Foundations: AWS Cloud Architecture Fundamentals

What you'll learn

• AWS Global Infrastructure

  AWS infrastructure is organized into a hierarchy designed for high availability, fault tolerance, and low latency:

• Region Selection Criteria

  | Factor | Consideration | |--------|--------------| | Compliance | Data must stay in specific geography (GDPR, data sovereignty) | | Latency | Close to target users for lowest network hops | | Service availability | Not all services lau…

• Availability Zones (AZs)

  - Each AZ = one or more discrete data centers with independent power, cooling, and physical security - AZs within a region connected via high-bandwidth, ultra-low-latency private networking - Minimum 2 AZs per region (most have 3) - Desi…

• Identity and Access Management (IAM)

  IAM is a global service (not region-scoped). It controls WHO can do WHAT on WHICH AWS resources.

• IAM Entity Hierarchy

• IAM Users and Groups

  | Concept | Rule | |---------|------| | Root account | Created by default. Never use for daily tasks. MFA required. | | Users | Represent physical persons or applications | | Groups | Contain ONLY users (not other groups) | | User member…

• IAM Policies — JSON Structure

  Evaluation logic: Explicit Deny > Explicit Allow > Implicit Deny (default)

• IAM Best Practices

  | Practice | Why | |----------|-----| | Least privilege | Only grant what's needed | | Use groups | Manage permissions at group level, not user level | | Strong password policy | Enforce length, complexity, rotation | | MFA for privilege…

• IAM Roles vs Users

  | Attribute | User | Role | |-----------|------|------| | Credentials | Permanent (access key + secret) | Temporary (STS token, expires) | | Used by | Humans, external apps | AWS services, cross-account access, federated users | | Sessio…

• Virtual Private Cloud (VPC)

  A VPC is your isolated network within AWS. Every resource you launch goes into a VPC.

• VPC Architecture

• Key VPC Concepts

  | Component | Purpose | |-----------|---------| | CIDR Block | IP address range for the VPC (e.g., 10.0.0.0/16) | | Subnet | Subdivision of VPC within a SINGLE AZ | | Internet Gateway (IGW) | Enables internet access for VPC resources | |…

• Subnet Classification

  | Type | Route to IGW? | Inbound from Internet? | Use Case | |------|---------------|----------------------|----------| | Public | Yes (0.0.0.0/0 → IGW) | Yes (if SG allows) | Load balancers, bastion hosts | | Private | No (uses NAT for…

• EC2 (Elastic Compute Cloud)

  EC2 is AWS's core compute service — virtual machines (instances) you launch in your VPC.

• Configuration Parameters

  | Parameter | Options | Notes | |-----------|---------|-------| | AMI | Amazon Linux, Ubuntu, Windows, custom | Operating system + pre-installed software | | Instance type | t2.micro through p3.16xlarge | CPU, memory, storage, network ca…

• EC2 Instance Lifecycle

  Critical behaviors: - Stop/Start → Public IP changes (private IP stays) - Stop/Start → Instance may move to different host hardware - Reboot → IPs stay same, same host - Terminate → Instance gone, EBS root deleted (unless "Delete on Term…

• Security Groups (Virtual Firewall)

  Security Groups are stateful firewalls that control traffic at the instance level.

• Rules and Behavior

  | Property | Detail | |----------|--------| | Default inbound | ALL traffic BLOCKED | | Default outbound | ALL traffic ALLOWED | | Stateful | If inbound allowed, response automatically allowed out | | Rules are ALLOW only | Cannot create…

• Rule Components

• Common Security Group Configurations

  | Service | Port | Protocol | Source | |---------|------|----------|--------| | SSH | 22 | TCP | Your IP (never 0.0.0.0/0 in production) | | HTTP | 80 | TCP | 0.0.0.0/0 (or ALB SG) | | HTTPS | 443 | TCP | 0.0.0.0/0 (or ALB SG) | | Postgr…

• Security Group References (Critical Pattern)

  Instead of allowing by IP, allow by Security Group ID: Why this matters: EC2 instances with SG-web can talk to DB regardless of their IPs. Add/remove instances freely — the security group reference automatically adapts.

• Troubleshooting Network Issues

  | Symptom | Cause | Fix | |---------|-------|-----| | Connection timeout | Security Group blocking | Add inbound rule for the port | | Connection refused | App not running / wrong port | Check app is started on correct port | | Permissio…

• EC2 IP Addressing

• Three Types of IPs

  | Type | Persistence | Scope | Cost | |------|-------------|-------|------| | Private IP | Survives stop/start | Internal VPC only | Free | | Public IP | Changes on stop/start | Internet-reachable | Free (while running) | | Elastic IP |…

• Elastic IP Constraints

  - Limit: 5 per AWS account (can request increase) - Reflects poor architecture — AWS discourages - Better alternatives: - Random public IP + DNS name (Route 53) - Load Balancer (stable DNS endpoint) - Use private IPs with NAT Gateway for…

• IPv4 Address Space

  Two different private networks CAN have overlapping private IPs — they're isolated. This becomes a challenge when connecting VPCs (peering/transit gateway must not have overlapping CIDRs). ---

• EC2 User Data (Bootstrap Scripts)

  User Data scripts automate instance initialization at first launch.

• How It Works

  | Property | Detail | |----------|--------| | Execution | Runs ONCE at first instance start only | | Runs as | Root user (full sudo privileges) | | Location | Configured in "Advanced Details" during launch | | Format | Shell script (#!/b…

• Common Use Cases

  Best practice: Keep User Data minimal. Use it to install a config management agent (Ansible, Chef, Puppet) or pull from S3/CodeDeploy for complex setups. ---

• EC2 Instance Purchase Options

• Comparison Matrix

  | Option | Discount | Commitment | Best For | |--------|----------|------------|----------| | On-Demand | 0% (baseline) | None | Short workloads, unpredictable, testing | | Reserved | Up to 75% | 1 or 3 years | Steady-state, always-on (d…

• On-Demand

  - Pay per second (Linux) or per hour (Windows) - Highest cost, zero commitment - No upfront payment - Use for: short-term, spiky, unpredictable workloads; first-time application testing

• Reserved Instances

  | Payment Option | Discount Level | |----------------|---------------| | No Upfront | Lowest discount (~36%) | | Partial Upfront | Medium discount (~50%) | | All Upfront | Highest discount (~75%) | - Can choose 1-year or 3-year term - Re…

• Spot Instances — Deep Dive

  Critical rules: - You set max price you're willing to pay - If market price exceeds your max → 2-minute warning → instance terminated/stopped/hibernated - Persistent requests: AWS automatically re-launches when price drops below your max…

• Spot Fleets

  A Spot Fleet = collection of Spot Instances + optionally On-Demand instances to meet target capacity. | Strategy | Behavior | Best For | |----------|----------|----------| | lowestPrice | Launch from cheapest pool | Cost optimization (sh…

• Dedicated Instances vs Dedicated Hosts

  | Feature | Dedicated Instance | Dedicated Host | |---------|-------------------|----------------| | Hardware isolation | Yes (no other customer) | Yes (entire physical server) | | Placement control | No (AWS decides which server) | Yes…

• EC2 Instance Type Families

• Family Quick Reference

  | Family | Optimized For | Use Cases | Example | |--------|--------------|-----------|---------| | T (burstable) | Variable CPU | Dev/test, small web apps | t3.medium | | M (general) | Balanced CPU/RAM | Web servers, app servers | m5.xla…

• Instance Naming Convention

• Burstable Instances (T2/T3) — CPU Credits

  Burstable instances provide a baseline CPU performance with the ability to burst above it using accumulated credits. How CPU credits work: | Instance | vCPUs | Baseline Performance | Credits/Hour | Max Accrued | |----------|-------|-----…

• EC2 Connectivity

• SSH Access Methods

  | Method | Platform | Requirement | |--------|----------|-------------| | Native SSH | Mac/Linux | ssh -i key.pem ec2-user@ | | PuTTY | Windows < 10 | Convert .pem to .ppk format | | OpenSSH | Windows 10+ | Same as Mac/Linux | | EC2 Inst…

• SSH Troubleshooting

  | Error | Cause | Fix | |-------|-------|-----| | Permission denied (publickey) | Wrong key or wrong username | Verify key matches launch key; use correct user (ec2-user, ubuntu, admin) | | Unprotected private key file | Key permissions…

• EC2 Instance Connect

  - Browser-based SSH through AWS Console - Uploads a temporary SSH public key (valid 60 seconds) - Still requires port 22 open in Security Group - No need to manage key pairs locally - Available for Amazon Linux 2 and Ubuntu 16.04+ ---

• Architecture Patterns

• Multi-AZ Web Application

• Security Group Layering Pattern

• Cost Optimization Architecture

  ---

• Key Decisions for System Design Interviews

• When Discussing AWS Infrastructure

  | Question | Decision Framework | |----------|-------------------| | "How will you handle AZ failure?" | Multi-AZ deployment + ALB health checks + Auto Scaling | | "How to secure the database?" | Private subnet + SG referencing app-SG +…

• Common Anti-Patterns

  | Anti-Pattern | Why It's Wrong | Better Approach | |--------------|---------------|-----------------| | Elastic IP per instance | Doesn't scale; 5 per account | Load Balancer + DNS | | SSH keys in User Data | Visible in instance metadat…