DevOps8 min read

AWS Core Services

Foundation AWS services - EC2, S3, Lambda, RDS, VPC, IAM, and CloudFront - covering the architecture patterns every AWS application relies on.

AWSEC2S3LambdaIAMCloud

skill: AWS Core Services category: DevOps tags: [AWS, EC2, S3, Lambda, IAM, Cloud] readingTime: 8

AWS is the most comprehensive cloud platform - use it for production workloads that need the widest service catalog. GCP is stronger for data analytics and ML workloads. Azure is preferred for Microsoft-heavy enterprises. All three have equivalent core services - choose based on team familiarity and existing contracts.

Workflow

Set up IAM with least privilegeIAM is the foundation of AWS security. Every service, CI system, and developer should have only the permissions they need - nothing more.
Host static assets on S3 + CloudFrontS3 + CloudFront delivers static files (images, JS, CSS) from 400+ edge locations globally - sub-50ms latency worldwide for pennies.
Deploy serverless functions with LambdaLambda runs code without managing servers - ideal for event-driven tasks, API backends, and scheduled jobs. Pay only per invocation.
Run containers with ECS FargateECS Fargate runs Docker containers without managing EC2 instances - Kubernetes simplicity on AWS infrastructure.
Manage costs proactivelyAWS bills can spike unexpectedly - a misconfigured service or forgotten resource can generate thousands in charges. Cost management is a day-1 concern.

Output Format

AWS architecture: IAM least privilege, S3+CloudFront for assets, Lambda or ECS for compute, RDS for data, with billing alerts.

AWS Account:
├── IAM: roles per service, MFA on all users
├── VPC: public/private subnets, NAT Gateway
├── Compute: Lambda (serverless) or ECS Fargate
├── Storage: S3 (static) + RDS/Aurora (relational)
├── CDN: CloudFront
├── Monitoring: CloudWatch + AWS X-Ray
└── Billing: Budget alerts at $X/month

Examples

Input

Output

Edge Cases & Gotchas

Root account access - Never use the root account for daily operations. Create an IAM admin user, enable MFA on root, and store root credentials in a safe. Delete all root access keys.
Lambda cold starts - Lambda cold starts add 100ms-3s latency on first invocation. Use Provisioned Concurrency for latency-sensitive endpoints or keep functions warm with EventBridge scheduled pings.
VPC NAT Gateway cost - NAT Gateway costs $0.045/GB processed - unexpectedly high for high-egress workloads. Monitor with VPC flow logs and optimize by placing high-egress services in public subnets when appropriate.
Security Group vs. NACL - Security Groups are stateful (return traffic allowed automatically); NACLs are stateless (return traffic needs explicit allow). Use SGs for most use cases; NACLs for subnet-level blocking.

When to Break These Rules

Use GCP Cloud Run + BigQuery when data analytics and ML (Vertex AI) are the primary workloads - GCP's data tools are superior.
Use Cloudflare Workers instead of Lambda@Edge when you need low-latency edge compute globally - Cloudflare has 3x more PoPs than CloudFront.

Reference Files

https://docs.aws.amazon.com/
https://aws.amazon.com/architecture/well-architected/