AWS Core Concepts

The AWS Mental Model

Before deploying anything, let's build a mental model of how AWS works. This will save you hours of confusion later.

Regions and Availability Zones

What is a Region?

A region is a geographic area containing AWS data centers. Each region is completely independent - your resources in us-east-1 (Virginia) don't automatically exist in eu-west-1 (Ireland).

World Map of AWS Regions (simplified)
┌─────────────────────────────────────────────────────────────┐
│                                                             │
│   us-west-1 ●        us-east-1 ●    eu-west-1 ●            │
│   (California)       (Virginia)     (Ireland)              │
│                                                             │
│   us-west-2 ●        us-east-2 ●    eu-central-1 ●         │
│   (Oregon)           (Ohio)         (Frankfurt)            │
│                                                             │
│                      sa-east-1 ●    ap-northeast-1 ●       │
│                      (São Paulo)    (Tokyo)                │
│                                                             │
└─────────────────────────────────────────────────────────────┘

Choosing a Region

What are Availability Zones?

Each region has multiple Availability Zones (AZs) - physically separate data centers with independent power and networking.

Region: us-east-1
├── us-east-1a (AZ 1)
├── us-east-1b (AZ 2)
├── us-east-1c (AZ 3)
├── us-east-1d (AZ 4)
├── us-east-1e (AZ 5)
└── us-east-1f (AZ 6)

For high availability, deploy resources across multiple AZs. If one data center fails, others keep running.

Core AWS Services

AWS has 200+ services. Here are the ones you'll actually use:

Compute (Running Your Code)

Storage

Database

Networking

Container Services

IAM: The Permission System

IAM (Identity and Access Management) controls who can do what to which resources.

Key Concepts

IAM Hierarchy
├── Users (people)
├── Groups (collections of users)
├── Roles (temporary permissions for services)
└── Policies (permission documents)

Users vs Roles

Understanding Policies

Policies are JSON documents that define permissions:

json
Copy
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

This policy says: "Allow reading objects from my-bucket"

Common Built-in Policies

ARNs: How AWS Identifies Resources

Every AWS resource has an ARN (Amazon Resource Name) - a unique identifier.

arn:aws:service:region:account:resource

Examples:

arn:aws:s3:::my-bucket              # S3 bucket (global, no region)
arn:aws:ec2:us-east-1:123456789:instance/i-1234567890abcdef0
arn:aws:iam::123456789:user/admin   # IAM user (global, no region)

You'll see ARNs in error messages, policies, and CLI output. They're how you precisely identify what you're working with.

Security Groups: The Firewall

Security groups control what network traffic can reach your resources.

Security Group: web-server
┌──────────────────────────────────────┐
│ Inbound Rules                        │
├──────────────────────────────────────┤
│ Port 80 (HTTP)   ← From: 0.0.0.0/0  │ (anyone)
│ Port 443 (HTTPS) ← From: 0.0.0.0/0  │ (anyone)
│ Port 22 (SSH)    ← From: 1.2.3.4/32 │ (your IP only)
└──────────────────────────────────────┘
┌──────────────────────────────────────┐
│ Outbound Rules                       │
├──────────────────────────────────────┤
│ All traffic      → To: 0.0.0.0/0    │ (anywhere)
└──────────────────────────────────────┘

VPC: Your Private Network

A VPC (Virtual Private Cloud) is your isolated network within AWS.

VPC: 10.0.0.0/16
├── Public Subnet: 10.0.1.0/24 (has internet access)
│   ├── Web Server (public IP)
│   └── NAT Gateway
│
└── Private Subnet: 10.0.2.0/24 (no direct internet)
    ├── Database (no public IP)
    └── App Server (no public IP)

Default VPC

AWS creates a default VPC in each region. For learning, this is fine. For production, create custom VPCs with proper subnet design.

How Services Connect

Here's how a typical web application flows through AWS services:

User Request Flow
─────────────────

Internet
    │
    ▼
Route 53 (DNS: myapp.com → IP address)
    │
    ▼
CloudFront (CDN - caches static content)
    │
    ▼
Application Load Balancer (distributes traffic)
    │
    ├──────────────┬──────────────┐
    ▼              ▼              ▼
  ECS Task 1    ECS Task 2    ECS Task 3
  (Container)   (Container)   (Container)
    │              │              │
    └──────────────┴──────────────┘
                   │
                   ▼
              RDS Database
              (PostgreSQL)

Cost Model: How You're Charged

AWS charges for what you use. Key pricing models:

Free Tier Highlights

Deployment Options Compared

Now that you understand the pieces, here's how they fit together for deployment:

Quick Reference: AWS CLI for Exploration

bash
Copy
# Explore regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output table

# List availability zones in your region
aws ec2 describe-availability-zones --query 'AvailabilityZones[].ZoneName'

# See your VPCs
aws ec2 describe-vpcs --query 'Vpcs[].{ID:VpcId,CIDR:CidrBlock,Default:IsDefault}'

# List security groups
aws ec2 describe-security-groups --query 'SecurityGroups[].{Name:GroupName,ID:GroupId}'

# Check your IAM user
aws iam get-user

What's Next?

You now have a mental map of AWS. In the next lesson, we'll use App Runner to deploy your first container - the fastest path from code to running application.