AWS for DevOps: The Ultimate Beginner's Guide & Cheat Sheet

 

Welcome to your ultimate cheat sheet for AWS for DevOps. AWS provides over 200 cloud services, but as a DevOps engineer, you only need to master a core subset to build, scale, and automate reliable infrastructure.

This breakdown translates key AWS concepts into clear, practical DevOps terms.

1. Identity & Security (IAM & Access Control)

Security is job zero in cloud operations. IAM controls who can access what.

• IAM (Identity and Access Management): The central control panel for permissions across your entire AWS account.
• Users: Individuals or applications needing direct credentials (access keys or passwords). Best practice: Never use your root user for daily work.
• Groups: Collections of users. Assign permissions to a group (e.g., Developers, Admins), then drop users in to make permission management easy.
• Roles: Temporary permissions granted to human operators or AWS services (e.g., giving an EC2 server permission to write logs to CloudWatch). Roles don't rely on long-lived secrets, making them far more secure.
• Policies: JSON documents defining exact permissions (Allow or Deny actions on specific resources). Always follow the Least Privilege Principle: grant only the minimum access needed.
• MFA (Multi-Factor Authentication): An mandatory extra security layer (like an authenticator app) to secure root and IAM user logins.

2. Compute (Running Applications)

Compute services run your code, containers, and web servers.

• EC2 (Elastic Compute Cloud): Virtual servers in the cloud. You choose the OS, CPU, and RAM, and pay by the second.
• AMIs (Amazon Machine Images): Snapshots or "blueprints" of a server containing an OS, pre-installed tools, and software. Used to launch standard EC2 instances fast.
• Auto Scaling: Automatically adds or removes EC2 instances based on traffic or system load (CPU/memory) to keep apps stable and costs low.
• Launch Templates: The saved configuration recipe (AMI, instance type, security group, startup scripts) used by Auto Scaling to spawn new instances automatically.

3. Storage (Data & Files)

Choose storage based on access speed, sharing needs, and permanence.

• S3 (Simple Storage Service): Object storage for files, backups, static websites, and deployment artifacts. Think of it as an infinitely scalable cloud drive structured into Buckets.
• EBS (Elastic Block Store): High-performance persistent virtual hard drives attached directly to a single EC2 instance. If the instance stops, the EBS volume retains its data.
• EFS (Elastic File System): Network-attached file storage (NFS) that can be mounted simultaneously by hundreds of EC2 instances at once.
• Storage Classes (S3): Tiers to balance cost vs. access speed: S3 Standard: Frequently accessed data. S3 Infrequent Access (IA): Lower storage cost, but small charge to retrieve data. S3 Glacier: Extremely cheap, long-term archival (retrieval takes minutes to hours).
• Lifecycle Policies: Automated rules that shift S3 files to cheaper storage tiers (or delete them) as they age—vital for cost optimization.

4. Networking (Virtual Network Isolation)

Designing secure network topology is a core DevOps responsibility.

• VPC (Virtual Private Cloud): Your isolated private network within AWS.
• Subnets: Sections of a VPC divided into sub-networks: Public Subnets: Connected directly to the internet (used for web servers, load balancers). Private Subnets: Isolated from direct internet access (used for internal databases, backend apps).
• Route Tables: IP routing rules that dictate where network traffic is directed.
• Internet Gateway (IGW): The target attached to public subnets allowing inbound/outbound communication with the public internet.
• NAT Gateway: A bridge placed in a public subnet that allows instances in private subnets to download updates from the internet without letting the internet initiate connections to them.
• Security Groups: Instance-level stateful firewalls controlling inbound and outbound traffic.
• Network ACLs (NACLs): Subnet-level stateless firewalls acting as a secondary security layer.

5. Databases

Managed databases eliminate manual operating system and patch maintenance.

• RDS (Relational Database Service): Managed SQL database service supporting engines like PostgreSQL, MySQL, and MariaDB. AWS handles automated backups, patching, and multi-region failover.
• DynamoDB Basics: Fully managed, highly scalable NoSQL database delivering single-digit millisecond performance. Perfect for key-value storage, session management, and microservices.

6. Load Balancing

Distributes incoming traffic across multiple instances to ensure high availability.

• Application Load Balancer (ALB): Operates at Layer 7 (HTTP/HTTPS). Routes traffic based on paths or domains (e.g., /api goes to service A, /app goes to service B). Ideal for microservices and web applications.
• Network Load Balancer (NLB): Operates at Layer 4 (TCP/UDP/TLS). Built for extreme performance, low latency, and handling millions of requests per second.

7. Monitoring & Auditing

Without observability, you are flying blind in production.

• CloudWatch: Central operational hub. Collects system metrics (CPU, RAM), aggregates logs from apps/servers, triggers custom alarms, and automates responses.
• CloudTrail: API audit recorder. Logs every single action taken inside your AWS account (who deleted that EC2 instance, when, and from what IP address). Essential for compliance and security auditing.

8. DNS

• Connecting web addresses to infrastructure.*
• Route 53: Highly available Cloud Domain Name System (DNS) service. Translates human-readable names (app.com) to IP addresses, performs health checks on endpoints, and routes traffic globally.

9. Serverless

Focus entirely on code without provisioning or managing underlying servers.

• AWS Lambda: Event-driven compute service. Runs short-lived code in response to events (e.g., S3 file uploads, API requests) and scales automatically—paying only for execution time used.
• API Gateway Basics: A fully managed front door for your applications. Accepts HTTP/REST requests, handles authentication, and routes them to Lambda functions or internal backend services.

10. Messaging & Decoupling

Enables asynchronous, resilient microservice architectures.

• SQS (Simple Queue Service): Message queuing service. Decouples components by storing messages safely in a queue until target worker instances pick them up and process them.
• SNS (Simple Notification Service): Pub/Sub (Publisher/Subscriber) messaging service. Sends real-time notifications to multiple endpoints simultaneously (e.g., triggering Lambda, sending an email, or pushing an SMS).

11. Infrastructure as Code (IaC)

Replace manual console clicks with code files to build reproducible infrastructure.

• CloudFormation Basics: Native AWS IaC service. You write YAML/JSON templates defining your resources, and CloudFormation provisions the entire stack consistently.
• Terraform (Highly Recommended): Industry-standard open-source IaC tool created by HashiCorp. Uses Declarative HashiCorp Configuration Language (HCL). Preferred in DevOps for multi-cloud capability, modular structure, and state-file management.

Beginner DevOps Learning Order

If you're wondering where to start, build in this order:

1. Lock down security (IAM).
2. Set up your network (VPC & Subnets).
3. Spin up compute (EC2 + Load Balancer).
4. Connect storage & databases (S3, EBS, RDS).
5. Automate the entire setup with Terraform or CloudFormation.