Aws Cloud Services

AWS Cloud Services

A comprehensive skill for building, deploying, and managing cloud infrastructure on Amazon Web Services (AWS). Master S3 object storage, Lambda serverless functions, DynamoDB NoSQL databases, EC2 compute instances, RDS relational databases, IAM security, CloudFormation infrastructure as code, and enterprise-grade cloud architecture patterns.

When to Use This Skill

Use this skill when:

• Building scalable cloud applications on AWS infrastructure
• Implementing serverless architectures with Lambda and API Gateway
• Managing object storage and file uploads with S3
• Designing NoSQL database solutions with DynamoDB
• Deploying EC2 instances and managing compute resources
• Setting up RDS databases for relational data storage
• Implementing IAM security policies and access control
• Automating infrastructure deployment with CloudFormation
• Architecting multi-region, highly available systems
• Optimizing cloud costs and performance
• Migrating on-premises applications to AWS
• Implementing event-driven architectures
• Building data pipelines and analytics solutions
• Managing secrets and credentials securely
• Setting up CI/CD pipelines with AWS services

Core Concepts

AWS Fundamentals

AWS is Amazon's comprehensive cloud computing platform offering 200+ services across compute, storage, databases, networking, security, and more.

Key Concepts

Regions and Availability Zones

• Regions: Geographic areas with multiple data centers (e.g., us-east-1, eu-west-1)
• Availability Zones (AZs): Isolated data centers within a region
• Edge Locations: CDN endpoints for CloudFront content delivery
• Local Zones: Extensions of regions for ultra-low latency

AWS Account Structure

• Root Account: Primary account with full access (use sparingly)
• IAM Users: Individual user accounts with specific permissions
• IAM Roles: Temporary credentials for services and applications
• Organizations: Multi-account management for enterprises

Service Categories

• Compute: EC2, Lambda, ECS, EKS, Fargate
• Storage: S3, EBS, EFS, Glacier
• Database: RDS, DynamoDB, Aurora, ElastiCache, Redshift
• Networking: VPC, Route 53, CloudFront, API Gateway, ELB
• Security: IAM, Cognito, Secrets Manager, KMS, WAF
• Infrastructure: CloudFormation, CDK, Systems Manager
• Monitoring: CloudWatch, X-Ray, CloudTrail

AWS SDK for JavaScript v3

The AWS SDK v3 is modular, tree-shakable, and optimized for modern JavaScript/TypeScript applications.

Key Improvements

Modular Architecture

// v2 (monolithic)
const AWS = require('aws-sdk');
const s3 = new AWS.S3();

// v3 (modular)
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
const client = new S3Client({ region: 'us-east-1' });

Command Pattern

• Each operation is a command class
• Clear separation between client and commands
• Better TypeScript support and type inference

Middleware Stack

• Customizable request/response pipeline
• Built-in retry and exponential backoff
• Request signing and authentication

Identity and Access Management (IAM)

IAM controls authentication and authorization across all AWS services.

Core IAM Components

Users

• Individual identities with long-term credentials
• Access keys for programmatic access
• Passwords for console access
• MFA (Multi-Factor Authentication) support

Groups

• Collections of users
• Attach policies to manage permissions collectively
• Users can belong to multiple groups

Roles

• Temporary credentials assumed by users, services, or applications
• Cross-account access
• Service-to-service communication
• Federation with external identity providers

Policies

• JSON documents defining permissions
• Identity-based policies (attached to users/groups/roles)
• Resource-based policies (attached to resources like S3 buckets)
• Service control policies (SCPs) for Organizations

Policy Structure

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Policy Elements

• Effect: Allow or Deny
• Action: Services and operations (e.g., s3:GetObject)
• Resource: ARN of resources affected
• Condition: Optional constraints (IP, time, MFA, etc.)
• Principal: Who the policy applies to (for resource-based policies)

Least Privilege Principle

Always grant minimum permissions necessary:

• Start with no permissions
• Add permissions incrementally as needed
• Use managed policies for common patterns
• Create custom policies for specific use cases
• Regularly audit and remove unused permissions

Credential Management

Credential Chain

The SDK searches for credentials in this order:

1. Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
2. Shared credentials file: ~/.aws/credentials
3. Shared config file: ~/.aws/config
4. IAM role (EC2/ECS/Lambda): Instance metadata service
5. Process credentials: From a custom executable

Best Practices

• Never hardcode credentials in source code
• Use IAM roles for EC2, Lambda, ECS
• Use temporary credentials whenever possible
• Rotate access keys regularly (90 days recommended)
• Use AWS Secrets Manager for application secrets
• Enable MFA for privileged accounts
• Use AWS SSO for centralized access management

Regions and Endpoint Configuration

import { S3Client } from '@aws-sdk/client-s3';

// Specify region explicitly
const client = new S3Client({
  region: 'us-west-2',
  endpoint: 'https://s3.us-west-2.amazonaws.com' // Optional custom endpoint
});

// Use default region from environment/config
const defaultClient = new S3Client({}); // Uses AWS_REGION or default region

S3 (Simple Storage Service)

S3 is AWS's object storage service for storing and retrieving any amount of data from anywhere.

Core S3 Concepts

Buckets

• Globally unique names: Must be unique across all AWS accounts
• Regional resources: Created in a specific region
• Unlimited objects: No limit on number of objects
• Bucket policies: Resource-based access control
• Versioning: Keep multiple versions of objects
• Encryption: Server-side and client-side encryption

Objects

• Key-value store: Key is the object name, value is the data
• Metadata: System and user-defined metadata
• Size limit: 5TB per object
• Multipart upload: For objects > 100MB (required for > 5GB)
• Storage classes: Standard, IA, Glacier, etc.

S3 Storage Classes

S3 Standard

• Frequently accessed data
• 99.99% availability
• Millisecond latency

S3 Intelligent-Tiering

• Automatic cost optimization
• Moves data between access tiers

S3 Standard-IA (Infrequent Access)

• Lower cost for infrequently accessed data
• Retrieval fees apply

S3 One Zone-IA

• Single AZ storage for less critical data
• 20% cheaper than Standard-IA

S3 Glacier

• Long-term archival
• Minutes to hours retrieval
• Very low cost

S3 Glacier Deep Archive

• Lowest cost storage
• 12-hour retrieval
• Ideal for compliance archives

S3 Operations

Upload Objects

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { readFileSync } from 'fs';

const client = new S3Client({ region: 'us-east-1' });

// Simple upload
const uploadFile = async (bucketName, key, filePath) => {
  const fileContent = readFileSync(filePath);

  const command = new PutObjectCommand({
    Bucket: bucketName,
    Key: key,
    Body: fileContent,
    ContentType: 'image/jpeg', // Optional
    Metadata: { // Optional custom metadata
      'uploaded-by': 'user-123',