AWS/Cloud Services Overview

Difficulty: Intermediate

Question

What AWS services should a developer know? Explain the core services and how they fit together in a typical web application architecture.

Answer

AWS (Amazon Web Services) provides over 200 cloud services. For a web developer, the essential ones are:

Compute: - EC2: Virtual servers. Choose instance type, OS, and scale up/down. - ECS/Fargate: Run Docker containers without managing servers. - Lambda: Serverless functions. Pay only when code runs.

Storage: - S3: Object storage for files, images, backups. Virtually unlimited. - EBS: Block storage (hard drives) attached to EC2 instances.

Database: - RDS: Managed relational databases (PostgreSQL, MySQL). Handles backups, patching, replication. - DynamoDB: NoSQL key-value database. Massively scalable. - ElastiCache: Managed Redis or Memcached for caching.

Networking: - VPC: Virtual private network isolating your resources. - CloudFront: CDN that caches content at edge locations worldwide. - Route 53: DNS service for domain management. - ALB: Application Load Balancer distributing traffic.

Security: - IAM: Identity and Access Management. Users, roles, policies. - Secrets Manager: Store and rotate secrets. - ACM: Free SSL/TLS certificates.

A typical architecture: Route 53 (DNS) -> CloudFront (CDN) -> ALB (load balancer) -> ECS/EC2 (app servers) -> RDS (database) + ElastiCache (cache) + S3 (file storage).

Code examples

AWS CLI Essential Commands

# Configure AWS CLI
aws configure
# AWS Access Key ID: AKIA...
# AWS Secret Access Key: ...
# Default region: us-east-1
# Default output: json

# S3 Operations
aws s3 ls                           # list buckets
aws s3 ls s3://my-bucket/           # list objects
aws s3 cp file.txt s3://my-bucket/  # upload file
aws s3 sync ./dist s3://my-bucket/  # sync directory
aws s3 rm s3://my-bucket/file.txt   # delete object

# EC2
aws ec2 describe-instances --query \
  'Reservations[].Instances[].{ID:InstanceId,State:State.Name,IP:PublicIpAddress}'
aws ec2 start-instances --instance-ids i-1234567890
aws ec2 stop-instances --instance-ids i-1234567890

# RDS
aws rds describe-db-instances --query \
  'DBInstances[].{ID:DBInstanceIdentifier,Status:DBInstanceStatus,Endpoint:Endpoint.Address}'

# Secrets Manager
aws secretsmanager get-secret-value --secret-id myapp/prod/db-url
aws secretsmanager create-secret --name myapp/prod/api-key \
  --secret-string "sk-abc123..."

# CloudWatch Logs
aws logs tail /aws/ecs/myapp --follow

The AWS CLI is essential for automation and debugging. S3 sync is commonly used for deploying static sites. Secrets Manager replaces .env files in production.

S3 Static Website + CloudFront

# Deploy a React app to S3 + CloudFront

# 1. Create S3 bucket for static hosting
aws s3 mb s3://myapp-frontend
aws s3 website s3://myapp-frontend \
  --index-document index.html \
  --error-document index.html

# 2. Build and upload React app
npm run build
aws s3 sync dist/ s3://myapp-frontend --delete

# 3. CloudFront distribution (CDN)
# Creates edge locations worldwide for fast loading
aws cloudfront create-distribution \
  --origin-domain-name myapp-frontend.s3.amazonaws.com \
  --default-root-object index.html

# 4. Invalidate CDN cache after deploy
aws cloudfront create-invalidation \
  --distribution-id E1234567890 \
  --paths "/*"

# S3 bucket policy for public read
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::myapp-frontend/*"
  }]
}

# Cost: ~$1-5/month for a typical SPA
# S3 storage + CloudFront bandwidth

S3 + CloudFront is the cheapest and fastest way to host a static React app. CloudFront caches assets at edge locations close to users worldwide.

IAM Roles and Policies

# IAM Policy: Least privilege access
# Only allow specific S3 actions on specific bucket
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": "arn:aws:s3:::my-uploads-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-uploads-bucket"
    }
  ]
}

# Create IAM user for CI/CD
aws iam create-user --user-name github-actions
aws iam attach-user-policy --user-name github-actions \
  --policy-arn arn:aws:iam::123456789:policy/deploy-policy
aws iam create-access-key --user-name github-actions

# Better: Use IAM Roles with OIDC for GitHub Actions
# No long-lived credentials needed
# GitHub Actions assumes an IAM role via OIDC token

# Check who you are
aws sts get-caller-identity
# {"UserId": "AIDA...", "Account": "123456789", "Arn": "arn:aws:iam::..."}

# List attached policies
aws iam list-attached-user-policies --user-name github-actions

Always follow least-privilege: grant only the permissions needed. Use IAM roles with OIDC for CI/CD instead of long-lived access keys. Avoid using the root account.

Key points

• Follow the principle of least privilege for IAM: only grant permissions that are needed
• S3 + CloudFront is the standard way to deploy static frontends on AWS
• Use managed services (RDS, ElastiCache) instead of running databases on EC2

Concepts covered

AWS, EC2, S3, RDS, CloudFront, IAM, Cloud Architecture