lambda needs RDS Proxy, and cost.

Create an RDS instance with the right choices up front: subnet groups, settings you cannot change later, parameter groups, private access and first checks.

Secure an RDS database: network isolation, encryption at rest and in transit, IAM authentication, secret rotation, audit logs and deletion protection.

Learn how AWS Lambda works: the execution model, memory as CPU, cold starts, the concurrency limit, timeouts and retries, VPC networking and surprise costs.

Write, package and deploy Lambda functions: handler signatures, zip vs container image packaging, layers, versions and aliases, and testing locally.

Compare ECS and EKS on cost, complexity, portability and ecosystem, see where Fargate and App Runner fit, and get a short decision rule for your team.

Understand ECS task definitions and services: task role vs execution role, networking modes, health checks, deployments and fixing a task that will not start.

Use CloudWatch metrics, logs, alarms and dashboards well. Covers missing EC2 metrics, log groups that never expire, alarm states and the bill.

Understand CloudWatch metrics: namespaces, dimensions, statistics, the EC2 metrics AWS does not publish (memory, disk), custom metric costs and metric math.

Build a CI/CD pipeline with AWS CodePipeline: stages, source providers, artifacts, manual approvals and deploy actions, plus CodePipeline vs GitHub Actions.

Write a CodeBuild buildspec.yml that works: phases and failure behavior, caching, Docker image builds, VPC access, exported variables and build diagnosis.

Cut your AWS bill in a sensible order: find where the money goes, use Savings Plans, Spot and Graviton, and fix hidden data transfer and NAT gateway charges.

Choose between ALB, NLB and GWLB, then set up target groups, listener rules, health checks and TLS, and debug 502 and 503 errors from the load balancer.

Create an Application Load Balancer, set up target group health checks and priority-ordered listener rules, read 502 and 503 errors and compare ALB with NLB.

Set up a Network Load Balancer for layer 4 traffic: static IPs, client IP preservation, the hairpin problem, cross-zone charges, TLS listeners and NLB vs ALB.

See what scales on AWS and how: EC2 Auto Scaling vs Application Auto Scaling, scaling ECS, DynamoDB and Aurora, and why right-sizing often beats scaling.

Set up an Auto Scaling group with launch templates, ELB vs EC2 health checks and grace periods, then deploy with instance refresh and Spot mixed instances.

Compare target tracking, step, scheduled and predictive scaling, pick the right policy, and use warmup and cooldowns to stop flapping and bad scale-in.

Learn how CloudFront caching works: origin access control for S3, the cache key behind your hit rate, TTL header rules, invalidation costs and error pages.

Create a CloudFront distribution step by step. Learn behavior precedence, multiple origins, origin groups for failover and Functions vs Lambda@Edge.

Serve CloudFront on your own domain over HTTPS: request the ACM certificate in us-east-1, validate with DNS, add the alias record and pick a security policy.

Get DNS working on Route 53: public and private hosted zones, the delegation step people forget, alias records, health checks and how TTL sets failover speed.

Create the Route 53 record types you will use: A, AAAA, CNAME, MX, TXT, CAA and SRV. Covers UPSERT semantics, SPF and DMARC records and common errors.

Choose a Route 53 routing policy: weighted, latency, failover, geolocation, geoproximity or multivalue. Learn the Set Identifier rule and why canaries drift.

Learn DynamoDB if you know SQL: partition and sort keys, designing for access patterns first, avoiding hot partitions, conditional writes, streams and TTL.

Create a DynamoDB table with the AWS CLI. Choose the key schema you cannot change later, enable deletion protection and PITR, and take on-demand backups.

Learn DynamoDB Query vs Scan, why filter expressions do not cut cost, how GSIs differ from LSIs, and how to paginate results and use sparse indexes.

Run ElastiCache well: pick Redis, Valkey or Memcached, start serverless, set eviction policies, implement cache-aside and handle cluster mode and failover.

Use Amazon SQS well: Standard vs FIFO, a visibility timeout longer than processing time, long polling, idempotent consumers, dead-letter queues, monitoring.

Set up an SQS dead-letter queue with a redrive policy, choose maxReceiveCount, inspect failed messages without consuming them and redrive them safely.

Build publish-subscribe messaging with Amazon SNS: set up the SNS-to-SQS fan-out pattern, use filter policies and raw message delivery and avoid email traps.

Route events with Amazon EventBridge: create buses and rules, write event patterns, schedule jobs, transform input, archive and replay events and add a DLQ.

Orchestrate workflows with AWS Step Functions: Standard vs Express (a 100x cost gap), retries and catchers, Map state parallelism and debugging failed runs.

Choose between API Gateway HTTP, REST and WebSocket APIs, then create an HTTP API with stages, throttling and a custom domain. Includes the 70% price gap.

Build an API Gateway REST API with resources, mapping templates and request validation, then add API keys, usage plans, caching and OpenAPI import.

Connect API Gateway to Lambda with proxy integration and return the response shape that avoids a 502. Covers payload v1 vs v2, CORS and the 29-second limit.

Push, pull and secure Docker images in Amazon ECR. Authenticate with the AWS CLI, tag images, set lifecycle policies, enable scanning and fix common errors.

Understand how Amazon EKS runs Kubernetes on AWS: what AWS manages, node options, access entries, IRSA vs Pod Identity, add-ons and networking pitfalls.

Create an EKS cluster that works the first time: avoid IAM lockouts with access entries vs aws-auth, tag subnets correctly and plan for the VPC CNI IP limit.

Run EKS worker nodes : managed node groups vs Fargate, why Karpenter beats Cluster Autoscaler, taints, Spot interruptions and nodes that will not join.

Understand AWS CloudFormation: template anatomy, deploying stacks, change sets, drift detection and stuck stacks, plus CloudFormation vs Terraform.

Recover a CloudFormation stack stuck in UPDATE_ROLLBACK_FAILED or ROLLBACK_COMPLETE, then prevent repeats with change sets, drift checks and delete policies.

Write maintainable CloudFormation templates with typed parameters, intrinsic functions, conditions, DependsOn and custom resources, then lint with cfn-lint.

Deploy an app with Elastic Beanstalk without managing servers. Compare deployment policies and downtime tradeoffs, blue-green URL swaps and .ebextensions.

Use AWS KMS correctly: why key policies come before IAM, AWS managed vs customer managed keys, envelope encryption, encryption context, rotation and grants.

Store, rotate and read secrets with AWS Secrets Manager. Covers resource policies, automatic rotation, caching, recovery windows, cost and Parameter Store.

Set up AWS WAF without blocking users: build a web ACL, run rules in count mode first, add rate limiting, handle false positives and weigh Shield Advanced.

Go beyond the 90-day event history: create a multi-region CloudTrail trail, log management and data events, validate log files and query logs with Athena.

Use AWS Config for continuous compliance: turn on the recorder, apply managed rules and conformance packs, auto-remediate with SSM and compare with CloudTrail.

Set up Systems Manager and fix managed instances that do not appear, then use Run Command, Patch Manager, State Manager and Automation to manage a fleet.

Get a shell on EC2 with Session Manager and no SSH, bastion or open ports. Meet the prerequisites, log sessions for audit and port-forward to a database.

Store configuration and secrets in SSM Parameter Store with SecureString encryption, path hierarchies, versions, labels, standard vs advanced tiers and cost.

Set up multi-account AWS with Organizations. Learn why separate accounts beat separate VPCs, how to design OUs, create accounts and use consolidated billing.

Write service control policies that restrict without breaking things: deny lists over allow lists, why an SCP grants nothing, break-glass roles and testing.

Create and mount Amazon EFS across instances and containers. Covers mount targets per AZ, the forgotten security group rule, throughput modes and EFS vs EBS.

Choose and tune EBS volumes: gp3 vs gp2, io2 Block Express, why the instance type caps throughput, fast snapshot restore, safe resizing and encryption.

Choose between Kinesis Data Streams, Firehose, SQS and MSK. Learn shards, hot partition keys, consumer lag, enhanced fan-out and how to reshard a busy stream.

Query S3 with SQL using Athena and keep the bill low. Learn partitioning, partition projection, why Parquet beats JSON and how to cap bytes scanned per query.

Run blue-green and canary deployments to EC2, Lambda and ECS with CodeDeploy. Write the appspec file, add lifecycle hooks and roll back on CloudWatch alarms.

CodeCommit no longer accepts new customers. See what that means for existing repositories and how to migrate to GitHub or GitLab with your history intact.

Define AWS infrastructure in TypeScript or Python with CDK. Learn the three construct levels, bootstrapping, cdk diff, escape hatches and CDK vs Terraform.

Build and deploy serverless apps with AWS SAM: write the template shorthand, run sam build and sam deploy --guided, test with sam local and compare with CDK.