Most AWS material fails in one of two directions. Marketing pages tell you a service is scalable,
durable, and cost-effective without ever telling you how it works or when it's the wrong choice.
Reference documentation tells you every parameter of every API call without ever telling you why you'd
reach for it. This article is an attempt at the missing middle: plain-English intuition first, then
the precise mechanics underneath, then the trade-offs nobody advertises.
It's written for a working engineer — someone who will have to operate the thing, defend the design in
a review, explain the bill, and get paged when it breaks. Every term is defined the first time it
appears. Every feature comes with the conditions under which it helps and the conditions under which
it hurts. Every hands-on section shows the same task three ways, and every service gets a real
deployment path rather than a console click-through.
Start here
Foundations — the AWS platform model comes before any service.
Five things are true of every AWS service: the account is the real isolation and billing boundary
(not the VPC, not the region); every tool from the console to Terraform is a client of the same
regional API; IAM is one evaluation algorithm rather than per-service permissions; regions and
Availability Zones behave in specific, non-obvious ways; and ARNs, tags, and Service Quotas are the
connective tissue everything else assumes. Read those once and every service afterwards makes more
sense — skip them and you'll keep meeting the same confusions dressed in different service names.
How to read this
Each AWS service is a topic. Every topic is broken into the same nine sub-topics, in a
deliberate order: why it exists → how it works → how to run it → how to ship it → how to run
it well → prove you understood it.
| # |
Sub-topic |
The question it answers |
| 1 |
What & Why |
What is it, and what problem does it kill? |
| 2 |
Core Concepts |
What are its primitives and vocabulary? |
| 3 |
Architecture |
How does it actually work under the hood? |
| 4 |
Getting Started |
How do I stand up a minimal working example? |
| 5 |
Deployment |
How do I ship it repeatably, across environments? |
| 6 |
Integrations |
How does it wire into the rest of AWS? |
| 7 |
Production |
Security, cost, scaling, observability, reliability |
| 8 |
Interview Questions |
Can I defend my understanding? |
| 9 |
Glossary & Cheatsheet |
The 10-second lookup |
Read a topic top to bottom the first time. After that, jump straight to the sub-topic that answers
your question — each one stands on its own and links to the others where they connect.
Sub-topics 4 and 5 do different jobs. Sub-topic 4 is learning: the smallest thing that proves the
service works, thrown away five minutes later. Sub-topic 5 is shipping: the same resource
parameterised, version-controlled, reviewed, promoted through environments, and reversible.
Infrastructure-as-code order
Every Deployment sub-topic uses the same tool ranking, so the treatment stays consistent from topic to
topic:
| Rank |
Tool |
Role |
| 1 |
Terraform |
Primary — the full worked example, every time |
| 2 |
Ansible |
Secondary — post-provision configuration and day-2 operations (amazon.aws collection) |
| 3 |
CloudFormation / CDK |
Third — the AWS-native equivalent, in a collapsible block |
Deployment also covers remote state and locking, CI/CD wiring with OIDC role assumption,
dev/staging/prod strategy, drift detection, and rollback with an explicit blast-radius discussion.
Depth varies by service
There are hundreds of AWS services and only a few dozen you'll meet on most architectures. Depth is
allocated accordingly, so nothing is over- or under-built:
| Depth |
What you get |
| Full |
All nine sub-topics, as separate pages — the services on nearly every architecture |
| Overview |
A single page: what it is, its core concepts, how to provision it with Terraform, and interview questions |
| Summary |
A single page: a definition and an honest "when you'd use it" |
Status: 📋 Planned · 🚧 In progress · ✅ Available
A note on numbers. Concepts, architecture, and trade-offs are durable; quotas, prices, region
availability, and default values are not. Anywhere a volatile figure appears it is either labelled
"as of writing" or flagged ⚠️ verify against current AWS docs. Treat those as prompts to check,
not as facts to memorise.
Contents
| Topic |
Depth |
Status |
|
| Foundations — accounts, the API model, IAM, regions, ARNs and quotas |
Full |
✅ Available |
Read → |
Compute
| Topic |
Depth |
Status |
|
| EC2 (+ Auto Scaling) |
Full |
✅ Available |
Read → |
| Lambda |
Full |
📋 Planned |
— |
| ECS |
Full |
📋 Planned |
— |
| Fargate |
Full |
📋 Planned |
— |
| EKS |
Full |
📋 Planned |
— |
| ECR |
Full |
📋 Planned |
— |
| Elastic Beanstalk |
Overview |
📋 Planned |
— |
| Lightsail |
Overview |
📋 Planned |
— |
| Batch |
Overview |
📋 Planned |
— |
| App Runner |
Overview |
📋 Planned |
— |
| Outposts |
Summary |
📋 Planned |
— |
| Wavelength |
Summary |
📋 Planned |
— |
| Local Zones |
Summary |
📋 Planned |
— |
| Serverless Application Repository |
Summary |
📋 Planned |
— |
Storage
| Topic |
Depth |
Status |
|
| S3 |
Full |
📋 Planned |
— |
| EBS |
Full |
📋 Planned |
— |
| EFS |
Overview |
📋 Planned |
— |
| S3 Glacier |
Overview |
📋 Planned |
— |
| AWS Backup |
Overview |
📋 Planned |
— |
| FSx |
Summary |
📋 Planned |
— |
| Storage Gateway |
Summary |
📋 Planned |
— |
| Snow Family |
Summary |
📋 Planned |
— |
| Elastic Disaster Recovery |
Summary |
📋 Planned |
— |
Databases
| Topic |
Depth |
Status |
|
| RDS |
Full |
📋 Planned |
— |
| Aurora |
Full |
📋 Planned |
— |
| DynamoDB |
Full |
📋 Planned |
— |
| ElastiCache |
Full |
📋 Planned |
— |
| Redshift |
Overview |
📋 Planned |
— |
| MemoryDB |
Summary |
📋 Planned |
— |
| DocumentDB |
Summary |
📋 Planned |
— |
| Neptune |
Summary |
📋 Planned |
— |
| Keyspaces |
Summary |
📋 Planned |
— |
| Timestream |
Summary |
📋 Planned |
— |
| QLDB (retiring — verify status) |
Summary |
📋 Planned |
— |
Networking & Content Delivery
| Topic |
Depth |
Status |
|
| VPC |
Full |
📋 Planned |
— |
| Route 53 |
Full |
📋 Planned |
— |
| CloudFront |
Full |
📋 Planned |
— |
| API Gateway |
Full |
📋 Planned |
— |
| Elastic Load Balancing |
Full |
📋 Planned |
— |
| Transit Gateway |
Overview |
📋 Planned |
— |
| Direct Connect |
Overview |
📋 Planned |
— |
| PrivateLink |
Overview |
📋 Planned |
— |
| Site-to-Site VPN |
Overview |
📋 Planned |
— |
| Global Accelerator |
Summary |
📋 Planned |
— |
| App Mesh |
Summary |
📋 Planned |
— |
| Cloud Map |
Summary |
📋 Planned |
— |
Security, Identity & Compliance
| Topic |
Depth |
Status |
|
| IAM |
Full |
📋 Planned |
— |
| KMS |
Full |
📋 Planned |
— |
| Secrets Manager |
Full |
📋 Planned |
— |
| Cognito |
Overview |
📋 Planned |
— |
| GuardDuty |
Overview |
📋 Planned |
— |
| WAF |
Overview |
📋 Planned |
— |
| Shield |
Overview |
📋 Planned |
— |
| Inspector |
Overview |
📋 Planned |
— |
| Security Hub |
Overview |
📋 Planned |
— |
| ACM |
Overview |
📋 Planned |
— |
| IAM Identity Center |
Overview |
📋 Planned |
— |
| Macie |
Summary |
📋 Planned |
— |
| Detective |
Summary |
📋 Planned |
— |
| Firewall Manager |
Summary |
📋 Planned |
— |
| CloudHSM |
Summary |
📋 Planned |
— |
| Directory Service |
Summary |
📋 Planned |
— |
| RAM |
Summary |
📋 Planned |
— |
| Audit Manager |
Summary |
📋 Planned |
— |
| Verified Permissions |
Summary |
📋 Planned |
— |
| Verified Access |
Summary |
📋 Planned |
— |
| Artifact |
Summary |
📋 Planned |
— |
Management & Governance
| Topic |
Depth |
Status |
|
| CloudWatch |
Full |
📋 Planned |
— |
| CloudTrail |
Full |
📋 Planned |
— |
| CloudFormation |
Full |
📋 Planned |
— |
| Systems Manager |
Overview |
📋 Planned |
— |
| Config |
Overview |
📋 Planned |
— |
| Organizations |
Overview |
📋 Planned |
— |
| Control Tower |
Overview |
📋 Planned |
— |
| Trusted Advisor |
Summary |
📋 Planned |
— |
| Well-Architected Tool |
Summary |
📋 Planned |
— |
| Service Catalog |
Summary |
📋 Planned |
— |
| License Manager |
Summary |
📋 Planned |
— |
| Compute Optimizer |
Summary |
📋 Planned |
— |
| Resource Groups |
Summary |
📋 Planned |
— |
| Health Dashboard |
Summary |
📋 Planned |
— |
| Chatbot |
Summary |
📋 Planned |
— |
| Proton |
Summary |
📋 Planned |
— |
| Launch Wizard |
Summary |
📋 Planned |
— |
| Topic |
Depth |
Status |
|
| CodePipeline |
Overview |
📋 Planned |
— |
| CodeBuild |
Overview |
📋 Planned |
— |
| CodeDeploy |
Overview |
📋 Planned |
— |
| CDK |
Overview |
📋 Planned |
— |
| X-Ray |
Overview |
📋 Planned |
— |
| CodeCommit |
Summary |
📋 Planned |
— |
| CodeArtifact |
Summary |
📋 Planned |
— |
| CodeGuru |
Summary |
📋 Planned |
— |
| Cloud9 |
Summary |
📋 Planned |
— |
| CloudShell |
Summary |
📋 Planned |
— |
| CodeCatalyst |
Summary |
📋 Planned |
— |
| SAM |
Summary |
📋 Planned |
— |
Analytics
| Topic |
Depth |
Status |
|
| Kinesis |
Full |
📋 Planned |
— |
| Athena |
Full* |
📋 Planned |
— |
| Glue |
Full* |
📋 Planned |
— |
| EMR |
Full* |
📋 Planned |
— |
| OpenSearch Service |
Overview |
📋 Planned |
— |
| MSK |
Summary |
📋 Planned |
— |
| QuickSight |
Summary |
📋 Planned |
— |
| Lake Formation |
Summary |
📋 Planned |
— |
| Data Exchange |
Summary |
📋 Planned |
— |
| DataZone |
Summary |
📋 Planned |
— |
| Clean Rooms |
Summary |
📋 Planned |
— |
| Managed Service for Apache Flink |
Summary |
📋 Planned |
— |
Machine Learning & AI
| Topic |
Depth |
Status |
|
| SageMaker |
Full |
📋 Planned |
— |
| Bedrock |
Full |
📋 Planned |
— |
| Rekognition |
Overview |
📋 Planned |
— |
| Amazon Q |
Overview |
📋 Planned |
— |
| Comprehend |
Overview* |
📋 Planned |
— |
| Textract |
Overview* |
📋 Planned |
— |
| Translate |
Summary |
📋 Planned |
— |
| Transcribe |
Summary |
📋 Planned |
— |
| Polly |
Summary |
📋 Planned |
— |
| Lex |
Summary |
📋 Planned |
— |
| Kendra |
Summary |
📋 Planned |
— |
| Personalize |
Summary |
📋 Planned |
— |
| Forecast |
Summary |
📋 Planned |
— |
| Fraud Detector |
Summary |
📋 Planned |
— |
| Augmented AI (A2I) |
Summary |
📋 Planned |
— |
| DeepRacer |
Summary |
📋 Planned |
— |
| HealthLake |
Summary |
📋 Planned |
— |
| HealthOmics |
Summary |
📋 Planned |
— |
| Entity Resolution |
Summary |
📋 Planned |
— |
Application Integration
| Topic |
Depth |
Status |
|
| SQS |
Full |
📋 Planned |
— |
| SNS |
Full |
📋 Planned |
— |
| EventBridge |
Full |
📋 Planned |
— |
| Step Functions |
Full |
📋 Planned |
— |
| MWAA (Managed Airflow) |
Full* |
📋 Planned |
— |
| AppFlow |
Summary |
📋 Planned |
— |
| Amazon MQ |
Summary |
📋 Planned |
— |
| SWF |
Summary |
📋 Planned |
— |
Front-End Web & Mobile
| Topic |
Depth |
Status |
|
| Amplify |
Overview |
📋 Planned |
— |
| AppSync |
Overview |
📋 Planned |
— |
| Device Farm |
Summary |
📋 Planned |
— |
| Location Service |
Summary |
📋 Planned |
— |
| Pinpoint |
Summary |
📋 Planned |
— |
Migration & Transfer
| Topic |
Depth |
Status |
|
| DMS |
Overview |
📋 Planned |
— |
| Migration Hub |
Summary |
📋 Planned |
— |
| Application Migration Service (MGN) |
Summary |
📋 Planned |
— |
| DataSync |
Summary |
📋 Planned |
— |
| Transfer Family |
Summary |
📋 Planned |
— |
| Mainframe Modernization |
Summary |
📋 Planned |
— |
| Topic |
Depth |
Status |
|
| Elemental MediaConvert |
Summary |
📋 Planned |
— |
| Elemental MediaLive |
Summary |
📋 Planned |
— |
| Elemental MediaPackage |
Summary |
📋 Planned |
— |
| Elemental MediaStore |
Summary |
📋 Planned |
— |
| Elemental MediaTailor |
Summary |
📋 Planned |
— |
| Elemental MediaConnect |
Summary |
📋 Planned |
— |
| Interactive Video Service (IVS) |
Summary |
📋 Planned |
— |
| Nimble Studio |
Summary |
📋 Planned |
— |
IoT
| Topic |
Depth |
Status |
|
| IoT family (Core, Greengrass, Analytics, SiteWise, …) |
Summary |
📋 Planned |
— |
Business Applications & End-User Computing
| Topic |
Depth |
Status |
|
| SES |
Overview |
📋 Planned |
— |
| WorkSpaces |
Summary |
📋 Planned |
— |
| AppStream 2.0 |
Summary |
📋 Planned |
— |
| WorkDocs |
Summary |
📋 Planned |
— |
| WorkMail |
Summary |
📋 Planned |
— |
| Connect |
Summary |
📋 Planned |
— |
| Chime |
Summary |
📋 Planned |
— |
| Supply Chain |
Summary |
📋 Planned |
— |
| Wickr |
Summary |
📋 Planned |
— |
Games, Blockchain, Quantum, Robotics & Satellite
| Topic |
Depth |
Status |
|
| GameLift |
Summary |
📋 Planned |
— |
| Managed Blockchain |
Summary |
📋 Planned |
— |
| Braket |
Summary |
📋 Planned |
— |
| RoboMaker |
Summary |
📋 Planned |
— |
| Ground Station |
Summary |
📋 Planned |
— |
Cloud Financial Management
| Topic |
Depth |
Status |
|
| Cost Explorer |
Overview |
📋 Planned |
— |
| Budgets |
Overview |
📋 Planned |
— |
| Cost and Usage Report |
Summary |
📋 Planned |
— |
| Billing Conductor |
Summary |
📋 Planned |
— |
| Savings Plans |
Summary |
📋 Planned |
— |
Full contents by topic
Every sub-topic of every published topic, so you can go straight to what you need.
The five things that are true of every service, written once so no topic has to repeat them.
Topic overview →
| # |
Sub-topic |
What it covers |
| 1 |
Accounts & Organizations |
The account as the real boundary; OUs, SCPs, Control Tower, consolidated billing |
| 2 |
The API & Control Plane |
One signed regional API behind every tool; credentials, eventual consistency, throttling, control vs. data plane |
| 3 |
IAM & Identity |
Principals, the five policy types, the evaluation algorithm, roles over users, short-lived credentials |
| 4 |
Regions & Availability |
Regions, AZs and AZ IDs, global vs. regional vs. zonal services, data residency |
| 5 |
ARNs, Tagging & Quotas |
The identifier every policy consumes, a tag schema that survives, and how quotas actually work |
EC2 — Elastic Compute Cloud
Renting virtual machines by the second: instance types, the Nitro system, Auto Scaling, and the cost
model that makes or breaks a fleet. Topic overview →
| # |
Sub-topic |
What it covers |
| 1 |
What & Why |
The problem EC2 solves, where it sits against Lambda / Fargate / Lightsail, and the honest anti-patterns |
| 2 |
Core Concepts |
Instances, AMIs, instance families, EBS vs. instance store, security groups, instance profiles, purchase options |
| 3 |
Architecture |
The Nitro system, a traced launch, network-attached storage, and the named failure modes |
| 4 |
Getting Started |
One instance three ways — Console, CLI, Terraform — and the teardown |
| 5 |
Deployment |
Launch template + Auto Scaling group + load balancer in Terraform, Ansible, CloudFormation/CDK, CI/CD, rollback, drift |
| 6 |
Integrations |
VPC, EBS, IAM, load balancing, CloudWatch, Systems Manager, S3, Secrets Manager, RDS, EventBridge |
| 7 |
Production |
Security, the real cost model, quotas, what to alarm on, and reliability posture |
| 8 |
Interview Questions |
Fifteen questions across three tiers, with answer keys |
| 9 |
Glossary & Cheatsheet |
Sixty terms, grouped commands, and symptom-to-metric lookups |
Notes on depth
* = role adjustment. The general allocation underrates the data and ML pipeline. For an MLOps
engineer, Glue, Athena, EMR, and MWAA deserve full treatment, and Comprehend, Textract, and
Rekognition earn a proper overview if you touch document or vision workloads. SageMaker, Bedrock, and
Kinesis already get full treatment.
Borderline calls. EKS is the most defensible candidate for demotion to an overview (heavier and
more specialised than ECS); Redshift and Systems Manager are the strongest candidates for promotion to
full treatment.
Promotion rule. A topic moves from a single page to nine sub-topic pages when its content exceeds
roughly 400 lines, or when a single concept inside it becomes worth linking to directly.
