AWS Tutorial with Examples.
AWS tutorial for beginners: EC2, S3, Lambda, IAM, VPC, RDS and the core cloud architecture patterns of Amazon Web Services.
Architecture at a glance
Click any box to open the lesson that teaches it
AWS architecture at a glance
CLI → IAM → VPC → EC2 / Lambda → S3 / RDS, watched by CloudWatch
How it fits together (5 steps)
- Every request starts from the AWS CLI, configured for a region and confirmed against an identity before anything else runs — against LocalStack with zero account, or against real AWS once credentials are set.
- That identity is only as powerful as its IAM policy: a user with no permissions gets a real
AccessDenieduntil a least-privilege policy is attached — roles skip the long-lived keys entirely. - Compute runs inside a VPC, where a subnet only reaches the internet once its route table points at an internet gateway, independently of whatever its security group allows — both have to be right. EC2 launches an instance there you SSH into directly; Lambda runs the same code with no server to manage, at the cost of a cold start on the first invocation.
- Both call the data layer: S3 holds objects in a versioned bucket, and RDS runs a managed Postgres instance you can snapshot and restore.
- Two services wrap the whole stack: CloudFormation deploys every resource above as one template that rolls back together on failure, and CloudWatch collects the metrics, logs, and alarms that watch it while it runs. Cost Explorer and the Well-Architected Framework's six pillars are the last check before calling it production-ready.
Beginner
Start here — no prior experience needed
Introduction to AWS
What AWS regions and availability zones really are, then configure the CLI and confirm your identity against LocalStack with no AWS account required.
IAM: Users, Roles, and Policies
Create a least-privilege IAM policy, attach it to a user, hit a real AccessDenied error, then read the policy to see exactly what was missing.
EC2 Fundamentals
Launch an EC2 instance behind a security group with Terraform, SSH into it, and read the exact CLI output that confirms each step worked.
S3 Fundamentals
Create a bucket, upload and download objects, attach a bucket policy, and turn on versioning to recover an overwritten file — all against LocalStack.
Intermediate
For developers with core concepts down
VPC and Networking Basics
Build a subnet, route table, and internet gateway, then walk through the exact debugging sequence for an EC2 instance that can't reach the internet.
RDS Basics
Launch a managed Postgres instance on RDS, connect to it with psql, take a snapshot, and restore it into a brand-new instance.
AWS Lambda Fundamentals
Write, deploy, and invoke a real Lambda function through the CLI, then measure cold start against warm invocation with the numbers AWS actually reports.
CloudFormation Basics
Deploy a minimal CloudFormation stack, break it on purpose with a bad parameter, and read exactly what a failed rollback prints in the events log.
CloudWatch Monitoring Basics
Push a custom metric, create a log group with a metric filter, and set an alarm that actually transitions to ALARM state on real threshold breaches.
DynamoDB: Tables and Keys
Create a DynamoDB table with a partition key and sort key, put two items under the same partition, and query them with begins_with — all against the real DynamoDB Local emulator, no AWS account needed.
DynamoDB: Scan, Reserved Words, and Global Secondary Indexes
Scan a DynamoDB table with a filter and watch Count diverge from ScannedCount, hit the real reserved-word error on an attribute named total, fix it with an alias, then add and query a Global Secondary Index.
DynamoDB: Conditional Writes, Atomic Counters, and Streams
Block a duplicate write with a ConditionExpression, increment a counter atomically with an update expression, then read the resulting change straight off DynamoDB Streams — all against the real DynamoDB Local emulator.
SQS: Visibility Timeout and Dead-Letter Queues
Send one SQS message, watch its ApproximateReceiveCount climb across a 2-second visibility timeout, and see it redrive into a dead-letter queue the moment maxReceiveCount is exceeded — against the moto emulator, no AWS account.
SQS: FIFO Queues, Message Groups, and Deduplication
Send the same message body twice to a FIFO queue and watch content-based deduplication deliver it only once, then interleave two message groups and confirm each group's own order is preserved — against the moto emulator.
SNS: Fan-Out to SQS and Filter Policies
Fan one SNS topic out to two SQS queues, give one of them a FilterPolicy, and watch it get only the messages that match — while the unfiltered queue gets everything — against the moto emulator.
ELB and Auto Scaling: Wiring an ASG Behind a Load Balancer
Wire a launch template, an Auto Scaling Group, and an Application Load Balancer's target group together, watch a terminated instance get replaced automatically, then hit several real moto emulator gaps this lesson states plainly.
ECS: Task Definitions and Services
Register two revisions of an ECS task definition, create a service that reports desiredCount without ever running anything, then docker run the same image/port/cpu/memory/env to see what a task actually is — against moto.
Advanced
Production-grade patterns for experienced engineers
AWS Cost and Well-Architected Basics
Query real Cost Explorer output, walk the Well-Architected Framework's six pillars, and compare On-Demand, Reserved, and Spot pricing with the math shown.
DynamoDB: Single-Table Design
Store two different entity types — customer profiles and their orders — in one DynamoDB table, and prove each of three real access patterns, including a cross-customer query, costs exactly one Query against real DynamoDB Local.
Also part of AWS
Taught in other topics. Each link opens the lesson in its home topic.
Linting AWS IAM Policies Before Deploy with Parliament
Lint IAM policy JSON locally with parliament: catch s3:* on *, a mistyped action and a resource mismatch, then gate CI on a least-privilege rewrite.
Auditing the AWS IAM Credential Report with Python
Parse an AWS IAM credential report with Python's csv module: find active root keys, users without MFA, keys over 90 days old and unused credentials.
Hunting in AWS CloudTrail Logs with Python
Search CloudTrail JSON with Python for root console logins, new access keys, IAM policy changes and public buckets, then build a sorted attack timeline.
Dead-Letter Queues: What Happens When Retries Keep Failing
A consumer retrying a poison message forever wastes work on something that will never succeed — route it to a dead-letter queue, then replay once fixed.
Idempotent Consumers: Surviving a Duplicate Delivery
The outbox pattern can deliver the same event twice; a consumer that tracks processed event IDs stays correct even when it does.
Load Balancing: Round Robin vs Least Connections
Round robin sends every server an equal share regardless of load; least connections adapts to which servers are actually busy right now.
Kubernetes Fundamentals
Learn the core concepts of Kubernetes—clusters, pods, deployments, services, namespaces, and how to reason about orchestration.
Horizontal Pod Autoscaling: Real Replicas, Real CPU Numbers
Deploy a CPU-hungry container behind an HPA and watch replica count climb in real time as metrics-server reports real utilization — no simulated numbers, just kubectl get hpa polled while it happens.