Module: Cloud Fundamentals · Level: Beginner · Time: ~22 min read + quiz Prereq: Lesson 1 (service models, deployment models, providers) You'll be able to: explain AWS's global infrastructure, identify the 11 core services and what problem each solves, apply the shared responsibility model, avoid the classic first-month billing traps, and describe the CLF-C02 → SAA-C03 certification path.
1. One whiteboard, one startup
Here's a secret that demystifies all of AWS: strip away the 200+ service catalog, and almost every application you've ever used runs on the same ~11 building blocks. So instead of touring a catalog, we're going to build something.
Meet Shutterbird — a fictional photo-sharing startup. By the end of this lesson its whole architecture fits on one diagram, and you'll be able to read it like an engineer.
2. Where AWS physically lives
Three levels, one mental model — country, city, corner store:
- Regions (the countries): independent clusters of infrastructure around the world (us-east-1, eu-west-2...). You choose based on user latency, data-residency laws, and price — the same service costs different amounts in different regions.
- Availability Zones (the cities): each region contains multiple physically separate data centers with independent power and networking. One AZ can fail without taking the others. This is the unit of high availability — remember "Multi-AZ"; it returns shortly.
- Edge locations (the corner stores): hundreds of small caching sites far closer to users than any region. Content gets stored near your users so it loads fast. This is where CloudFront lives.
3. Building Shutterbird: the core 11
Need: run the application code. → EC2 (Elastic Compute Cloud). Virtual servers — you pick the size, OS, and pay by the hour/second. Three ways to pay: on-demand (flexible, priciest), reserved/savings plans (commit 1–3 years, save big), spot (spare capacity, up to ~90% off, can be reclaimed — fine for interruptible work). Shutterbird starts with one on-demand instance.
Need: a private network so our servers aren't naked on the internet. → VPC (Virtual Private Cloud). Your own fenced-off slice of AWS networking: public subnets for things that face the internet (web servers), private subnets for things that shouldn't (databases). Security groups act as per-resource firewalls.
Need: survive traffic spikes and server failures. → Elastic Load Balancing + Auto Scaling. The load balancer spreads traffic across multiple EC2 instances in multiple AZs (there's Multi-AZ working). Auto Scaling adds instances when traffic surges and removes them when it fades — elasticity from Lesson 1, made real.
Need: store millions of photos. → S3 (Simple Storage Service). Object storage: files in buckets, effectively unlimited, famously durable (the "eleven nines" design). Storage classes trade access speed for cost — frequently viewed photos in Standard, old ones in cheaper infrequent-access or archival tiers.
Need: store user accounts and comments. → RDS (Relational Database Service). Managed SQL databases (PostgreSQL, MySQL...) — AWS handles patching, backups, and failover. Turn on Multi-AZ and a standby copy in another AZ takes over automatically if the primary dies.
Need: blazing-fast likes and view counts. → DynamoDB. AWS's serverless NoSQL database — single-digit-millisecond lookups at any scale. The classic interview contrast: RDS for structured data and complex queries; DynamoDB for simple lookups at massive speed and scale.
Need: make a thumbnail every time a photo uploads. → Lambda. Serverless compute — upload triggers your function, it runs, you pay for the milliseconds used, and there's no server to manage. (There is a server. You just never think about it.)
Need: know when things break. → CloudWatch. Metrics, logs, dashboards, alarms — CPU spikes, error rates, and (foreshadowing) your bill.
Need: fast worldwide + a real domain. → CloudFront + Route 53. CloudFront caches content at those edge locations so a user in Singapore doesn't fetch photos from Virginia. Route 53 is DNS — shutterbird.com points at all of the above, with routing policies for failover and geography.
Need: control who can touch what. → IAM (Identity and Access Management). Users, groups, roles, and policies deciding exactly who (and what — services get roles too) can do exactly what. The discipline you already know from the terminal lesson applies verbatim: least privilege.
The payoff: diagram in the cheat sheet — users → Route 53 → CloudFront → load balancer → EC2 (Auto Scaling, multi-AZ, in a VPC) → RDS + DynamoDB, S3 for photos, Lambda for thumbnails, CloudWatch watching, IAM gating everything. That's a real production architecture. You can now read it.
4. The shared responsibility model (the most-tested idea on the exam)
AWS is responsible for security OF the cloud. You are responsible for security IN the cloud.
AWS handles: physical data centers, hardware, the hypervisor, the global network. You handle: your data, access management, and configuration. The split moves depending on the service:
| EC2 (IaaS) | RDS (managed) | S3 (fully managed) | |
|---|---|---|---|
| Hardware & facility | AWS | AWS | AWS |
| OS patching | You | AWS | AWS |
| Database software | You | AWS | AWS |
| Data, access policy, encryption choices | You | You | You |
The more managed the service, the more AWS carries — but your data and who can access it is always yours. Most real-world "cloud breaches" are misconfigurations on the customer side of this line (remember Lesson 1's security surprise?).
Two first-day non-negotiables: lock the root user (the all-powerful account you signed up with — enable MFA, then stop using it; create IAM users for daily work) and MFA everywhere.
5. Free tier and the art of not getting a surprise bill
AWS gives new accounts free usage — historically a mix of 12-month allowances (e.g., EC2/RDS hours), always-free tiers (e.g., Lambda's monthly grant), and short trials. The exact structure has changed over time (newer accounts use a credits-based model), so check the current free-tier page when you create your account.
What hasn't changed: the three classic bill-shock traps.
- The forgotten instance — resources bill until terminated, not until you stop thinking about them.
- Data transfer out (egress) and NAT gateways — data into AWS is free; data out costs; NAT gateways bill hourly + per GB. These two surprise more beginners than anything else.
- Silent expiry — 12-month allowances end quietly; the resources keep running, now billed.
The first-day ritual: before building anything, create a billing alarm (CloudWatch again) that emails you when the month's forecast passes a few dollars. Sixty seconds of setup; complete peace of mind while you learn.
6. The certification path
- CLF-C02 — AWS Certified Cloud Practitioner. The entry cert. Four domains: Cloud Concepts (24%), Security & Compliance (30% — note that weight; it's why Section 4 exists), Cloud Technology & Services (34% — today's 11 services are its backbone), Billing & Support (12%). ~65 questions, 90 minutes, 700/1000 to pass, ~$100. Verify current details on the official page — logistics drift.
- SAA-C03 — Solutions Architect Associate. The six-figure-signal cert; scenario-based architecture questions. Everything today is its foundation.
- Who should skip CLF? If you have real IT experience and can commit to a longer runway, going straight to SAA is legitimate — CLF's value is confidence, vocabulary, and a win on the résumé while you build toward SAA.
Recap
AWS is regions → AZs → edge locations (country, city, corner store). Eleven services build a real product: EC2 compute inside a VPC, scaled by ELB + Auto Scaling; S3 for objects, RDS for relational, DynamoDB for fast NoSQL; Lambda for serverless events; CloudWatch for visibility; CloudFront + Route 53 for delivery; IAM over everything. AWS secures the cloud, you secure what's in it. Set a billing alarm before you build. CLF-C02 first (or SAA if experienced).
Next lesson: hands-on — create your account safely (root + MFA), set the billing alarm, launch your first EC2 instance and S3 bucket. Screenshots become your first portfolio artifacts.
Quiz
1. Shutterbird wants its database to survive a data-center failure automatically. Which feature? a) Spot instances b) RDS Multi-AZ ✅ c) Edge locations d) S3 storage classes Multi-AZ keeps a standby in a separate availability zone with automatic failover.
2. A user in Tokyo loads photos quickly even though Shutterbird runs in Virginia. Which service most directly explains this? a) EC2 b) Route 53 c) CloudFront ✅ d) IAM CloudFront caches content at edge locations near users.
3. On an EC2 instance, who patches the operating system? a) AWS b) You ✅ c) Nobody — it's automatic d) The hypervisor IaaS: AWS runs the hardware and hypervisor; the guest OS is yours.
4. Which workload fits Lambda best? a) A database needing constant uptime b) A short task triggered by each file upload ✅ c) A desktop application d) A long-running game server Event-driven, short-lived, pay-per-execution.
5. What should you configure FIRST in a brand-new AWS account? a) An EC2 instance b) A VPC c) Root-user MFA + a billing alarm ✅ d) A domain in Route 53 Security of the root account and cost visibility come before any resources.
6. Complex queries across structured, related data → ___ ; millisecond key-value lookups at huge scale → ___ a) DynamoDB / RDS b) RDS / DynamoDB ✅ c) S3 / EBS d) EC2 / Lambda The classic pairing: relational for relationships, DynamoDB for speed-at-scale simplicity.