Amazon Web Services

Compute | Service | Use case | |---|---| | EC2 | Virtual machines full OS control | | ECS | Docker containers (task-based) | | EKS | Managed Kubernetes | | Lambda | Serverless functions (up to 15 min) | | Fargate | Serverless containers (no cluster mgmt) | | App Runner | Simple container deployment |

Storage | Service | Use case | |---|---| | S3 | Object storage files, backups, static sites | | EBS | Block storage for EC2 (like a hard drive) | | EFS | Shared NFS file system (multiple EC2) | | Glacier | Long-term archival (cheap, slow retrieval) |

Database | Service | Use case | |---|---| | RDS | Managed PostgreSQL, MySQL, SQL Server, Oracle | | Aurora | AWS-optimized MySQL/PostgreSQL, 5x faster | | DynamoDB | Serverless NoSQL key-value/document | | ElastiCache | Managed Redis or Memcached | | Redshift | Petabyte-scale data warehouse |

Networking | Service | Use case | |---|---| | VPC | Isolated virtual network | | Route 53 | DNS and health routing | | CloudFront | Global CDN | | ALB/NLB | Load balancing (Layer 7 / Layer 4) | | API Gateway | Managed API proxy with auth and throttling |

5 Pillars of AWS Well-Architected:

1. Operational Excellence automate, make small reversible changes, anticipate failures
2. Security least privilege IAM, encryption at rest/transit, VPC isolation, CloudTrail audit
3. Reliability multi-AZ, auto-scaling, circuit breakers, health checks
4. Performance right instance types, caching (CloudFront, ElastiCache), async patterns
5. Cost Optimization right-sizing, reserved instances, Spot instances, auto-scaling

IAM Best Practices: ``json { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my-bucket/*" } ``
• Never use root account for daily operations
• Create roles, not users for services
• Enable MFA on all human accounts
• Use IAM roles for EC2/Lambda (no hardcoded keys)
• Audit with IAM Access Analyzer

# Lambda best practices

import json import boto3 import os from typing import Any import logging

logger = logging.getLogger() logger.setLevel(logging.INFO)

# Initialize clients OUTSIDE handler (warm container reuse) dynamodb = boto3.resource('dynamodb') table = dynamodb.Table(os.environ['TABLE_NAME']) ssm = boto3.client('ssm')

# Cache SSM parameter (avoid fetching on every invocation) _cached_config = None

def get_config(): global _cached_config if _cached_config is None: response = ssm.get_parameter( Name='/myapp/config', WithDecryption=True ) _cached_config = json.loads(response['Parameter']['Value']) return _cached_config

def handler(event: dict, context: Any) -> dict: logger.info("Event: %s", json.dumps(event, default=str))

try: # API Gateway proxy event if 'httpMethod' in event: return handle_api_event(event)

# SQS batch event if 'Records' in event and event['Records'][0].get('eventSource') == 'aws:sqs': return handle_sqs_batch(event['Records'])

# EventBridge scheduled event if 'source' in event: return handle_scheduled_event(event)

except Exception as e: logger.error("Unhandled error: %s", e, exc_info=True) raise # re-raise for Lambda retry / DLQ

def handle_sqs_batch(records: list) -> dict: failures = [] for record in records: try: body = json.loads(record['body']) process_message(body) except Exception as e: logger.error("Failed to process %s: %s", record['messageId'], e) failures.append({"itemIdentifier": record['messageId']})

# Partial batch response only retry failed messages return {"batchItemFailures": failures} ```