AWS Trainer

The boundary layer first, because everything later depends on it. How the global infrastructure is laid out, how a request is authenticated and authorised, and why the account itself is the strongest isolation mechanism AWS offers. IAM users, roles, identity and resource policies, and the evaluation order that explains almost every unexpected AccessDenied.

Topics: Regions, Availability Zones, edge locations and service scope · The AWS API, CLI, SDKs and the console as one control plane · IAM users, groups, roles and instance profiles · Identity policies, resource policies and trust policies · Policy evaluation order, conditions and permission boundaries · AWS Organizations, OUs and service control policies · Cross-account access and role assumption · IAM Identity Center and federation

• Assignments: (1) Write a least-privilege policy for a deployment role and prove which statement denies an unwanted call; (2) Assume a role across two accounts and trace the call in CloudTrail
• Capstone: Design a multi-account structure for dev, staging, production and shared services, with the SCPs and cross-account roles that make it enforceable

Reachability, from first principles. Building a VPC by hand until the subnet, route table and gateway relationships are obvious, then the stateful versus stateless difference between security groups and NACLs, private egress paths, and the endpoints that keep traffic off the public internet entirely.

Topics: VPC CIDR planning and subnet layout across Availability Zones · Route tables, internet gateways and NAT gateways · Security groups versus network ACLs · VPC endpoints — gateway and interface — and PrivateLink · VPC peering and Transit Gateway · Route 53 public and private hosted zones · VPC Flow Logs and reachability troubleshooting · Application, Network and Gateway Load Balancers

• Assignments: (1) Build a three-tier VPC where the private subnets have no route to the internet and the workload still reaches S3; (2) Debug a broken path using flow logs and the Reachability Analyzer
• Capstone: Deliver a VPC design for a regulated workload — private-only data tier, controlled egress, and a written justification for every route

Instances as cattle rather than pets. Instance families and what they are actually optimised for, AMI construction and hardening, user data and cloud-init, then launch templates, Auto Scaling groups and health checks — including the difference between an EC2 status check and a target-group health check, which is where most bad scaling behaviour originates.

Topics: Instance families, sizing and purchase options — on-demand, Spot, Reserved, Savings Plans · AMIs, snapshots and golden image pipelines · User data, cloud-init and instance metadata service v2 · Launch templates and Auto Scaling groups · Scaling policies: target tracking, step and scheduled · Load balancer target groups and health checks · Placement groups and multi-AZ distribution · Systems Manager Session Manager, Patch Manager and Run Command

• Assignments: (1) Build a hardened AMI and roll it out through an Auto Scaling group with no downtime; (2) Run a Spot-backed workload that survives interruption
• Capstone: Stand up a self-healing, multi-AZ application tier that recovers automatically when instances are terminated at random

Where state lives and what that costs. S3 semantics — consistency, versioning, lifecycle transitions, replication and the access-control interaction between bucket policies, block public access and IAM. Then block and file storage, and the relational and NoSQL choices, judged on failover behaviour rather than feature lists.

Topics: S3 storage classes, lifecycle policies and Intelligent-Tiering · S3 versioning, replication, Object Lock and encryption · Bucket policies, Block Public Access and access points · EBS volume types, snapshots and encryption; EFS and FSx · RDS and Aurora: multi-AZ, read replicas, failover and backups · DynamoDB: partition keys, capacity modes, GSIs and streams · Choosing between relational, key-value and object storage · Backup strategy with AWS Backup and cross-region copies

• Assignments: (1) Configure an S3 bucket that is private, versioned, encrypted and lifecycle-managed, then prove public access fails; (2) Force an RDS multi-AZ failover and measure application impact
• Capstone: Produce a storage and backup design for a stateful application, with an RPO and RTO you can demonstrate rather than assert

Building without instances. Lambda execution model, packaging, layers, concurrency and cold starts; API Gateway in front of it; and the messaging fabric — SQS, SNS, EventBridge and Step Functions — that turns individual functions into a system. Retries, visibility timeouts, dead-letter queues and idempotency are treated as first-class design, because at-least-once delivery is the default everywhere.

Topics: Lambda packaging, layers, environment configuration and IAM execution roles · Concurrency, reserved and provisioned concurrency, cold starts · API Gateway REST and HTTP APIs, authorisers and throttling · SQS standard versus FIFO, visibility timeout and dead-letter queues · SNS fan-out and EventBridge rules, buses and schemas · Step Functions state machines and error handling · Idempotency and exactly-once semantics in practice · Serverless deployment with SAM, CDK or Terraform

• Assignments: (1) Build an event-driven pipeline where a failed message ends in a DLQ and can be replayed safely; (2) Add idempotency to a handler that is deliberately invoked twice
• Capstone: Deliver a serverless workflow with orchestration, retries, dead-lettering and alarms that survives a deliberately injected downstream failure

The three container answers and when each is right. ECR with image scanning and lifecycle rules, ECS task definitions and services on both EC2 and Fargate, and EKS with managed node groups, Fargate profiles and IRSA. The emphasis is on networking and identity — awsvpc mode, task roles, IAM roles for service accounts — because that is where container deployments on AWS actually fail.

Topics: ECR repositories, image scanning, lifecycle policies and cross-account pulls · ECS task definitions, services, and the EC2 versus Fargate launch types · awsvpc networking mode and task-level security groups · ECS task roles versus execution roles · EKS cluster architecture, managed node groups and Fargate profiles · IAM Roles for Service Accounts (IRSA) and the AWS Load Balancer Controller · Service discovery, autoscaling and rolling deployments · Logging containers to CloudWatch and OpenSearch

• Assignments: (1) Deploy the same application to ECS Fargate and to EKS, and compare operational cost and effort; (2) Grant a pod access to an S3 bucket using IRSA with no static credentials
• Capstone: Run a containerised service end to end — registry, private networking, scoped IAM, load balancing, autoscaling and rolling deployment

Making the account maintainable. Observability with CloudWatch metrics, logs, alarms and dashboards; auditability with CloudTrail and AWS Config; encryption and secrets with KMS and Secrets Manager; detection with GuardDuty and Security Hub. Then everything gets expressed as code and given a cost model, because an environment nobody can rebuild or explain the bill for is not finished.

Topics: CloudWatch metrics, log groups, metric filters, alarms and dashboards · CloudTrail, AWS Config rules and conformance packs · KMS key policies, envelope encryption and Secrets Manager rotation · GuardDuty, Security Hub and Inspector · CloudFormation stacks, change sets and StackSets · Terraform against AWS: remote state in S3 with locking, provider and module structure · Cost management: tags, budgets, Cost Explorer, Savings Plans and rightsizing · Well-Architected review as a working checklist

• Assignments: (1) Rebuild an environment that was created by hand entirely from code, then destroy and recreate it; (2) Attribute a month of spend to teams using tags and produce a rightsizing plan
• Capstone: Deliver a reproducible, monitored, tagged and cost-attributed environment, with the security controls and the runbook that go with it