AWS Global Infrastructure
AWS Global Network

- AWS infrastructure is distributed worldwide, organized into multiple smaller infrastructure groupings that are interconnected through a high-speed global network
- Reference: https://www.infrastructure.aws/ → visualization of the AWS global network
- The AWS global network is continuously expanding and evolving
- There are three main types of infrastructure groupings:
- Regions
- Availability Zones (AZs)
- Edge Locations (Points of Presence / PoPs)
AWS Infrastructure Groupings

AWS Region
- A Region is a physical geographic area that contains a complete set of AWS services such as compute, storage, databases, analytics, and more
- Example: Asia Pacific (Sydney), identified by the code
ap-southeast-2- “Asia Pacific (Sydney)” refers to the region name, while
ap-southeast-2is its identifier
- “Asia Pacific (Sydney)” refers to the region name, while
- Regions are not the same as countries, states, or continents
- AWS defines these boundaries based on where it deploys infrastructure
- Example: Asia Pacific (Sydney), identified by the code
- Regions are connected to one another through high-speed networking
- They enable systems to be designed for global fault tolerance
- If one region experiences a failure, workloads can operate from another region
- A region must be selected when working with non-global AWS services
- Global services (such as IAM) do not require a region selection
- Key benefits of using regions:
- Geographic isolation (fault separation)
- Failures in one region are contained and do not affect others
- Regulatory and legal separation
- Data is governed by the laws of the region where it is stored
- Data does not leave a region unless explicitly configured
- Improved performance through proximity
- Placing infrastructure closer to users reduces latency
- Geographic isolation (fault separation)
- Factors to consider when selecting a region:
- Regulatory requirements (e.g., data residency rules)
- Latency and performance based on user location
- Service availability, since not all services exist in every region
- Pricing differences across regions
AWS Availability Zone (AZ)
- An Availability Zone (AZ) is a subdivision of a region
- Each region typically contains 3 to 6 AZs
- Example:
ap-southeast-2a,ap-southeast-2b,ap-southeast-2cwithin the Sydney region
- AZs provide isolation within a region
- Each AZ has separate compute, storage, networking, power, and facilities
- If one AZ fails, services can continue running in other AZs if configured properly
- An AZ is not the same as a single data center
- One AZ may consist of one or multiple data centers
- Data centers are physically separated and include redundant power, networking, and connectivity
- AZs are connected to each other with high bandwidth and low latency links
- Some AWS services operate across multiple AZs for resilience
AWS Edge Location (Point of Presence / PoP)
- An Edge Location is a smaller distribution site used to deliver data to users with low latency
- Much smaller compared to regions
- Often used for content delivery (e.g., caching media closer to users)
- Typically located in third-party data centers
- Primarily storage-focused (e.g., caching), with limited compute capabilities
- These locations support edge computing use cases
- While technically different, Edge Locations and PoPs are commonly treated as the same concept
Resilience of an AWS Service
- Global resilience
- A global service operates as a single system with a centralized data layer
- Data is replicated across multiple regions
- The service can continue functioning even if an entire region fails
- Examples include IAM and Route 53
- A global service operates as a single system with a centralized data layer
- Regional resilience
- A regional service runs within a specific region, using a database located in that region
- Data is replicated across all AZs within the region
- Can tolerate failure of a single AZ
- If the entire region fails, the service becomes unavailable in that region
- Examples include VPC and S3
- S3 bucket names are globally unique, but the data resides within a region
- A regional service runs within a specific region, using a database located in that region
- Availability Zone (AZ) resilience
- The service operates within a single AZ
- More vulnerable to failure compared to regional or global services
- However, architectures can still achieve high availability by distributing workloads across AZs
- Hardware-level failures may occur without taking down the entire AZ
- Examples include EC2 and RDS
- The service operates within a single AZ
Amazon S3 (Simple Storage Service) 101
Amazon S3 – Core Concepts
- AWS’s primary storage service
- Object Storage (not a file system, not block storage)
- Stores objects (data items) inside buckets (containers for objects)
- Ideal for large-scale data storage (videos, audio, images, text, unstructured data)
- Cost-effective
- Accessible via AWS console, CLI, API, and HTTP(S)
- Fully public service, supports unlimited storage and multiple users
- Many AWS services use S3 as their default input/output storage
- Object Storage (not a file system, not block storage)
- S3 is a global service with regional resilience
- Bucket names must be unique worldwide
- Data is stored in specific regions and replicated across availability zones
- Key distinctions of S3:
- Not a File Store → cannot browse it like a typical file system
- Use Amazon EFS or Amazon FSx for file-based storage
- Not a Block Store → cannot mount a bucket as a drive like
K:\or/images- Use Amazon EBS for mountable block storage
- Not a File Store → cannot browse it like a typical file system
S3 Objects

- Objects are like files (conceptually similar but technically different)
- Object components:
- Key → the unique identifier for an object within a bucket (like a filename)
- Example:
koala.jpg
- Example:
- Value → the actual data/content of the object
- Size can range from 0B to 5TB
- 5TB is the maximum size for a single object
- Other attributes: Version ID, metadata, access control lists (ACLs), and subresources
- Key → the unique identifier for an object within a bucket (like a filename)
- Objects exist only inside buckets; they cannot exist independently
S3 Bucket

- Bucket = container for S3 objects
- Created within a specific region for controlled data residency
- Its data stays in the region unless explicitly configured to replicate: AWS Global Infrastructure
- Can hold an unlimited number of objects, making S3 highly scalable
- Created within a specific region for controlled data residency
- Bucket names:
- Must be unique globally
- Example:
koaladata - The ARN does not include the region:
arn:aws:s3:::koalacampaign13333337
- Example:
- Naming rules:
- 3–63 characters, lowercase letters only, no underscores
- Must start with a lowercase letter or number
- Cannot resemble an IP address (e.g.,
1.2.3.4)
- Must be unique globally
- Flat storage structure (no true folders or directories)
- Objects are all stored at the same level
- AWS console shows folder-like structures, but these are prefixes, not actual directories

Example: /images/badges.jpg appears under /images/, but /images/ is not a folder, just a prefix used to filter/display objects
- Bucket limits per AWS account
- Default: 10,000 buckets
- See AWS docs: S3 Bucket Limits
- Requests to exceed require AWS support approval
- Limits affect architecture choices; e.g., using prefixes instead of creating one bucket per user for large user bases
- Default: 10,000 buckets
- Buckets are private by default
- AWS includes a failsafe to block all public access

- Turning off the failsafe does not make the bucket public automatically; explicit permissions are still required
Amazon VPC (Virtual Private Cloud) 101
Amazon VPC – Core Concepts
- Create and manage private networks within AWS
- A Virtual Private Cloud (VPC) is a private virtual network inside an AWS account
- VPC CIDR defines the IP address range for the VPC (e.g., 172.31.0.0/16)
- Most AWS services and resources (especially private ones, like EC2 instances) run inside VPCs
- A Virtual Private Cloud (VPC) is a private virtual network inside an AWS account
- VPCs exist within a single AWS account and region → regionally resilient
- Subnets (smaller network segments) can be deployed across different availability zones (AZs) in the region
- If one AZ fails, other AZs in the region keep the VPC operational
- Subnet CIDR = portion of the VPC’s CIDR
- Once set, it cannot be modified
- Subnets (smaller network segments) can be deployed across different availability zones (AZs) in the region
- Types of VPCs:
- Default VPC (0–1 per region)
- Always comes with preconfigured settings
- Custom VPCs (0 or more per region)
- Require manual configuration
- Private by default
- Default VPC (0–1 per region)
- Custom VPCs are isolated by default
- No communication with external networks or other VPCs occurs unless explicitly configured
- Specific setup is required to connect a Custom VPC to:
- Other VPCs
- On-premises networks (hybrid cloud)
- Other cloud platforms (multi-cloud)
- Public internet
- Default VPCs are an exception to this strict isolation
Default VPC
- Automatically created by AWS and preconfigured in a consistent way
- Predictable → useful for quick testing
- Less flexible → not ideal for production environments
- Default VPC CIDR = 172.31.0.0/16 (always fixed)
- 0–1 per region
- Can be deleted and recreated
- “Create VPC” creates a Custom VPC, which is not the same as restoring a Default VPC
- Can be deleted and recreated

- Some AWS services expect a Default VPC, so keeping it is recommended
- Subnets
- One /20 subnet is created in each AZ of the region
- Example:
us-east-1(N. Virginia) has 6 AZs → Default VPC has 6 subnets
- Example:
- One /20 subnet is created in each AZ of the region

- Preconfigured components
- Internet Gateway (IGW), Security Groups (SG), Network ACLs (NACL)
- By default, resources in the Default VPC are assigned a public IPv4 address, making them reachable from the internet
- Custom VPCs do not assign public IPs by default
Default VPC – Reference Diagram:

Amazon EC2 (Elastic Compute Cloud) 101
Amazon EC2 – Core Concepts
- AWS’s main compute service
- IaaS (Infrastructure-as-a-Service) → customers use and manage the OS
- Users launch instances, which run on physical EC2 hosts
- Instances are also called virtual machines (VMs) or virtual servers (VSs)
- Customers manage instances, while AWS manages hosts (except for dedicated EC2 hosts, which the customer manages)
- Instances run inside VPC subnets
- EC2 instances are private by default
- EC2 is resilient across availability zones (AZs)
EC2 Instances
- An instance is a virtual machine
- Customers choose and configure the OS
- Runtime Environment (RTE), databases, and applications can be installed and managed within the instance
- Instance size and capacity are defined at launch
- Some configurations can be modified after launch
- Billing: Default is On-Demand → charged per second of usage
- Networking: Deployed inside VPC subnets
- Private by default
- Public access requires configuration
- Storage options:
- Local, ephemeral block storage (Instance Store)
- External, persistent block storage via Amazon EBS (Elastic Block Store)
EC2 Instance State

- State represents the condition of the instance
- Main states:
- Running (Active)
- Billed for CPU, network, memory, and storage usage
- Stopped (Inactive)
- Billed only for storage
- Can be restarted
- Terminated (Deleted)
- Completely deleted and cannot be restarted
- No further charges apply
- Running (Active)
Connecting to EC2 Instances via SSH
- SSH (Secure Shell) → secure protocol for connecting to instances
- Uses port 22
- Authentication through SSH key-pairs (private + public)
- Private key is downloaded once to the local machine (e.g.,
A4L.pem) - Public key stored on the EC2 instance by AWS
- Private key is downloaded once to the local machine (e.g.,
- Once connected via SSH, you can manage the instance via a command-line terminal
- Private key permissions must allow only the owner to read it:
chmod 400 A4L.pem(Mac/Linux)- Other users on the same machine cannot access the file
- AWS rejects connections if permissions are incorrect

Connecting to Older Windows Instances via RDP
- Older Windows OS (< Win10) do not support SSH natively
- Use RDP (Remote Desktop Protocol) instead
- Runs on port 3389
- SSH keys are used to retrieve the administrator password
- Once authenticated, users access the instance via RDP
- Use RDP (Remote Desktop Protocol) instead
Amazon Machine Image (AMI)
- AMI = template for launching EC2 instances
- Similar to a VM snapshot or OS installation media
- Contains the OS, disk image, kernel, and configuration
- Can launch a new EC2 instance or create an AMI from an existing instance (“snapshot”)
- Disk image includes OS and any installed software at the time of creation
- Components:
- Permissions → control who can launch instances from the AMI
- Public AMI → anyone can use
- Private AMI → owner only
- Implicit Allow: AMI owner can launch
- Explicit Allow: owner can allow specific AWS accounts
- By default, AMIs are private and owner-only
- Root/Boot Volume → OS boot drive (e.g.,
C:for Windows or/for Linux) - Block Device Mapping → defines how storage volumes are presented to the OS
- Permissions → control who can launch instances from the AMI

Amazon CloudWatch (CW) 101
Amazon CloudWatch – Components and Architecture

- Collects and manages operational data to provide monitoring and operational insights
- Data includes service performance, metrics, and logs
- Acts as a core support service for most AWS products
- Available as a public service
- Main components:
- CloudWatch Metrics – the core metrics service
- Examples: CPU utilization for EC2, disk usage on an on-premises server
- Can ingest metrics from AWS services, custom applications, or on-premises systems
- Some metrics are collected automatically by AWS
- CloudWatch Agent is required to:
- Collect metrics inside AWS not gathered natively (e.g., internal EC2 processes)
- Collect metrics from external infrastructure
- CloudWatch Logs
- Can collect logs from AWS services, custom apps, or on-premises servers
- Some logs are created automatically; others require the CloudWatch Agent
- CloudWatch Alarms
- Trigger notifications via Amazon SNS or initiate events based on metric thresholds
- Examples: Send an SMS if EC2 CPU usage exceeds 90%
- Billing alarms also use CloudWatch to send notifications when costs exceed a set budget
- Events (now Amazon EventBridge)
- Works with AWS services and scheduled tasks
- Generates events that can trigger automated actions
- Events can be based on:
- Conditions (e.g., EC2 instance created or terminated)
- Schedules (e.g., every Friday at 18:00)
- CloudWatch Metrics – the core metrics service
Amazon CloudWatch – Key Concepts

- Datapoint = Timestamp + Value
- Example: CPU usage 98.3% at 08:45:45 on 2019-12-03
- Metric = Sequence of datapoints over time
- Examples: CPU usage, network I/O, disk I/O
- A metric is not always tied to a single server; by default, CPU usage may reflect all EC2 instances unless specified

- Namespace – Container for metrics to organize monitoring data
- Prevents naming conflicts
- Example:
AWS/stores all AWS service metrics- Example:
AWS/EC2stores all EC2 metrics
- Example:
- Dimensions – Attributes to differentiate datapoints within the same metric
- Example: Within
AWS/EC2, dimensions can separate Instance A from Instance B - Provides flexibility for monitoring different perspectives
- Example: Within

- Alarms trigger actions when metrics reach specified thresholds
- Example: Notify when budget is exceeded
- Alarm States:
INSUFFICIENT DATA– initial stateOK– metric within thresholdALARM– metric exceeds threshold, triggers Amazon SNS notifications
AWS CloudFormation (CFN) 101
IaC Basics and AWS CloudFormation
- Infrastructure as Code (IaC)
- Allows you to create, update, and delete infrastructure using code or templates
- Code/templates are repeatable and consistent
- Reduces human errors
- Faster than manually provisioning or deleting resources
- AWS CloudFormation (CFN) – AWS’s official IaC service
- Templates written in YAML or JSON define infrastructure within AWS
- External IaC tools like Terraform or CDK often generate CFN templates to deploy infrastructure
CFN Templates – Structure and Components
- Templates are usually stored in an S3 bucket with prefix
CF- Note: CFN (CloudFormation) ≠ CF (CloudFront)
Example templates in YAML/JSON:

- Resources → mandatory section defining AWS resources
- Examples: VPCs, S3 buckets, EC2 instances
- Resources in templates are logical resources, not the actual physical infrastructure
- AWSTemplateFormatVersion → template version
- Description → optional text explaining template purpose
- Metadata → controls how the template appears in AWS UI
Example:

- Parameters → fields prompting user input when creating a stack
Example:

- Mappings → key-value lookups for conditional values
Example:

- Conditions → control resource creation based on logic
- Example: create an EC2 instance only in PROD environment
Example:

- Outputs → return information when the template executes
- Example: “EC2 instance created”
Example:

- Templates can also include intrinsic functions:
LatestAmiId→ fetch the latest AMI in a region!Ref→ reference another resource in the template!GetAtt→ get a resource’s attribute
CFN Stacks

- A CFN template defines logical resources and other components
- CFN Stack → live representation of all resources in a template
- Executed in an AWS account to create, update, or delete infrastructure
- Each logical resource in the stack corresponds to a physical AWS resource
Syncing Logical and Physical Resources
- Physical resource → exists in AWS, visible in the UI
- Example: running EC2 instance with ID
i-1234567890abcdef0
- Example: running EC2 instance with ID
- Logical resource → defined in CFN templates and stacks
- Has a type (e.g.,
AWS::EC2::Instance) - Has properties (e.g.,
ImageID,KeyName)
- Has a type (e.g.,
- CFN ensures logical and physical resources remain in sync
- Automates infrastructure management and reduces manual effort
- Allows template-based approval workflows before committing changes
- Quick one-off deployments are possible
- Deleting a stack removes both logical and physical resources, automatically cleaning up infrastructure
- Many SAA-C03 labs use CFN stack deployments
AWS Lambda 101
AWS Lambda – Key Concepts
- Function-as-a-Service (FaaS) lets you run small, specific pieces of code without managing servers.
- A Lambda function is the code that AWS Lambda executes.
- Also serves as a unit of configuration in Lambda.
- Informally, “Lambda” usually refers to the function itself.
- A Lambda function is the code that AWS Lambda executes.
- Every function must specify a Runtime Environment (RTE) (e.g., Python 3.8) before it can run.
- Memory is directly set, while CPU is allocated automatically based on memory.
- The function executes inside this environment when triggered.
- Billing is based only on actual compute usage during function execution.
- This is a key part of serverless and event-driven architectures.
- Lambda is cost-effective: first million requests are free, and subsequent requests are inexpensive.
AWS Lambda – Architecture

- A Lambda function includes code, configuration, and execution wrappers.
- Required components: programming language, deployment package (downloaded and executed at runtime), and allocated resources.
- Informally, people may refer to only the code as “Lambda,” but the function encompasses more than the code.
- Supported runtimes include Python, Ruby, Java, Node.js, etc.
- Lambda Layers can add custom runtimes, such as Rust.
- Choosing a runtime determines the software environment available.
- Each invocation creates a new runtime environment:
- Code is loaded, executed, and the environment is discarded.
- Future invocations generally run in a fresh environment; some settings allow reusing previous resources, but this is not default.
- Lambda functions are generally stateless; no data persists between invocations. Code must run correctly in a new environment each time.
- Traditional Docker containers are not standard for Lambda.
- Lambda supports container images, but these must be built specifically for Lambda, not standard Docker containers.
- Resource limits:
- Memory: 128 MB – 10,240 MB (1 MB increments)
- vCPU: assigned automatically based on memory (1 vCPU per ~1,769 MB)
- Temporary disk space: 512 MB at
/tmpby default, up to 10,240 MB- Cleared each invocation; only for temporary use.
- Maximum timeout: 900 seconds (15 minutes). Tasks longer than this require Step Functions or other services.
- Execution role: IAM role assigned to the function to control access to AWS resources.
AWS Lambda – Common Use Cases
- Serverless applications: e.g., S3 + API Gateway + Lambda.
- File processing: e.g., processing or transforming files uploaded to S3.
- Database triggers: Lambda runs automatically when items in DynamoDB are added, updated, or deleted.
- Scheduled tasks: using EventBridge or CloudWatch Events to run functions at set times.
- Real-time stream processing: Lambda reacts to new data in streams like Kinesis.
Demo: Create and Test a Lambda Function
- Deploy the CloudFormation stack provided in the demo, which creates two EC2 instances
- Create an execution role:
- Either in IAM or during Lambda creation.
- Example JSON policy (allow Lambda to start/stop EC2 instances and log to CloudWatch):
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Action”: [
“logs:CreateLogGroup”,
“logs:CreateLogStream”,
“logs:PutLogEvents”
],
“Resource”: “arn:aws:logs:*:*:*”
},
{
“Effect”: “Allow”,
“Action”: [
“ec2:Start*”,
“ec2:Stop*”
],
“Resource”: “*”
}
]
}
3. Go to Services → Lambda → Create Function
A. Enter a function name and select a runtime (Python 3.9 in demo)

B. Assign the execution role created earlier
- Once the function is created, add the code to stop EC2 instances:
A. Stop EC2 instances Python script
import boto3
import os
import jsonregion = 'us-east-1'
ec2 = boto3.client('ec2', region_name=region)def lambda_handler(event, context):
instances = os.environ['EC2_INSTANCES'].split(",")
ec2.stop_instances(InstanceIds=instances)
print('stopped instances: ' + str(instances))
B. Paste the code into the Lambda function editor

- Set Environment Variables
- Go to Configurations → Environment variables.
- Add a variable named
EC2_INSTANCESwith the EC2 instance IDs, separated by commas (no spaces).
- Test the function
- Click Test (no event input needed).
- After execution, check the EC2 console to confirm the instances were stopped.
- Create another function to start EC2 instances in a similar way:
A. Start EC2 instances Python script
import boto3
import os
import jsonregion = 'us-east-1'
ec2 = boto3.client('ec2', region_name=region)def lambda_handler(event, context):
instances = os.environ['EC2_INSTANCES'].split(",")
ec2.start_instances(InstanceIds=instances)
print('started instances: ' + str(instances))
B. Test the function and verify in the EC2 console that the instances were started.
- Clean-up
- Delete the Lambda functions created.
- Delete the CloudFormation stack used for the demo.
Amazon R53 (Route 53) 101
Amazon Route 53 – Key Concepts
- DNS-as-a-Service (DNSaaS) → AWS-managed solution for DNS
- Global service
- Maintains a single database that is replicated across all regions
- Highly available and resilient worldwide
- No region selection required in the console
- Main functionalities:
- Registered Domains
- Acts as a domain registrar
- Hosted Zones
- Functions as a DNS hosting service
- Registered Domains
- Costs: Besides domain registration and renewal fees, hosting the DNS zones also incurs charges
Registered Domains

- R53 interacts with all top-level domains (TLDs) like
.com,.net,.io- Example: PIR (Public Interest Registry) manages the
.orgdomain
- Example: PIR (Public Interest Registry) manages the
- Process to register a domain (e.g.,
animals4life.org):- R53 checks if the domain is available
- If available, the user accepts the terms and purchases it through R53
- R53 generates a ZoneFile for the domain (contains DNS information)
- R53 assigns four AWS-managed name servers for the domain
- R53 creates a hosted zone
- ZoneFile is stored across the four NSs
- Registered Domains and Hosted Zones are updated to reference these NSs
- R53 communicates with the TLD registry (e.g., PIR for
.org)- The TLD points to R53’s NSs, making them authoritative for the domain
- Note: You do not need to purchase a domain to follow AWS CLF-C02 or SAA-C03 courses. Domain registration is optional but required for projects like the Cloud Resume Challenge.
- Transfer lock (default enabled): Prevents the domain from being moved outside of R53
- Important: If a hosted zone is deleted and recreated, you must update the NS records in Registered Domains to reference the new servers. Failure to do so will break DNS resolution.
Hosted Zones
- Each hosted zone runs on four AWS-managed name servers
- These servers contain DNS records (RRSETs)
- Network visibility:
- Public Hosted Zones:
- Records are visible globally
- Accessible over the public internet
- Private Hosted Zones:
- Linked to specific VPCs
- Only accessible within those VPCs
- Useful for sensitive or internal DNS
- Public Hosted Zones:
- Billing:
- Monthly hosting fee
- Charges per query made against the zone
- Costs can grow with high query volumes, so consider this for large-scale applications