beginnerintermediateadvanced

AWS · Fundamentals

AWS Fundamentals

The vocabulary and the one security model every later section assumes you already have

Shared responsibilityAWS secures infrastructure; you secure configuration
Regional by defaulta handful of services (IAM, Route 53) are global instead
One account, one billan Organization groups several accounts together
Five pricing dimensionscompute, storage, requests, transfer, provisioned capacity

1.AWS as managed infrastructure and platform services

Each AWS service takes over one piece of operational work — racking a server, patching a database, replicating storage — so you design against a promise ("durable," "scales automatically") instead of building it yourself.

Command

text

Unmanaged: you run it        Managed: AWS runs it, you configure it
EC2 instance you patch   →   RDS database AWS patches
Self-hosted queue        →   SQS, always available
Servers behind your LB   →   Lambda, no servers at all

Ask what promise a service makes ("11 nines of durability," "scales to zero") before asking what it is called — the promise is what you are actually buying.

2.Account, Region, AZ, edge location, and the other core vocabulary

An AWS account is your billing and resource boundary. You work in one Region at a time, a Region is built from several isolated Availability Zones, and every action — Console, CLI, or SDK — is really one API call underneath.

Key features

One account = one bill and one resource boundary
A Region is a set of Availability Zones, physically separate
Global services (IAM) span every Region; most services do not
Console, CLI and SDKs all call the same underlying API
A service quota is a per-account, per-Region ceiling

The building blocks, smallest to largest scope

The building blocks, smallest to largest scope
Term	Scope	What it actually is
Resource	One object	A specific VPC, bucket, or instance — has its own ARN
Availability Zone (AZ)	One data center cluster	Isolated power/network from other AZs in the Region
Region	A geographic area	A group of AZs, e.g. us-east-1 — most services live here
Edge location	Near the end user	CloudFront/Route 53 point of presence, not a full Region
Account	Billing + resource boundary	Everything you create belongs to exactly one account
Organization	A group of accounts	Consolidated billing and account-wide guardrails

What contains what

Organization

A group of accounts under one management account.

Account

Your billing and resource boundary.

Region

A geographic area — most services are Regional.

Availability Zone

One or more physically isolated data centers.

Resource

The actual thing — an instance, a bucket, a table.

Command

text

Console   → click, sees the same API
AWS CLI   → aws <service> <action> --region <region>
SDK       → boto3.client("ec2", region_name="us-east-1")

Most services are Regional and invisible outside the Region they were created in; a small named set (IAM, Route 53, CloudFront) is global instead.

3.The shared responsibility model

AWS is responsible for security OF the cloud — data centers, hardware, network, host software. You are responsible for security IN the cloud — how you configure each service, who has access, and whether your data is encrypted.

Key features

AWS secures the infrastructure; you secure your configuration
A public S3 bucket is a customer misconfiguration, not an AWS breach
The split moves with the service — Lambda hides more than EC2 does
IAM policies, encryption, and network rules are always your job
AWS never sees this as optional — it applies to every service, always

Where the line sits, and how it moves

AWS: security OF the cloud

Physical facilities, power, cooling
The hypervisor and host infrastructure
Global network backbone
Managed-service internals (e.g. RDS engine patching)

You: security IN the cloud

IAM: who can do what
Data classification and encryption choices
Network configuration — security groups, NACLs
Application-level security and dependency patching

Command

text

AWS's side                    Your side
─────────────────             ─────────────────
Physical data centers         IAM users, roles, policies
Host OS and virtualization    Guest OS patches (on EC2)
Network infrastructure        Security groups, NACLs
Managed-service durability    Data you choose to store there

AWS secures the infrastructure UNDER every service. Configuration, identity, and data ON that service are always yours — "managed" never means "secured for me."

4.How AWS pricing dimensions generally work

AWS bills are built from a handful of repeating dimensions — compute time, storage, requests, data leaving AWS, and whether you paid for capacity up front or per use. Nearly every service is some combination of these.

The pricing dimensions, and where each shows up

The pricing dimensions, and where each shows up
Dimension	Billed by	Example
Compute time	Instance-hours or invocation duration	EC2 per second while running, Lambda per millisecond
Storage	GB stored per month	S3 storage class, EBS volume size
Requests	Per API call or invocation	S3 GET/PUT requests, Lambda invocations
Data transfer	GB moved, mostly outbound	Data leaving a Region to the internet
Provisioned capacity	Reserved ahead of use, cheaper per unit	RDS instance class, DynamoDB provisioned throughput
Managed-service tier	Feature level, not just usage	Support plans, Aurora vs standard RDS

Command

text

Pay-as-you-go   → billed for exactly what ran, no commitment
Provisioned     → pay ahead for capacity, cheaper per unit if fully used
Free tier       → a capped monthly allowance on many services, first 12 months or always-free

Data transfer OUT to the internet is billed on most services; data transfer IN is usually free — avoiding egress is usually cheaper, not just faster.

5.Reading AWS documentation, quotas, and pricing pages

AWS has hundreds of services and no engineer memorizes them all — the actual skill is going straight to a service's documentation, its quota page, and its pricing page, and reading exactly the part that answers the question in front of you.

Command

text

Docs page      → what a service does and how its API is shaped
Quota page     → per-account, per-Region ceilings (often raisable via a request)
Pricing page   → which dimensions this specific service bills on
Console limits → what you'll actually hit first, day to day

A quota is not a hard ceiling on what AWS can do — most are a default that can be raised by request before you hit it in production, not after.

Spotted a mistake on this page? Tell us.

Read Sheet