Week 5 — AWS Fundamentals
My journey with Cloud Engineering Academy
Introduction
Hello everyone, I’m Pasquale. I’ve recently embarked on a journey with the Cloud Engineering Academy to learn the AWS cloud technology. I’ll be using this weekly post to track my progress and share what I’m learning along the way.
Get Pasquale Kwan’s stories in your inbox
Join Medium for free to get updates from this writer.
Week 5 of the Cloud Engineer Academy covered the basic parts of Amazon Web Services (AWS) fundamentals. This time focused on practical skills, moving from ideas to actual cloud setups. I focused on building secure networks and understanding core services like VPC, IAM, and EC2. This hands-on period helped me understand how to build the foundational components of scalable, secure, and reliable systems on AWS.
Key Concepts Learned this Week
This week’s lessons focused on the main building blocks of AWS and how they work together.
AWS Global Infrastructure
The AWS global infrastructure is the essential backbone for delivering highly available, scalable, and reliable services globally.
- AWS Regions are independent geographical areas offering services globally.
- Availability Zones (AZs) are distinct, isolated data centers within a Region, separated by significant distance for resilience.
- Local Zones extend regions to bring services closer to users for low-latency needs.
- Edge Locations cache data closer to users, supporting services like CloudFront.
- Note: Services like S3 and IAM are global, not tied to a specific region.
Amazon VPC
The logically isolated private network within AWS.
- CIDR Blocks: The IP address range defining the total available addresses (like property lines).
- Subnets: Smaller divisions of the VPC, which can be public (internet-facing, using an Internet Gateway) or private (internal, using a NAT Gateway for outbound access only).
- Route Tables: Rules that determine the direction of data traffic flow.
- Internet Gateway (IGW): The connection point between your VPC and the internet.
- NAT Gateway: Allows resources in a private subnet to initiate outbound internet traffic but prevents unsolicited inbound connections.
- Security Groups (SGs): Stateful firewalls for individual resources (instance-level protection).
- Network Access Control Lists (NACLs): Stateless firewalls for the entire subnet (subnet-level protection).
AWS Identity and Access Management (IAM)
Securely controls access to AWS resources.
- Users: Individuals or services needing access.
- Groups: Organized sets of users with similar access needs.
- Roles: Temporary permissions for services or temporary workers.
- Policies: Define granular access rules (security protocols).
Hands-on Experience & Lab Work
- VPC Design & Setup: I designed a multi-AZ VPC, including public and private subnets, an Internet Gateway (IGW), and route tables, then built this architecture using the AWS Console.
- Bastion Host: I set up a secure server (bastion host) in a public subnet to enable secure SSH access to servers located in private subnets.
- Multi-AZ Deployment: I configured the VPC across multiple AZs to ensure high availability and resilience.
Key Takeaway
Week 5 was foundational, introducing me to many core AWS concepts through direct, hands-on practice in the AWS console. I gained a deep understanding of each component’s configuration and how they connect by manually building resources like VPCs, subnets, and EC2 instances.
This “point-and-click” experience was invaluable for me to visualize the AWS infrastructure and grasp its underlying structure. However, this manual setup also clearly showed me that it is prone to errors, difficult to consistently repeat, and time-consuming for any complex environment.
This personal experience strongly highlighted my crucial need for a more automated and reliable way to manage cloud resources in the future. I’m looking forward to diving into CloudFormation in Week 6 to address these challenges and automate infrastructure builds.
