aws

AWS

Amazon Web Services (AWS) is a comprehensive cloud platform providing scalable compute, serverless architectures, managed databases, and enterprise AI infrastructure.

When to Use

• Enterprise Cloud Infrastructure: Global compute (EC2, ECS, EKS), storage (S3), and database (Aurora, DynamoDB) solutions.
• Serverless & Event-Driven Applications: AWS Lambda, EventBridge, SQS, SNS, and API Gateway for zero-idle cost scaling.
• High-Security Multi-Account Architectures: AWS Organizations, IAM Identity Center, Control Tower, and KMS.
• Edge Computing & Global Content Delivery: CloudFront CDN, Route 53 DNS, and AWS WAF.

Quick Start

# Verify credentials and caller identity
aws sts get-caller-identity

# List S3 buckets
aws s3 ls

# Sync local assets directory to private S3 bucket
aws s3 sync ./dist s3://my-app-assets-bucket/ --delete

Core Concepts

Serverless Architecture with AWS Lambda & SQS

Event-driven microservice processing incoming messages:

import json
import boto3
import os

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table(os.environ['ORDERS_TABLE'])

def handler(event, context):
    processed_count = 0

    for record in event['Records']:
        body = json.loads(record['body'])
        order_id = body['order_id']
        amount = body['amount']

        # Persist transaction to DynamoDB
        table.put_item(Item={
            'PK': f"ORDER#{order_id}",
            'amount': str(amount),
            'status': 'CONFIRMED',
            'timestamp': record['attributes']['ApproximateFirstReceiveTimestamp']
        })
        processed_count += 1

    return {
        'statusCode': 200,
        'body': json.dumps({'processed': processed_count})
    }

Least-Privilege IAM Policy

Scoping permissions strictly to resource ARNs:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3InvoiceBucketAccess",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::corporate-invoices-prod/*"
    },
    {
      "Sid": "AllowKMSDecryption",
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/abc-123",
      "Condition": {
        "StringEquals": {
          "kms:CallerAccount": "123456789012"
        }
      }
    }
  ]
}