# Lesson 2: Meet AWS — The 11 Building Blocks Behind (Almost) Everything

> **Module:** Cloud Fundamentals · **Level:** Beginner · **Time:** ~22 min read + quiz
> **Prereq:** Lesson 1 (service models, deployment models, providers)
> **You'll be able to:** explain AWS's global infrastructure, identify the 11 core services and what problem each solves, apply the shared responsibility model, avoid the classic first-month billing traps, and describe the CLF-C02 → SAA-C03 certification path.

---

## 1. One whiteboard, one startup

Here's a secret that demystifies all of AWS: strip away the 200+ service catalog, and almost every application you've ever used runs on the same ~11 building blocks. So instead of touring a catalog, we're going to build something.

Meet **Shutterbird** — a fictional photo-sharing startup. By the end of this lesson its whole architecture fits on one diagram, and you'll be able to read it like an engineer.

## 2. Where AWS physically lives

Three levels, one mental model — country, city, corner store:

- **Regions** (the countries): independent clusters of infrastructure around the world (us-east-1, eu-west-2...). You choose based on user latency, data-residency laws, and price — the same service costs different amounts in different regions.
- **Availability Zones** (the cities): each region contains multiple physically separate data centers with independent power and networking. One AZ can fail without taking the others. **This is the unit of high availability** — remember "Multi-AZ"; it returns shortly.
- **Edge locations** (the corner stores): hundreds of small caching sites far closer to users than any region. Content gets stored near your users so it loads fast. This is where CloudFront lives.

## 3. Building Shutterbird: the core 11

**Need: run the application code.** → **EC2** (Elastic Compute Cloud). Virtual servers — you pick the size, OS, and pay by the hour/second. Three ways to pay: *on-demand* (flexible, priciest), *reserved/savings plans* (commit 1–3 years, save big), *spot* (spare capacity, up to ~90% off, can be reclaimed — fine for interruptible work). Shutterbird starts with one on-demand instance.

**Need: a private network so our servers aren't naked on the internet.** → **VPC** (Virtual Private Cloud). Your own fenced-off slice of AWS networking: *public subnets* for things that face the internet (web servers), *private subnets* for things that shouldn't (databases). Security groups act as per-resource firewalls.

**Need: survive traffic spikes and server failures.** → **Elastic Load Balancing + Auto Scaling.** The load balancer spreads traffic across multiple EC2 instances in *multiple AZs* (there's Multi-AZ working). Auto Scaling adds instances when traffic surges and removes them when it fades — elasticity from Lesson 1, made real.

**Need: store millions of photos.** → **S3** (Simple Storage Service). Object storage: files in buckets, effectively unlimited, famously durable (the "eleven nines" design). Storage classes trade access speed for cost — frequently viewed photos in Standard, old ones in cheaper infrequent-access or archival tiers.

**Need: store user accounts and comments.** → **RDS** (Relational Database Service). Managed SQL databases (PostgreSQL, MySQL...) — AWS handles patching, backups, and failover. Turn on *Multi-AZ* and a standby copy in another AZ takes over automatically if the primary dies.

**Need: blazing-fast likes and view counts.** → **DynamoDB.** AWS's serverless NoSQL database — single-digit-millisecond lookups at any scale. The classic interview contrast: **RDS** for structured data and complex queries; **DynamoDB** for simple lookups at massive speed and scale.

**Need: make a thumbnail every time a photo uploads.** → **Lambda.** Serverless compute — upload triggers your function, it runs, you pay for the milliseconds used, and there's no server to manage. (There is a server. You just never think about it.)

**Need: know when things break.** → **CloudWatch.** Metrics, logs, dashboards, alarms — CPU spikes, error rates, and (foreshadowing) your bill.

**Need: fast worldwide + a real domain.** → **CloudFront + Route 53.** CloudFront caches content at those edge locations so a user in Singapore doesn't fetch photos from Virginia. Route 53 is DNS — shutterbird.com points at all of the above, with routing policies for failover and geography.

**Need: control who can touch what.** → **IAM** (Identity and Access Management). Users, groups, roles, and policies deciding exactly who (and what — services get roles too) can do exactly what. The discipline you already know from the terminal lesson applies verbatim: least privilege.

**The payoff:** diagram in the cheat sheet — users → Route 53 → CloudFront → load balancer → EC2 (Auto Scaling, multi-AZ, in a VPC) → RDS + DynamoDB, S3 for photos, Lambda for thumbnails, CloudWatch watching, IAM gating everything. That's a real production architecture. You can now read it.

## 4. The shared responsibility model (the most-tested idea on the exam)

**AWS is responsible for security OF the cloud. You are responsible for security IN the cloud.**

AWS handles: physical data centers, hardware, the hypervisor, the global network. You handle: your data, access management, and configuration. The split *moves* depending on the service:

| | EC2 (IaaS) | RDS (managed) | S3 (fully managed) |
|---|---|---|---|
| Hardware & facility | AWS | AWS | AWS |
| OS patching | **You** | AWS | AWS |
| Database software | **You** | AWS | AWS |
| Data, access policy, encryption choices | **You** | **You** | **You** |

The more managed the service, the more AWS carries — but *your data and who can access it is always yours*. Most real-world "cloud breaches" are misconfigurations on the customer side of this line (remember Lesson 1's security surprise?).

Two first-day non-negotiables: **lock the root user** (the all-powerful account you signed up with — enable MFA, then stop using it; create IAM users for daily work) and **MFA everywhere**.

## 5. Free tier and the art of not getting a surprise bill

AWS gives new accounts free usage — historically a mix of 12-month allowances (e.g., EC2/RDS hours), always-free tiers (e.g., Lambda's monthly grant), and short trials. *The exact structure has changed over time (newer accounts use a credits-based model), so check the current free-tier page when you create your account.*

What hasn't changed: the three classic bill-shock traps.

1. **The forgotten instance** — resources bill until *terminated*, not until you stop thinking about them.
2. **Data transfer out (egress) and NAT gateways** — data *into* AWS is free; data *out* costs; NAT gateways bill hourly + per GB. These two surprise more beginners than anything else.
3. **Silent expiry** — 12-month allowances end quietly; the resources keep running, now billed.

**The first-day ritual:** before building anything, create a billing alarm (CloudWatch again) that emails you when the month's forecast passes a few dollars. Sixty seconds of setup; complete peace of mind while you learn.

## 6. The certification path

- **CLF-C02 — AWS Certified Cloud Practitioner.** The entry cert. Four domains: Cloud Concepts (24%), Security & Compliance (30% — note that weight; it's why Section 4 exists), Cloud Technology & Services (34% — today's 11 services are its backbone), Billing & Support (12%). ~65 questions, 90 minutes, 700/1000 to pass, ~$100. *Verify current details on the official page — logistics drift.*
- **SAA-C03 — Solutions Architect Associate.** The six-figure-signal cert; scenario-based architecture questions. Everything today is its foundation.
- **Who should skip CLF?** If you have real IT experience and can commit to a longer runway, going straight to SAA is legitimate — CLF's value is confidence, vocabulary, and a win on the résumé while you build toward SAA.

---

## Recap

AWS is regions → AZs → edge locations (country, city, corner store). Eleven services build a real product: EC2 compute inside a VPC, scaled by ELB + Auto Scaling; S3 for objects, RDS for relational, DynamoDB for fast NoSQL; Lambda for serverless events; CloudWatch for visibility; CloudFront + Route 53 for delivery; IAM over everything. AWS secures the cloud, you secure what's in it. Set a billing alarm before you build. CLF-C02 first (or SAA if experienced).

**Next lesson:** hands-on — create your account safely (root + MFA), set the billing alarm, launch your first EC2 instance and S3 bucket. Screenshots become your first portfolio artifacts.

---

## Quiz

**1. Shutterbird wants its database to survive a data-center failure automatically. Which feature?**
a) Spot instances b) RDS Multi-AZ ✅ c) Edge locations d) S3 storage classes
*Multi-AZ keeps a standby in a separate availability zone with automatic failover.*

**2. A user in Tokyo loads photos quickly even though Shutterbird runs in Virginia. Which service most directly explains this?**
a) EC2 b) Route 53 c) CloudFront ✅ d) IAM
*CloudFront caches content at edge locations near users.*

**3. On an EC2 instance, who patches the operating system?**
a) AWS b) You ✅ c) Nobody — it's automatic d) The hypervisor
*IaaS: AWS runs the hardware and hypervisor; the guest OS is yours.*

**4. Which workload fits Lambda best?**
a) A database needing constant uptime b) A short task triggered by each file upload ✅ c) A desktop application d) A long-running game server
*Event-driven, short-lived, pay-per-execution.*

**5. What should you configure FIRST in a brand-new AWS account?**
a) An EC2 instance b) A VPC c) Root-user MFA + a billing alarm ✅ d) A domain in Route 53
*Security of the root account and cost visibility come before any resources.*

**6. Complex queries across structured, related data → ___ ; millisecond key-value lookups at huge scale → ___**
a) DynamoDB / RDS b) RDS / DynamoDB ✅ c) S3 / EBS d) EC2 / Lambda
*The classic pairing: relational for relationships, DynamoDB for speed-at-scale simplicity.*