AWS Compute, Storage and Networking Essentials

EC2 instances and purchasing options

EC2 provides virtual machines. You pick an AMI (the image containing the operating system and software), an instance type, storage, a network location and a security group. Instance families are tuned for different shapes of work: general purpose for balanced needs, compute-optimised for CPU-bound jobs, memory-optimised for in-memory databases and caches, and storage-optimised for high local disk throughput. A user data script runs at first boot to bootstrap software, and an attached instance role gives the machine temporary credentials instead of stored keys.

Other useful features: placement groups (cluster for low latency, spread for isolation, partition for large distributed systems), elastic network interfaces, and hibernation, which saves memory contents to disk so an instance resumes quickly. Public IPs normally change on stop and start; an Elastic IP is a static address you keep until released.

Block and file storage

EBS

Elastic Block Store volumes are network-attached disks bound to a single AZ. SSD types cover general purpose and provisioned-IOPS needs, while HDD types suit large sequential workloads. Snapshots are incremental backups stored durably and can be copied across Regions or used to restore into another AZ. Volumes can be encrypted, and by default the root volume is deleted when its instance terminates, which you can change. An instance store, by contrast, is local disk with very high speed that disappears when the instance stops, so use it only for caches and scratch data.

EFS

Elastic File System is a managed NFS file system that many Linux instances across several AZs can mount simultaneously. It grows and shrinks automatically, supports lifecycle movement of cold files to a cheaper infrequent-access tier, and offers throughput modes for different load patterns.

FSx

FSx provides managed third-party file systems: Windows File Server for SMB and Active Directory environments, Lustre for high-performance computing and machine-learning data, NetApp ONTAP for multi-protocol enterprise features, and OpenZFS for ZFS-style snapshots and cloning.

S3 and its storage classes

S3 is object storage: flat buckets holding objects addressed by key, with very high durability and virtually unlimited capacity. Control access with IAM policies, bucket policies and by leaving Block Public Access on. Enable versioning to recover from overwrites and deletions, and server-side encryption to protect data at rest. Pre-signed URLs grant temporary access to a single object without making it public.

Lifecycle rules automate transitions between classes and expiry. Other handy features include cross-Region replication, event notifications to queues or functions, multipart upload for large files, and Object Lock for write-once retention.

VPC networking basics

A Virtual Private Cloud is your isolated network, defined by a private CIDR range such as 10.0.0.0/16 and divided into subnets, each living in one AZ. A subnet is "public" when its route table sends internet-bound traffic to an internet gateway; otherwise it is private. Resources in private subnets reach the internet outbound through a NAT gateway placed in a public subnet (one per AZ for resilience).

• Security groups are stateful, attach to network interfaces and only allow rules.
• Network ACLs are stateless, attach to subnets and support allow and deny rules in numbered order.
• VPC endpoints reach AWS services privately without traversing the internet.
• Peering and transit gateways connect VPCs; VPN and dedicated links connect on-premises networks.

Plan CIDR ranges so they never overlap with networks you may need to connect later, and keep databases and application servers in private subnets, exposing only load balancers publicly. A bastion host or a managed session tool provides administrative access.

Load balancing and Auto Scaling

Elastic Load Balancing spreads traffic across healthy targets in multiple AZs. The Application Load Balancer works at layer 7 with path and host routing; the Network Load Balancer works at layer 4 for extreme performance and static IPs; the Gateway Load Balancer inserts third-party network appliances. Targets are grouped in target groups with health checks. Useful settings include sticky sessions, cross-zone balancing, TLS termination with managed certificates, and a deregistration delay so in-flight requests finish before a target is removed.

An Auto Scaling group keeps a minimum, desired and maximum number of instances built from a launch template, replaces unhealthy ones and spans several AZs. Scaling policies can track a target metric (for example average CPU), follow a schedule, or respond to step alarms. Pair it with a load balancer so new instances are registered automatically, and add a cooldown to avoid thrashing.

Route 53 and CloudFront

Route 53 is a managed DNS service. Common record types are A, AAAA, CNAME and alias records; alias records can point a zone apex at AWS resources. Routing policies shape the answer returned:

• Simple and multi-value for basic distribution.
• Weighted for gradual rollouts and tests.
• Latency to send users to the fastest Region.
• Failover with health checks for active-passive setups.
• Geolocation and geoproximity for location-based answers.

Lower TTLs make changes propagate faster at the cost of more queries. CloudFront is a content delivery network that caches content at edge locations in front of an S3 bucket or any HTTP origin. It reduces latency, offloads origins, supports HTTPS, geographic restrictions and signed URLs, and lets you invalidate cached paths after a release.

Databases overview

Choose the engine by access pattern first: relational joins and transactions point to RDS or Aurora, huge key-based throughput to DynamoDB, and aggregate reporting to a warehouse. Put a cache in front of hot reads, encrypt at rest, and keep every database inside private subnets.