Compute
🖥️Amazon EC2Virtual servers. You manage the OS upwards.λAWS LambdaRun code without managing servers. Pay per request and millisecond.🌱Elastic BeanstalkUpload code; AWS provisions and manages the environment.⚖️Elastic Load BalancingSpreads traffic over healthy targets in several AZs.📈EC2 Auto ScalingAdds and removes instances with demand; replaces failed ones.
Storage
🪣Amazon S3Object storage. Eleven nines of durability. Hosts this website.💿Amazon EBSBlock storage volumes attached to one EC2 instance in one AZ.📁Amazon EFSShared file storage several instances can mount at once.🧊Amazon S3 GlacierArchive storage classes for data you rarely read.
Database
🗃️Amazon RDSManaged relational database. AWS patches the engine.⚡Amazon DynamoDBServerless key-value store. Single-digit millisecond reads.📊Amazon RedshiftColumnar MPP data warehouse for analytics at scale.🚀Amazon AuroraMySQL- and PostgreSQL-compatible, built for the cloud.
Networking
🗺️Amazon VPCYour own isolated network: subnets, routes, gateways.🌍Amazon Route 53DNS, domain registration and health-checked routing.🌐Amazon CloudFrontCDN that caches content at hundreds of edge locations.🔌AWS Direct ConnectA private circuit from your data centre into AWS.🕸️Transit GatewayHub connecting many VPCs, VPNs and Direct Connect links.
Security
🔑AWS IAMUsers, groups, roles and policies. Global, and free.🔐AWS KMSManaged encryption keys used by S3, EBS, RDS and more.🛡️Amazon GuardDutyThreat detection from CloudTrail, Flow Logs and DNS logs.🔍Amazon InspectorContinuous vulnerability scanning of EC2, ECR, Lambda and code.🧱AWS WAFLayer-7 firewall for CloudFront, ALB, API Gateway and more.🛡️AWS ShieldDDoS protection. Standard is free; Advanced is paid.🧭AWS Security HubOne normalised, prioritised list of findings across accounts.
Management
📋AWS CloudTrailRecords every API call. Answers 'who did that?'.📉Amazon CloudWatchMetrics, logs, alarms, dashboards and events.⚙️AWS ConfigRecords resource configuration over time and checks it against rules.🏛️AWS OrganizationsMany accounts, one bill, with SCP guardrails.✅AWS Trusted AdvisorAutomated best-practice checks across six categories.🔧AWS Systems ManagerPatching, parameters and shell access without opening port 22.
Integration
📢Amazon SNSPublish/subscribe. One topic, many subscriptions.📥Amazon SQSQueue that holds messages until a consumer pulls them.🔄Amazon EventBridgeEvent bus that reacts to changes in your account.
Compliance
Cost
🧮AWS Pricing CalculatorModel a workload's cost before you build it.🔎AWS Cost ExplorerTwelve months of cost history, filtered and forecast.🔔AWS BudgetsSet a target and get alerted before you blow past it.
Port numbers
| Port | Protocol | Notes |
|---|---|---|
| 20 / 21 | FTP | Data and control |
| 22 | SSH / SFTP | How you reach a Linux EC2 instance. Never open to 0.0.0.0/0. |
| 23 | Telnet | Unencrypted. Do not use. |
| 25 / 587 | SMTP | Sending mail |
| 53 | DNS | UDP usually, TCP for large answers. The origin of the name Route 53. |
| 67 / 68 | DHCP | Server and client |
| 80 | HTTP | Your S3 website endpoint uses this |
| 443 | HTTPS | What CloudFront gives you |
| 3306 | MySQL / Aurora MySQL | Allow from the web security group only |
| 3389 | RDP | Windows remote desktop |
| 5432 | PostgreSQL | |
| 1024–65535 | Ephemeral | Return traffic. Matters when writing NACL rules. |
Numbers worth memorising
| Number | What it is |
|---|---|
| 7 / 4 | Layers in the OSI model / in the TCP/IP model |
| 32 | Bits in an IPv4 address |
| 2^h − 2 | Usable hosts in a traditional subnet |
| 5 | Addresses AWS reserves in every subnet |
| 256 − mask octet | The block size shortcut for subnetting |
| 3 | Minimum Availability Zones in a Region |
| 6 | Well-Architected pillars |
| 8 | Operational Excellence design principles (current) |
| 11 nines | S3 durability |
| 99.9% = 8.8 h/yr | Three nines of downtime per year |
| 400 KB | Maximum DynamoDB item size |
| 9.0–10.0 | GuardDuty Critical severity band |
| 2 minutes | Spot Instance interruption notice |
| 35 days | DynamoDB point-in-time recovery window |
Picking the right service
| If the question says… | The answer is usually… |
|---|---|
| "key-value, millisecond, massive scale" | DynamoDB |
| "SUM, GROUP BY, three years of history" | Redshift |
| "serve users worldwide with low latency" | CloudFront |
| "route traffic to the nearest Region" | Route 53 latency-based routing |
| "send 10% of traffic to the new version" | Route 53 weighted routing |
| "who called this API and when?" | CloudTrail |
| "CPU is above 80% — tell someone" | CloudWatch alarm → SNS |
| "one message must reach four systems" | SNS fan-out |
| "buffer work so a slow consumer does not block" | SQS |
| "detect compromised instances" | GuardDuty |
| "find unpatched software" | Inspector |
| "block SQL injection" | AWS WAF |
| "private connection to S3 from a VPC" | Gateway VPC endpoint |
| "connect 30 VPCs and the office" | Transit Gateway |
| "one bill and guardrails for 20 accounts" | AWS Organizations with SCPs |
| "give my auditor the SOC 2 report" | AWS Artifact |
| "why is my bill so high?" | Cost Explorer |
| "warn me before I overspend" | AWS Budgets |