AWS Tutorials

Amazon Web Services from the parts you actually touch shipping a backend — IAM and the least-privilege policy that took three tries, EC2 and the load balancer in front of it, S3 and CloudFront, Lambda behind API Gateway, RDS and Aurora, the queues, and the CI/CD that puts it all there. Every command in this track is checked against the AWS API model before it ships, and the traps are ones that cost this site real time.

• AWS – EKS: Kubernetes, and Whether You Need It
  The honest version: most teams shipping one backend do not need Kubernetes, and ECS Fargate costs less to run and far less to learn. If you do need it — several teams, many services, or portability you can name — here is what EKS gives you, what the control plane costs before a single pod runs, node groups versus Fargate profiles, and the two AWS-specific pieces: IRSA for pod IAM, and the load balancer controller.
• AWS – Aurora: What It Changes About RDS
  Aurora is RDS with the storage layer replaced, and every difference that matters follows from that one change: replicas share storage so they lag in milliseconds, failover is fast, and storage grows on its own. The reader and writer endpoints and the bug you get from pointing writes at the wrong one, Serverless v2 scaling, and an honest look at when plain RDS Postgres is the better-value answer.
• AWS – Secrets Manager and Parameter Store
  Two services do this job and the right answer is usually the cheaper one. Parameter Store SecureString versus Secrets Manager, compared on the three things that differ: rotation, cross-account access, and price per secret per month. How to read one from a Lambda without shipping a key, caching so you are not billed per invocation, and why an environment variable holding a secret is visible in the console.
• AWS – CloudWatch: Logs, Metrics and Alarms Worth Having
  Log groups, retention that defaults to never expire and quietly bills you forever, and Logs Insights queries that find the error instead of scrolling to it. Metrics and the difference between a missing datapoint and a zero — which is what makes an alarm lie. Alarms that page a human versus alarms that trigger a rollback, and the handful actually worth creating on day one.
• AWS – CloudFormation: Infrastructure You Can Re-create
  Click-ops is fine until the day you have to build it again. A template's five sections, parameters and outputs, change sets so you see what an update will do before it does it, and SAM as the shorthand that turns forty lines of Lambda plumbing into six. Then the trap that ships stale config in silence: CloudFormation keeps the previous value for any parameter an update omits — it does not read your new default.
• AWS – CodeBuild: buildspec, Caching and Build Speed
  The buildspec file phase by phase, what each one is actually for, and the artifacts block that decides what the next stage receives. Then the two things that make builds slow and expensive: no dependency cache, and a compute type chosen by guessing. Local caching versus S3 caching, environment variables that should be parameter references, and privileged mode for building a container image.
• AWS – CodePipeline: Stages, Artifacts and Approvals
  A pipeline is stages, and between them an artifact in an S3 bucket — get that one idea and the rest is configuration. Source from GitHub through a CodeStar connection rather than a token, build, a manual approval gate, deploy. Where CodePipeline beats GitHub Actions and where it plainly does not, and the input-artifact mismatch that is the single most common reason a stage fails with nothing useful in the log.
• AWS – CodeDeploy: Blue/Green and Where It Still Fits
  CodeDeploy is the piece that takes a built artifact and puts it on the thing that runs it — and in 2026 it earns its place on EC2 and in ECS blue/green, not much elsewhere. The appspec file, the lifecycle hooks in the order they fire, and the validation hook that is the only reason blue/green is safer than in-place. Plus the automatic rollback alarm, and why a deployment can hang for an hour.
• AWS – CodeCommit Is Closed. Here Is What to Use
  On 25 July 2024 AWS stopped onboarding new customers to CodeCommit without announcing it. If you do not already have a repository there you cannot create one, and no new features are coming. What that means if you are on it — you can stay, and here is how to mirror out — and what to use instead: GitHub or GitLab, wired to CodePipeline or CodeBuild through a connection. Nobody should start here in 2026.
• AWS – Kinesis: Streams, Firehose and When to Use SQS Instead
  Most teams reaching for Kinesis want SQS, so this starts with the table that tells them apart: replay, ordering, and many consumers reading the same records. Then shards and the partition key that decides your hot shard, the retention window, and Data Firehose for the case where you only wanted the data in S3. Note the names changed — Firehose and Managed Service for Apache Flink are not called Kinesis now.
• AWS – Elastic Beanstalk, and Whether to Use It in 2026
  Beanstalk still works and still deploys a web app in one command, and it is still the fastest path from a zip file to a URL with a load balancer in front. What it actually creates on your behalf, `.ebextensions` and where the abstraction leaks, the deployment policies and which ones can serve two versions at once — and an honest comparison against ECS Fargate and App Runner before you commit.
• AWS – SNS: Fan-out, Filtering and SQS Subscriptions
  SNS pushes, SQS pulls, and the useful thing is putting them together: one topic, several queues, each consumer at its own pace. Topics and subscriptions, the confirmation handshake an HTTP endpoint has to complete, message filtering so a consumer is not woken for events it ignores, and the raw message delivery setting that stops your payload arriving wrapped in an envelope you did not ask for.
• AWS – SES: Sending Email That Arrives
  Getting SES to send is easy; getting the mail delivered is the work. Verifying a domain, and the three DNS records — SPF, DKIM, DMARC — that decide whether you land in an inbox or a spam folder. The sandbox and what leaving it requires, the reputation metrics AWS will suspend you over, and handling bounces and complaints through SNS instead of discovering them when your sending is paused.
• AWS – SQS: Queues, Visibility Timeout and DLQs
  A queue is the simplest way to stop a slow dependency from becoming a 500. Standard versus FIFO, long polling and the empty receives it saves you paying for, and visibility timeout — the setting that quietly processes your message twice when it is shorter than your handler. Dead-letter queues and the redrive policy, idempotency as a requirement rather than a nicety, and Lambda event source mapping with batching.
• AWS – KMS and Encryption at Rest
  Encryption at rest is a checkbox until something needs decrypting from another account. Customer managed keys versus AWS managed keys and the cost and control that separates them, envelope encryption in one diagram, and the key policy — which is the resource policy that IAM alone cannot override. Rotation, aliases, and the deletion window that is the only irreversible button in the service.
• AWS – Alexa Skills: Where They Actually Live
  Short and honest: an Alexa skill is not an AWS service. You build it on the Amazon Developer portal with the Alexa Skills Kit, and the only AWS part is the Lambda function it invokes. What that split means for where you configure things, what the ASK CLI does that the AWS CLI cannot, and how the skill's endpoint is wired to a function ARN. If you came here for AWS, the Lambda post is the one you want.
• AWS – API Gateway: HTTP APIs, Routes and Custom Domains
  HTTP API or REST API — one table, and for most backends the answer is the cheaper, faster one. Routes, proxy integration and the event shape your handler receives, CORS as configuration rather than code, and authorizers. Then the stage trap that makes one of your two URLs 404 forever: a named stage prefixes every path while a custom domain does not, and `$default` is the way out.
• AWS – Lambda: Handlers, Cold Starts and Packaging
  The handler signature, what actually lives in the execution context between invocations, and why that one fact decides where you open a database connection. Cold starts measured rather than feared, memory as the CPU dial it really is, layers versus a zip versus a container image, and the packaging trap that ships a Lambda which dies at import: compiled wheels built for your laptop instead of for Lambda.
• AWS – CloudFront: Caching, OAC and Edge Functions
  A CDN is a cache, and a cache you cannot explain is an outage waiting. Origins and behaviours, cache policies and what actually forms the cache key, and Origin Access Control so the bucket behind it can stay private. Invalidation and why fingerprinted filenames beat it, the certificate that must live in us-east-1, and a CloudFront Function doing URL rewriting at the edge — including why it needs republishing.
• AWS – S3: Buckets, Policies and Static Sites
  S3 as the service everything else leans on. Storage classes and the lifecycle rule that moves objects between them, versioning as an undo button with a bill attached, and Block Public Access — which should stay on, because a static site is served through CloudFront with OAC, not a public bucket. Ends with the bucket that serves this site: private, one policy, one distribution allowed to read it.
• AWS – ElastiCache: Redis in Front of Your Database
  Cache-aside in fifteen lines, then the four questions that decide whether it helps: what you key on, what you invalidate, what happens on a miss storm, and what happens when Redis is down. Valkey and Redis OSS engines, cluster mode on versus off, why your client needs the configuration endpoint and not a node address, and TTL as the only invalidation strategy that never goes stale forever.
• AWS – DynamoDB: Keys, Indexes and Access Patterns
  DynamoDB rewards you for knowing your queries before you design your table, and punishes you for anything else. Partition key and sort key, why a scan is a bug, and the single-table pattern in the smallest example that shows why it exists. GSIs and LSIs and the difference that cannot be undone after creation, on-demand versus provisioned, and the hot partition that throttles a table that looks under quota.
• AWS – RDS: Managed Databases and What Managed Means
  What RDS takes off your hands and what it very much does not. Multi-AZ is failover and not a read replica — the single most expensive misunderstanding in the service — plus parameter groups, subnet groups and the security group rule that is the reason you cannot connect. Backups, PITR and the retention window that defaults to a number you would not choose, and how to restore without praying.
• AWS – The CLI: Profiles, Queries and the Flags That Bite
  Named profiles so you never run a command against the wrong account, SSO login, and `--query` — JMESPath — which turns a screenful of JSON into the one field you wanted. Then the flags that have cost real time on this site: `s3 sync` skips unchanged files so metadata never updates, `--exact-timestamps` is not a tidy-up, and `--metadata-directive REPLACE` without `--content-type` rewrites every object.
• AWS – Route 53: DNS, Alias Records and Health Checks
  The one thing Route 53 does that other DNS does not: an ALIAS record, which points a bare domain at a CloudFront or ALB target with no CNAME and no charge. Hosted zones and delegation, the record types worth knowing, routing policies from simple to weighted to failover, and TTL as the rollback lever it is. Plus how to tell a propagation problem from your own resolver cache — `dig @8.8.8.8`, not `curl`.
• AWS – Load Balancers: ALB, NLB and Target Groups
  ALB or NLB, decided in one table instead of three paragraphs. The target group is the object that actually matters and the health check on it is what decides whether your deploy is a deploy or an outage — including the arithmetic that turns a 30-second interval into a two-and-a-half minute outage. Path and host routing rules, sticky sessions and why you probably do not want them, and draining connections.
• AWS – EC2: Instances, Storage and What They Cost
  Reading an instance type instead of guessing — what m7g.large tells you before you look it up — and the four purchase options ranked by how much they actually save. Security groups are stateful and NACLs are not, which explains most 'why can I not connect' questions. EBS volume types, why gp3 replaced gp2, user data for first-boot setup, and SSM Session Manager so you can close port 22 for good.
• AWS – IAM: Policies, Roles and Least Privilege
  IAM is the service you get wrong first and it is the one that matters most. The five parts of a policy document, the difference between an identity policy and a resource policy — and why an S3 bucket needs both — roles versus users and why your code should never hold a key, and how a deny always wins. Ends with the real bucket policy that lets exactly one CloudFront distribution read this site and nothing else.
• AWS – Stop an RDS Instance on a Schedule with Lambda
  Stopping RDS saves the instance hours but not the storage, and it does not last: AWS restarts any instance that has been stopped for seven days. That single fact is why a stop-on-a-schedule Lambda is a schedule and not a one-off click. The handler, the seven-day trap and how to notice it, and the difference between stopping an instance and stopping an Aurora cluster.
• AWS – Start an RDS Instance on a Schedule with Lambda
  Starting a stopped RDS instance is one API call and a wait measured in minutes, not seconds, which changes how you schedule it. The handler, the IAM policy, and the state check that stops a retry storm — calling start on an instance that is already starting is an error, not a no-op. Plus the configuration that cannot be stopped at all: anything with a read replica, or that is one.
• AWS – Start an EC2 Instance on a Schedule with Lambda
  The other half of the schedule: bring the instance back before anyone needs it. The cron expression EventBridge actually accepts — it is not standard cron, and the day-of-week field is the part that bites — why UTC ruins this twice a year, and the waiter that turns 'the API returned' into 'the box is up'. Plus a public IP that changes on every stop, and the one-line fix.
• AWS – Stop an EC2 Instance on a Schedule with Lambda
  A dev instance running nights and weekends is roughly 70% waste. Twenty lines of boto3, an EventBridge schedule, and an IAM policy scoped to a tag instead of `*`. Why the handler filters on instance state before it calls stop, what the stopping → stopped transition means for your EBS bill, and the mistake that stops your production fleet: a tag filter that matches nothing is a filter that matches all.
• AWS – ECR: The Registry Your Containers Come From
  Every container you run on ECS, EKS or Lambda is pulled from a registry, and on AWS that is ECR. Authenticating with a token that expires in twelve hours, the tag immutability setting that stops `:latest` meaning two different things, lifecycle policies so old images do not bill forever, and the vulnerability scan worth turning on. Plus the pull that fails from a private subnet, and why it is a VPC endpoint.
• AWS – ECS: Running Containers Without Kubernetes
  ECS in the three nouns it actually has — task definition, service, cluster — and why Fargate means you never touch an EC2 instance again. A task definition for the StayHub API, the service that keeps two of them running behind a load balancer, and rolling deploys with circuit breaker rollback. Plus the two things that make a task die on startup with no useful log: the execution role and the log group.