AWS for DevOps Tutorial
Learn AWS for DevOps: IAM, EC2, VPC, S3, RDS, Lambda, ECS, CloudWatch, and CodePipeline, hands-on tutorials with quizzes and real-world examples for every topic.
85 lessons in this tutorial
Introduction to AWS
Learn what AWS is, why it became the leading cloud platform, and how DevOps teams use its services to build, deploy, and operate systems faster.
AWS Global Infrastructure
Regions, Availability Zones, Local Zones and edge locations. How AWS is laid out, how to choose a Region, and why cross-AZ traffic shows up on your bill.
Setting Up AWS
What a new AWS environment needs before you build on it. Account structure, root hardening, identity, billing guardrails and CloudTrail.
AWS Account Setup
Securing a new AWS account. Root user hardening, MFA, billing alarms, CloudTrail, account contacts, and the settings that are painful to add later.
AWS Console Tour
Navigating the AWS Management Console efficiently: the search bar, Region switcher, CloudShell and Resource Explorer, and when not to use it at all.
AWS CLI Setup
Install and configure the AWS CLI properly. SSO instead of access keys, named profiles, the credential chain and safe multi-account use.
AWS IAM
How AWS IAM decides who can do what. Users, groups, roles and policies, the evaluation order that produces AccessDenied, and why humans should not have IAM users.
AWS IAM Users and Groups
How IAM users and groups work, why AWS now recommends against users for people, access key hygiene, and migrating to IAM Identity Center.
AWS IAM Roles and Policies
Trust policies versus permission policies, assuming roles with STS, managed and inline policies, permissions boundaries, and how to debug an assume-role failure.
AWS IAM Best Practices
Practical IAM hardening. Replacing IAM users with Identity Center, least privilege from real usage data, permissions boundaries, MFA, and what to audit regularly.
AWS EC2
How EC2 instances actually work. Families and sizing, pricing models, EBS vs instance store, IMDSv2, Session Manager instead of SSH, and stop vs terminate.
Launching an AWS EC2 Instance
Launching an EC2 instance properly. Choosing an AMI without hardcoding IDs, launch templates, user data, IMDSv2, and what to check when it comes up wrong.
AWS EC2 Instance Types
How to read an EC2 instance type, what each family is for, burstable credits, Graviton savings, and choosing a size from data rather than guesswork.
AWS EC2 Security Groups
How security groups work as stateful firewalls. Rule structure, referencing other groups, the default outbound rule, limits, and debugging blocked traffic.
AWS EC2 Key Pairs
How EC2 key pairs work, why Session Manager is a better default than SSH, recovering access to an instance with a lost key, and EC2 Instance Connect.
AWS VPC
How an AWS VPC is put together. CIDR and subnet sizing, what makes a subnet public, NAT gateway costs, VPC endpoints, and security groups versus NACLs.
AWS VPC Subnets
Designing VPC subnets. Public versus private, CIDR sizing and the five reserved IPs, availability zone placement, required tags, and running out of addresses.
AWS VPC Route Tables
How route tables decide where traffic goes: the local route, longest prefix match, the main table trap, and debugging a subnet with no connectivity.
AWS NAT Gateway
What a NAT gateway does, why it is often the largest networking cost on an AWS bill, and the VPC endpoints and architecture changes that reduce it.
AWS S3
How Amazon S3 object storage actually works. Buckets and keys, storage classes, encryption and public access defaults, and cost control.
AWS S3 Buckets
Creating and configuring S3 buckets. Global naming rules, the us-east-1 exception, and how to delete a bucket that will not delete.
AWS S3 Permissions
How S3 access is actually decided. IAM versus bucket policies, Block Public Access, ACLs being disabled, cross-account access, and debugging AccessDenied.
AWS S3 Versioning
How S3 versioning protects against overwrites and deletes. Delete markers, the storage cost nobody expects, lifecycle rules and Object Lock.
AWS RDS
Managed relational databases on AWS. Multi-AZ versus read replicas, backups and point-in-time recovery, the settings you cannot change later, and RDS Proxy.
AWS RDS Setup
Creating an RDS instance correctly. Subnet groups, the settings you cannot change later, parameter groups, connecting from a private subnet, and first-run checks.
AWS RDS Security
Securing an RDS database. Network isolation, encryption in transit and at rest, IAM authentication, secret rotation, audit logging and deletion protection.
AWS Lambda
How AWS Lambda works in practice: the execution model, memory and CPU, cold starts, concurrency limits, timeouts, retries and the costs that surprise teams.
AWS Lambda Functions
Writing, packaging and deploying Lambda functions. Handler signatures, deployment packages versus container images, layers, versions and aliases, and local testing.
AWS ECS vs EKS
Choosing between ECS and EKS on AWS: the real differences in cost, complexity, portability and ecosystem, plus where Fargate and App Runner fit.
AWS ECS Tasks and Services
ECS task definitions and services explained: the two IAM roles, networking modes, health checks and deployment behaviour, and debugging a task that will not start.
AWS CloudWatch
Metrics, logs, alarms and dashboards in CloudWatch: the missing EC2 metrics, log retention that never expires, alarm states, and how the bill gets away from teams.
AWS CloudWatch Metrics
How CloudWatch metrics work. Namespaces, dimensions and statistics, the metrics EC2 does not publish, custom metric cardinality costs, and metric math.
AWS CodePipeline
Building CI/CD pipelines with AWS CodePipeline. Stages and actions, source providers, approval gates, deployment strategies, and how it compares to GitHub Actions.
AWS CodeBuild
Running builds on AWS CodeBuild: the buildspec file, caching, building Docker images, VPC access, exported variables, and diagnosing a failing build.
AWS Cost Optimization
Where AWS bills actually go and how to reduce them. Savings Plans, Spot, Graviton, the hidden data transfer and NAT charges, and the tooling that finds waste.
AWS Elastic Load Balancing
Choose the right AWS load balancer. ALB vs NLB vs GWLB, target groups, health checks, TLS termination and debugging 502 and 503 errors.
AWS Application Load Balancer
Layer 7 load balancing on AWS. Listener rule precedence, target group health checks, the 502 and 503 errors you will meet, and ALB vs NLB.
AWS Network Load Balancer
Layer 4 load balancing on AWS. Static IPs, client IP preservation and the hairpin problem, cross-zone charges, and when an NLB beats an ALB.
AWS Auto Scaling
What actually scales on AWS and how. EC2 Auto Scaling vs Application Auto Scaling, scaling ECS, DynamoDB and Aurora, and why right-sizing usually beats scaling.
AWS Auto Scaling Groups
Operate an ASG properly. Launch templates, ELB vs EC2 health checks, grace periods, instance refresh, lifecycle hooks and mixed instances with Spot.
AWS Auto Scaling Policies
Target tracking, step, scheduled and predictive scaling compared, which to reach for, how warmup prevents flapping, and why scale-in goes wrong.
AWS CloudFront
CloudFront in practice. Origin access control, the cache key that decides your hit rate, invalidation costs and the us-east-1 certificate rule.
AWS CloudFront Distributions
Create and operate a distribution. Behaviour precedence, multiple origins, origin groups for failover, and CloudFront Functions vs Lambda@Edge.
AWS CloudFront SSL and Custom Domains
Serve CloudFront on your own domain over HTTPS: the us-east-1 certificate requirement, DNS validation, alias records, security policies, and origin-side TLS.
AWS Route 53
DNS on AWS. Public and private hosted zones, the delegation people forget, alias records, health checks, and why TTL decides failover speed.
AWS Route 53 Records
Every record type you will actually use, A, CNAME, MX, TXT, SRV and CAA, plus UPSERT semantics, SPF and DMARC, and the errors Route 53 returns.
AWS Route 53 Routing Policies
Weighted, latency, failover, geolocation and multivalue routing. What each is for, the Set Identifier rule, and why weighted canaries drift.
AWS DynamoDB
DynamoDB for people who know SQL. Partition and sort keys, why access patterns come before the schema, hot partitions and what it cannot do.
AWS DynamoDB Tables
Create and operate DynamoDB tables: the key schema you cannot undo, attribute definitions, deletion protection, PITR and on-demand backups.
AWS DynamoDB Queries
Query, Scan and secondary indexes. Why filter expressions do not save money, GSI vs LSI, projections, pagination, and the sparse index trick worth knowing.
AWS ElastiCache
Managed Redis and Memcached. Cluster mode and its client requirement, eviction policies, the cache-aside pattern and failover behaviour.
AWS SQS
Amazon SQS in practice. Standard vs FIFO, why visibility timeout must exceed processing time, long polling and idempotent consumers.
AWS SQS Dead-Letter Queues
Isolate and recover failing messages. Redrive policies, choosing maxReceiveCount, and why a DLQ without an alarm is worse than none at all.
AWS SNS
Publish-subscribe messaging on AWS: the SNS-to-SQS fan-out pattern, raw message delivery, filter policies and why email subscriptions bite.
AWS EventBridge
Route events by content, not topic. Event buses, pattern matching, AWS service events, scheduled rules, archive and replay, and why the DLQ belongs on the target.
AWS Step Functions
Orchestrate workflows without glue code. Standard vs Express and the 100x cost difference, retries, Map state concurrency and debugging a failure.
AWS API Gateway
Choosing and running API Gateway. HTTP vs REST vs WebSocket and the 70% price difference, stages, throttling, custom domains and cost at scale.
AWS API Gateway REST APIs
The REST API features worth paying for. Resources and methods, integration types, mapping templates, request validation, usage plans, caching, and OpenAPI import.
AWS API Gateway and Lambda
Wire Lambda behind API Gateway correctly. Proxy integration, the exact response shape that avoids a 502, payload format v1 vs v2, CORS and the 29-second ceiling.
AWS ECR
Push, pull and secure container images in Amazon ECR. Authentication, tagging, lifecycle policies, image scanning, and the errors you will hit first.
AWS EKS
How Amazon EKS runs managed Kubernetes on AWS. Control plane, node options, access entries, IRSA and Pod Identity, add-ons, and what each choice costs you.
AWS EKS Cluster Setup
Create an EKS cluster that works. The IAM mapping that locks people out, access entries vs aws-auth, subnet tagging and the CNI IP limit.
AWS EKS Node Groups
Run EKS workers properly. Managed node groups vs Fargate, Karpenter over Cluster Autoscaler, taints and labels, and Spot with interruption handling.
AWS CloudFormation
Define AWS infrastructure as code. Template anatomy, change sets, drift detection, rollback behaviour, deletion policies and how it compares to Terraform.
AWS CloudFormation Stacks
Operate stacks in practice. Change sets before every update, recovering from UPDATE_ROLLBACK_FAILED and ROLLBACK_COMPLETE, drift and deletion policies.
AWS CloudFormation Templates
Write templates that stay maintainable. Parameter types, intrinsic functions, conditions, DependsOn, custom resources and linting before deploy.
AWS Elastic Beanstalk
Deploy without managing infrastructure. Environment types, deployment policies and their downtime trade-offs, .ebextensions and the database mistake.
AWS KMS
Encryption keys that actually work. Key policies versus IAM, AWS managed vs customer managed keys, envelope encryption, grants and rotation.
AWS Secrets Manager
Store, rotate and retrieve secrets with AWS Secrets Manager. Resource policies, automatic rotation, caching, cost, and when Parameter Store is the better choice.
AWS WAF and Shield
Application-layer protection that does not block your users. Count mode before block, rate limiting, managed rule false positives and Shield Advanced.
AWS CloudTrail
The audit log for everything. Management vs data events, why the 90-day history is not enough, log file validation and querying trails with Athena.
AWS Config
Continuous compliance and resource history. Managed rules, conformance packs, auto-remediation with SSM, and Config versus CloudTrail.
AWS Systems Manager
Manage fleets without SSH. Why instances do not appear, Run Command, Patch Manager, and Parameter Store versus Secrets Manager.
AWS SSM Session Manager
Shell access with no SSH, no bastion and no open ports. Prerequisites, session logging for audit, and port forwarding to a private database.
AWS SSM Parameter Store
Store configuration and secrets in AWS Systems Manager Parameter Store. SecureString encryption, hierarchies, versions, standard vs advanced tiers, and cost.
AWS Organizations
Multi-account AWS done properly. Why separate accounts beat separate VPCs, OU design, consolidated billing and delegated administration.
AWS Organizations SCPs
Service control policies that restrict without breaking things. Deny lists over allow lists, why an SCP grants nothing, and break-glass exemptions.
AWS EFS
Shared NFS storage across instances and containers. Mount targets per AZ, why Bursting throughput stalls, access points and EFS versus EBS.
AWS EBS Deep Dive
Choose and tune block storage. Gp3 over gp2, io2 Block Express, why instance type caps your volume, snapshots and fast restore, resizing safely, and encryption.
AWS Kinesis
Streaming data on AWS. Data Streams versus Firehose, shards and hot partitions, consumer lag, and Kinesis compared with SQS and MSK.
AWS Athena
Query S3 with SQL and control the cost. Partitioning and partition projection, Parquet over JSON, and why you pay for every byte scanned.
AWS CodeDeploy
Blue-green and canary deployments for EC2, Lambda and ECS: the appspec file, lifecycle hooks, and automatic rollback driven by CloudWatch alarms.
AWS CodeCommit
CodeCommit is closed to new AWS customers. What that means, operating an existing repository, and migrating to GitHub or GitLab with history intact.
AWS CDK
Infrastructure in TypeScript or Python: the three construct levels, why cdk diff matters, bootstrapping, escape hatches and CDK versus Terraform.
AWS SAM
Build and deploy serverless applications with SAM: the template shorthand, sam local for testing, guided deploys, and SAM versus CDK.