Cloud & AWS Fundamentals

Understand what cloud computing actually is, how AWS organizes its global infrastructure, and how the Shared Responsibility Model defines who secures what.

Introduction

AWS is not a product; it is a platform of over 200 services running across a global network of data centers. Before touching any individual service, you need a mental model of how that infrastructure is organized, what cloud computing actually means, and where your security responsibilities begin and end. This lesson gives you that foundation.

1. Cloud Service Models

Cloud computing is renting compute, storage, and networking capacity from a provider instead of buying and running your own hardware. The three service models describe how much the provider manages vs. how much you manage:

IaaS

Infrastructure as a Service

You manage: OS, runtime, app, data.

Examples: EC2, VPC, EBS

PaaS

Platform as a Service

You manage: app and data only.

Examples: Elastic Beanstalk, RDS, Lambda

SaaS

Software as a Service

You manage: configuration only.

Examples: AWS WorkMail, Chime, Cognito

Practical take: as a developer you will mostly work at the IaaS and PaaS layers. Lambda is PaaS: you provide a function, AWS handles everything underneath (servers, OS, runtime patching, scaling). EC2 is IaaS: you get a virtual machine and you are responsible for keeping it patched and configured.

2. AWS Global Infrastructure

AWS operates three nested tiers of physical infrastructure. Understanding these is essential for designing resilient, low-latency systems.

AWS Global Infrastructure Hierarchy

VPCRegionus-east-1SVCAZ-1aSVCAZ-1bSVCAZ-1cCFEdge Location750+ PoPs globallycontainscontainscontainsconnects to

Regions contain Availability Zones; Edge Locations sit outside regions and serve cached content

Regions

Distinct geographic areas (39 globally). Each region is independent; data stays in that region unless you explicitly move it. Choose based on latency to your users and data residency requirements.

Availability Zones

One or more physical data centers within a region, connected by low-latency private fiber. Deploying across multiple AZs is how you achieve high availability.

Edge Locations

Points of Presence (PoPs) used by CloudFront, Route 53, and Global Accelerator. Over 750 PoPs across 100+ cities in 50+ countries, placing cached content milliseconds away from end users.

3. The Shared Responsibility Model

When a security breach occurs, the question of "who is responsible?" is answered by this model. AWS secures the infrastructure; you secure what you put on it.

AWS Secures
  • Physical data center facilities and hardware
  • Network infrastructure (routers, switches, cabling)
  • Hypervisors and virtualization layer
  • Managed service software (e.g., RDS engine patching)
  • Global backbone network
You Secure
  • IAM users, roles, and permissions
  • EC2 OS patching and hardening
  • Application code and its dependencies
  • Data encryption (at rest and in transit)
  • Network configuration (security groups, NACLs)

Key insight: with managed services you take on less responsibility. A misconfigured EC2 security group is your fault; an unpatched RDS engine is AWS's fault. This is why managed services reduce your operational burden but don't eliminate your security obligations.

4. The AWS CLI

The AWS CLI lets you interact with every AWS service from your terminal. Throughout this course you will use it alongside the console. Install it first:

# macOS
brew install awscli

# Linux (official installer, recommended over apt, always gets CLI v2)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Linux (apt may ship an older CLI v1 build)
sudo apt install awscli

# Verify
aws --version
# aws-cli/2.x.x Python/3.12.0 ...

Configure it with your credentials. For learning, access keys work. In production, use IAM roles instead:

# Configure your credentials interactively
aws configure

# AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
# AWS Secret Access Key [None]: wJalrXUtn...
# Default region name [None]: us-east-1
# Default output format [None]: json

# Verify by listing your S3 buckets
aws s3 ls

# Check your caller identity
aws sts get-caller-identity

The CLI uses the region you configured by default. You can override it per command or via an environment variable:

# List all AWS regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output table

# Switch region for a single command
aws s3 ls --region eu-west-1

# Set a default region via environment variable
export AWS_DEFAULT_REGION=us-west-2

Tip: use --output json, --output table, or --output text to control CLI output format. The --query flag accepts JMESPath expressions to filter results, which is invaluable when scripting.

Key Takeaways

  • IaaS vs PaaS vs SaaS - the further up the stack, the less you manage and the faster you move
  • Regions contain AZs - multi-AZ deployments give you resilience against data center failures
  • Edge Locations - used by CloudFront to cache content close to users, separate from region AZs
  • Shared Responsibility - AWS secures the infrastructure; you secure your configuration, code, and data
  • Managed services shift responsibility - RDS OS patching is AWS's job; your EC2 OS patching is yours
  • AWS CLI - aws configure once, then every service is a command away
AWS FundamentalsLesson 1