AWS essentials: 50 cards on EC2, S3, IAM, VPC, RDS and Lambda

All 50 cards

1. 1
   Region vs Availability Zone (AZ)
   A Region is a separate geographic area, such as eu-central-1 (Frankfurt), containing several AZs (usually three or more); an AZ is one or more data centers with independent power and networking, linked to the others by low-latency connections

   Spreading resources across AZs lets an application survive the loss of a whole data center.
2. 2
   The shared responsibility model
   AWS is responsible for security of the cloud (facilities, hardware, network, virtualization); you are responsible for security in the cloud (your data, IAM, OS patches on EC2, security group rules, encryption settings)
3. 3
   Who patches the operating system: EC2 vs RDS?
   On EC2 you patch the guest OS yourself; on RDS, AWS patches the OS and database engine in your maintenance window, while you manage users, network access and settings

   The more managed the service, the more of the stack AWS takes on.
4. 4
   Amazon EC2
   Elastic Compute Cloud: virtual servers (instances) you launch from an image, pick a size for and pay for while they run
5. 5
   AMI
   Amazon Machine Image: the template for launching an instance, with the OS, configuration and software

   AMIs are regional; copy one to use it in another Region.
6. 6
   What does the instance type m7g.large mean?
   Family m (general purpose), generation 7, attribute g (AWS Graviton, Arm-based), size large

   Other families: t burstable, c compute optimized, r memory optimized. Attribute letters include i (Intel), a (AMD) and d (local NVMe storage).
7. 7
   EC2 pricing: On-Demand vs Savings Plans vs Spot
   On-Demand: pay by the second or hour, no commitment. Savings Plans (or Reserved Instances): commit for 1 or 3 years for up to 72% off. Spot: spare capacity at up to 90% off, but AWS can reclaim it with a two-minute warning

   Spot suits fault-tolerant work such as batch jobs, CI runners and stateless workers, not a single database server.
8. 8
   EBS vs instance store
   EBS is network-attached block storage that persists independently of the instance and supports snapshots; instance store is a disk physically attached to the host, and its data is lost when the instance stops or terminates

   An EBS volume lives in one AZ. To move it, snapshot it and create a new volume from the snapshot elsewhere.
9. 9
   EC2 user data
   A script passed at launch that runs as root on the instance’s first boot, typically to install and configure software

   bash

   #!/bin/bash
   dnf install -y nginx
   systemctl enable --now nginx

10. 10
    Stopping vs terminating an EC2 instance
    Stop: the instance shuts down, its EBS volumes are kept and you stop paying for compute. Terminate: the instance is deleted, along with its root EBS volume by default

    After a stop and start, the instance usually gets a new public IPv4 address unless it uses an Elastic IP.
11. 11
    Auto Scaling group
    Keeps a desired number of EC2 instances running across AZs, replaces unhealthy ones and scales between a minimum and maximum based on policies such as target CPU utilization
12. 12
    Amazon S3
    Simple Storage Service: object storage where each object (data plus metadata) is stored in a bucket under a key, with practically unlimited capacity

    S3 is designed for 99.999999999% (11 nines) durability. General purpose bucket names must be globally unique.
13. 13
    S3 Standard vs S3 Standard-IA
    Standard is for frequently accessed data; Standard-IA (Infrequent Access) has cheaper storage but charges per GB retrieved, with a 30-day minimum storage duration and a 128 KB minimum billable object size

    S3 One Zone-IA is cheaper still, but keeps data in a single AZ, so use it only for data you can recreate.
14. 14
    The three S3 Glacier storage classes
    Glacier Instant Retrieval: millisecond access for data read about once a quarter. Glacier Flexible Retrieval: minutes to hours. Glacier Deep Archive: the cheapest, with retrieval within 12 hours (48 for bulk)

    Minimum storage durations: 90 days for Instant and Flexible Retrieval, 180 days for Deep Archive.
15. 15
    When should you use S3 Intelligent-Tiering?
    When access patterns are unknown or change: it moves objects between access tiers automatically based on use, with no retrieval fees but a small monthly monitoring fee per object
16. 16
    S3 lifecycle rules
    Rules that automatically transition objects to cheaper storage classes or delete them after a number of days

    Example: move logs to Glacier Flexible Retrieval after 90 days and delete them after 365.
17. 17
    What does S3 versioning protect against?
    Accidental overwrites and deletes: every write keeps the previous version, and a delete only adds a delete marker that you can remove

    Once enabled, versioning can be suspended but never fully turned off.
18. 18
    S3 Block Public Access
    Bucket- and account-level settings that override any policy or ACL that would make data public; they are on by default for new buckets

    New objects are also encrypted at rest by default (SSE-S3).
19. 19
    Give someone temporary access to a private S3 object
    bash

    aws s3 presign s3://my-bucket/report.pdf --expires-in 3600

    A presigned URL carries your credentials’ permissions for a limited time (the CLI default is one hour).
20. 20
    AWS IAM
    Identity and Access Management: controls who can authenticate and what actions they may perform on which resources. It is global and free
21. 21
    Best practices for the root user
    Enable MFA, create no access keys, and don’t use it for daily work; sign in as root only for the few tasks that require it, such as changing account settings or closing the account
22. 22
    IAM user vs IAM role
    A user is an identity with long-term credentials (a password or access keys); a role has permissions but no long-term credentials and is assumed by trusted users, services or accounts, which receive temporary credentials from STS

    A role’s trust policy says who may assume it.
23. 23
    How should an application on EC2 get AWS credentials?
    Attach an IAM role to the instance (via an instance profile); the SDKs fetch temporary, automatically rotated credentials from the instance metadata service

    Never put access keys in code, AMIs or config files.
24. 24
    Policy that allows reading objects from one bucket
    json

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::my-bucket/*"
        }
      ]
    }

    Statements combine Effect, Action and Resource, plus optional Condition. s3:ListBucket applies to the bucket ARN itself, without /*.
25. 25
    How does IAM decide whether a request is allowed?
    Everything is denied by default; an explicit Allow grants access, and an explicit Deny in any applicable policy always overrides any Allow
26. 26
    Identity-based vs resource-based policies
    Identity-based policies attach to users, groups and roles; resource-based policies attach to a resource such as an S3 bucket or SQS queue and name the allowed Principal, which can be another account
27. 27
    Least privilege in IAM, in practice
    Grant only the actions and resources a job needs: start narrow (or from a managed policy), then tighten using IAM Access Analyzer and last-accessed data
28. 28
    How should people sign in to AWS accounts?
    Through IAM Identity Center (formerly AWS SSO), which gives them temporary credentials across accounts, rather than through long-lived IAM users

    The CLI supports it with aws configure sso and aws sso login.
29. 29
    Check which identity your AWS CLI is using
    bash

    aws sts get-caller-identity

    It prints the account ID and the ARN of the user or assumed role.
30. 30
    Amazon VPC
    Virtual Private Cloud: your logically isolated network in a Region, with an IP range (CIDR block) you choose; it spans all of the Region’s AZs
31. 31
    Subnet
    A range of IP addresses within a VPC that lives in exactly one AZ

    AWS reserves five addresses in every subnet: the first four and the last.
32. 32
    What makes a subnet public?
    Its route table sends internet traffic (0.0.0.0/0) to an internet gateway. A private subnet has no such route

    Instances in a public subnet also need a public IP address to be reachable.
33. 33
    NAT gateway
    Lets instances in private subnets make outbound connections to the internet, for updates or external APIs, while blocking connections initiated from outside

    It sits in a public subnet and is billed per hour and per GB processed.
34. 34
    Security group vs network ACL
    A security group attaches to instances (network interfaces), is stateful and has allow rules only. A network ACL applies to a whole subnet, is stateless (return traffic needs its own rule) and has numbered allow and deny rules

    A new security group allows no inbound traffic and all outbound traffic.
35. 35
    Allow only the app servers to reach the database on port 5432
    In the database’s security group, add an inbound rule for TCP 5432 whose source is the app servers’ security group, not an IP range

    Instances that join the app security group later are allowed automatically.
36. 36
    Amazon RDS
    Managed relational databases (PostgreSQL, MySQL, MariaDB, Oracle, SQL Server, Db2 and Aurora): AWS handles provisioning, patching, backups and failover
37. 37
    RDS Multi-AZ vs read replicas
    Multi-AZ keeps a synchronous standby in another AZ for automatic failover (high availability); read replicas are asynchronous copies that scale read traffic and can be in other Regions

    In a classic Multi-AZ instance deployment the standby serves no traffic. A read replica can be promoted to a standalone database.
38. 38
    RDS automated backups
    Daily snapshots plus transaction logs, kept for 1 to 35 days, which allow a point-in-time restore to any second in that window

    A restore always creates a new DB instance.
39. 39
    Amazon Aurora
    AWS’s MySQL- and PostgreSQL-compatible database, whose storage keeps six copies of your data across three AZs and grows automatically

    It supports up to 15 low-latency read replicas, and Aurora Serverless v2 scales capacity automatically.
40. 40
    AWS Lambda
    Serverless functions: you upload code that runs in response to events, without managing servers, and pay per request and per GB-second of run time

    Common triggers: API Gateway or function URLs, S3 events, SQS queues, EventBridge schedules and DynamoDB Streams.
41. 41
    Lambda’s maximum timeout and memory
    15 minutes (900 seconds) and 10,240 MB of memory; CPU power scales with the memory you configure

    For longer jobs, use Step Functions, ECS or AWS Batch.
42. 42
    Lambda cold start
    The extra latency when Lambda must create a new execution environment: download the code, start the runtime and run your initialization code

    Reduce it with smaller packages, provisioned concurrency or SnapStart (Java, Python and .NET).
43. 43
    A minimal Python Lambda handler
    python

    def lambda_handler(event, context):
        name = event.get("name", "world")
        return {"statusCode": 200, "body": f"Hello, {name}"}

    Create SDK clients and connections outside the handler so warm invocations reuse them.
44. 44
    Amazon CloudWatch
    AWS’s monitoring service: metrics, logs (CloudWatch Logs), alarms and dashboards for your resources and applications
45. 45
    CloudWatch alarm
    Watches a metric against a threshold over a number of periods and moves between OK, ALARM and INSUFFICIENT_DATA, triggering actions such as an SNS notification or an Auto Scaling policy
46. 46
    Does EC2 send memory and disk-space usage to CloudWatch by default?
    No. Default metrics include CPU, network and disk I/O; memory and disk-space usage need the CloudWatch agent on the instance

    Basic monitoring sends metrics every 5 minutes; detailed monitoring every minute.
47. 47
    CloudWatch vs CloudTrail
    CloudWatch monitors performance and operations (metrics, logs, alarms); CloudTrail records API calls for auditing: who did what, when and from where
48. 48
    Amazon Route 53
    AWS’s DNS service: domain registration, public and private hosted zones, health checks and routing policies

    The name refers to port 53, the port DNS uses.
49. 49
    Route 53 alias record vs CNAME
    An alias record points a name to an AWS resource such as a load balancer or CloudFront distribution and, unlike a CNAME, works at the zone apex (example.com)

    Alias queries to AWS resources are free.
50. 50
    Which Route 53 routing policy: canary 10% of traffic, nearest Region, standby site?
    Weighted for sending 10% to a new version, latency-based for the lowest-latency Region, failover (with health checks) for an active-passive standby

    Others: simple, geolocation, geoproximity, multivalue answer and IP-based.