Amazon Web Services is usually taught as a catalogue, which is why it feels endless. It is smaller as a set of rules every service obeys: work runs in one geographic place and does not leave it by itself, identity decides what a request may do, the defaults favour reachability over safety, you are billed for what you reserve as much as for what you use, and anything you click into existence stops matching the file that claims to describe it. Learn those and a new service is mostly a new noun.
Each chapter opens with the short version. Tap one to read the detail.
Where your system runs, and how far a request travels
~2 min
Regions are isolated and nothing crosses between them unless you configure it. Two habits cause most of the confusion: reading "multi-A
Who is responsible for what
~2 min
AWS secures the cloud; you secure what you put in it — and the line moves service by service. The account, not a tag, is the hard boundary, and an organization guardrail grants nothing.
Identity is the perimeter
~2 min
Access is decided about a principal, not about where a request came from, so the identity design *is* the security design. The habit that breaks it is the long-lived access key.
How a request is decided, and why keys have their own policy
~2 min
Everything is denied until something allows it, and one explicit deny anywhere ends the argument. Boundaries and organization policies intersect rather than add — and an encryption key can refuse you anyway.
The network, and the defaults that are not safe defaults
~2 min
A subnet is public only because its route table sends everything to an internet gateway; nothing else marks it. Security groups are stateful and cannot deny; network access control lists are stateless, and the default one allows everything.
Instances, and the disks underneath them
~2 min
Stopping and terminating are not two strengths of one action. A stop erases instance-store data and keeps billing you for volumes; a terminate deletes the root volume by default.
Scaling reacts to a signal, so check the signal is real
~2 min
An Auto Scaling group replaces instances that fail a health check — but by default it uses only the built-in status checks and ignores the load balancer's. An instance that boots fine and serves errors stays in service.
Managed compute: what you stop owning, and what you start
~2 min
A function's execution environment handles one request at a time, so concurrency means more environments, never threads inside one. Code outside the handler runs once per environment, so a request-scoped variable there leaks between callers.
Object storage is not a filesystem
~2 min
Objects are stored under keys in a flat namespace; the slashes are ordinary characters the console draws as folders. Reads are strongly consistent, but two overlapping writes to one key are not arbitrated — the later timestamp wins.
Managed databases: what the provider runs, and what stays yours
~2 min
A standby in another zone exists for failover, not for read capacity — you cannot read from it. And filtering a scan does not make it cheaper: the filter runs after the read, so the capacity is consumed anyway.
Decoupling, and designing for the failure you will actually get
~2 min
Receiving a message does not remove it: the queue hides it for the visibility timeout, and your delete call is the acknowledgement. Build on that and a consumer crash costs nothing; assume otherwise and you lose work.
If it is not in a template, it is not real
~2 min
A stack manages its resources as one unit, so a console edit puts the running system out of step with the file that claims to describe it. Drift detection finds those — only for properties the template set.
Written by Keentune. We are not affiliated with or endorsed by the organizations whose documentation informs this guide, and any linked sources belong to their respective owners.
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.