Free chapter — no signup required

AWS Mastery (The Reference Implementation)

AWS Global Infrastructure: The Physical Layer

Introduction: The "Reference Implementation" of Cloud

The Hierarchy: Regions vs. AZs vs. Data Centers

The Edge Network: Bringing Content Closer

Special Zones: Local Zones & Wavelength

Partitions: The Hard Boundaries

IAM Architecture: The Guardian of the Cloud

Introduction: Who Are You and What Can You Do?

The Core Logic: How AWS Decides (Policy Evaluation Flow)

Service Control Policies (SCPs): The Organization's Guardrails

Permission Boundaries: The Sandbox for Delegated Administration

Cross-Account Roles: Trusting Strangers Safely

ABAC: Attribute-Based Access Control

AWS Advanced Networking: Connecting at Scale

Introduction: When Simple Networking Breaks Down

The Limits of VPC Peering

The Solution: AWS Transit Gateway (TGW)

PrivateLink Part 1: Gateway Endpoints

PrivateLink Part 2: Interface Endpoints

Seeing the Invisible: VPC Flow Logs

Global Accelerator vs. CloudFront: Improving Performance

Compute Internals: The Engine Under the Hood

Introduction: It's Not Just a Virtual Machine

The Three Pillars of Nitro

Decoding Instance Families (C, M, R, T)

Placement Groups: Controlling Physical Location

Spot Instances and Allocation Strategies

Storage Deep Dive: Mastering S3

Introduction: Beyond Simple Buckets

Strong Consistency: The "Read-After-Write" Guarantee

Storage Classes: The Hierarchy of Cost vs. Speed

Lifecycle Policies: Automating the Flow

Object Lock (WORM): Compliance & Security

S3 Select vs. Athena: Querying Data in Place

Presigned URLs: The Temporary Guest Pass

Storage Deep Dive: Elastic Block Store (EBS)

Introduction: The Hard Drive in the Cloud

Volume Types: The Performance Matrix

Multi-Attach: Clustering in the Cloud

Snapshots & Data Lifecycle Manager (DLM)

Storage Deep Dive: EFS & The FSx Family

Introduction: The "Shared Drive" Problem

Amazon EFS: The Linux Standard

FSx for Windows File Server: The Corporate "S: Drive

FSx for Lustre: The Speed Demon

FSx for NetApp ONTAP: The Enterprise Swiss Army Knife

FSx for OpenZFS: The Developer's NFS

Aurora: The Cloud-Native Database

Introduction: Reimagining the Relational Database

Aurora Storage Architecture: 6 Copies, 3 AZs

Endpoints: How to Connect

Aurora Serverless v2: Instant Scaling

Aurora Global Database: Speed of Light Replication

Aurora vs. RDS: Choosing the Right Tool

Database Engineering: DynamoDB Advanced Patterns

Introduction: SQL vs. DynamoDB

The Primary Key: Partition vs. Sort

Single Table Design: Adjacency Lists

GSI Overloading: One Index to Rule Them All

Hot Partitions & Write Sharding

Capacity Math: WCU & RCU

DynamoDB Streams: The Change Log

Transactions and Conditional Writes

Serverless & Event-Driven: Lambda Deep Dive

Introduction: Firecracker & The MicroVM

The Lambda Lifecycle & Cold Starts

SnapStart: Cheating the Cold Start

Concurrency: Reserved vs. Provisioned

Lambda Layers: Sharing Code and Dependencies

Event Source Mappings: The Poller Fleet

Serverless & Event-Driven: EventBridge Mastery

Introduction: The Nervous System of AWS

Event Buses: Default, Custom, and Partner

Events: The JSON Payload

Rules: The Routing Logic

Targets and Delivery Guarantees

Schema Registry: The Contract Between Teams

EventBridge Pipes: Point-to-Point Enrichment

Architectural Patterns and Production Considerations

Serverless & Event-Driven: SQS & SNS Mastery

Introduction: Decoupling with Messages

SQS Standard vs. FIFO: Speed vs. Order

The Fan-Out Pattern: SNS + SQS

Visibility Timeout: Preventing Double Work

Dead Letter Queues (DLQ): The Graveyard

SQS Long Polling vs. Short Polling

Management & Governance: The Control Tower

Introduction: Cattle, Pets, and Guardrails

Systems Manager: The End of the Bastion Host

CloudFormation: Managing Reality vs. Code

AWS Config vs. CloudTrail

Security Services: The Defense Layer

Introduction: Security in Depth

KMS: The Core of Encryption

KMS: Multi-Region Keys

GuardDuty: The Intelligent Watchdog

WAF vs. Shield: The Shield and The Sword

Macie: Finding the Needle in the Haystack

Cost Management: Taming the Cloud Bill

Introduction: The "Bill Shock" Reality

Cost Explorer vs. Cost & Usage Report (CUR)

Savings Plans vs. Reserved Instances (RIs)

Tagging Policies: Showback vs. Chargeback

The AWS Well-Architected Framework

Introduction: The Architect's Compass

Pillar 1: Operational Excellence

Pillar 2: Security

Pillar 3: Reliability

Pillar 4: Performance Efficiency

Pillar 5: Cost Optimization

Pillar 6: Sustainability

Control Plane vs. Data Plane: The Architecture of Reliability

Introduction: The Pilot and The Engines

The Availability Gap

The Cardinal Sin: Control Plane Dependency

Static Stability: The Holy Grail

Case Study: Route 53 and the 100% SLA

The "Big Red Button" Problem

Limiting the Blast Radius: Cellular Architecture

Advanced DynamoDB Modeling: Beyond the Basics

Introduction: From Tables to Graphs

Adjacency Lists: The Schema Pattern

Write Sharding: Solving the Hot Partition

Sparse Indexes: The "To-Do List" Pattern

Putting It All Together: Choosing the Right Pattern

Karpenter vs. Cluster Autoscaler: The Evolution of K8s Scaling

Introduction: The "Pending Pod" Problem

Cluster Autoscaler (CAS): The "ASG Manager

Karpenter: Just-in-Time Provisioning

Bin-Packing: The Game of Tetris

Disruption & Consolidation: Cleaning Up

Head-to-Head Comparison: When to Use Each

Networking Physics: Direct Connect, GWLB, & EFA

Introduction: When Standard Networking Isn't Enough

Direct Connect (DX): The Physical Layer

Gateway Load Balancer (GWLB): The Transparent Inspection Problem

Elastic Fabric Adapter (EFA): Bypassing the Operating System

Isolation Zones: Cell-Based Architecture & Stability

Introduction: Limiting the Blast Radius

Cell-Based Architecture: The Ultimate Bulkhead

Shuffle Sharding: The Math of Resilience

Static Stability: Surviving Without Changing

Putting It Together: The Isolation Zone Stack

Containers & Orchestration: EKS Mastery

Introduction: Kubernetes, The AWS Way

Managed Control Plane Architecture

Node Groups: Managed, Self-Managed, and Fargate

Pod Networking: The VPC CNI Plugin

Advanced Networking: Prefix Delegation

EKS Add-ons: Managing Operational Software

IRSA: IAM Roles for Service Accounts

Containers & Orchestration: ECS Mastery

Introduction: The "AWS Native" Orchestrator

Task Definitions: The Blueprint

Services: The Fleet Manager

Capacity Providers: The Bridge to Infrastructure

ECS vs. EKS: The Trade-offs

Containers & Orchestration: Fargate Mastery

Introduction: Serverless Containers

Fargate Platform Versions: 1.3 vs. 1.4

Fargate Networking: The ENI Per Task Model

Fargate Pricing: The Math That Matters

Compute Scaling Primitives: Mastering the ASG

Introduction: The Elasticity Engine

Launch Templates vs. Launch Configurations

Lifecycle Hooks: The "Pause" Button

Warm Pools: Cheating the Boot Time

Putting It All Together: The Production Pattern

API Gateway & Edge Networking

Introduction: The Digital Front Door

REST APIs vs. HTTP APIs: The Decision Matrix

Endpoint Types: Edge, Regional, & Private

Throttling: The Token Bucket Algorithm

Custom Authorizers: The Lambda Bouncer

Integration Types: How API Gateway Connects to Your Backend

API Gateway & Edge Networking: CloudFront Advanced

Introduction: The Layers of the Edge

Origin Shield: The "Super Cache

Compute at the Edge: Lambda@Edge vs. CloudFront Functions

Securing Content: Signed URLs vs. Signed Cookies

Cache Behavior and Cache Key Engineering

Route 53 Deep Dive: The Global Traffic Controller

Introduction: More Than Just a Phone Book

Routing Policies: Simple, Weighted, & Multi-Value

Routing Policies: Latency vs. Geolocation

Geoproximity Routing: Shifting Traffic by Bias

Failover Routing: Active-Passive Disaster Recovery

Health Checks: The Heartbeat Monitor

Alias Records vs. CNAME Records

Caching & Search Engines: ElastiCache Mastery

Introduction: The Millisecond Imperative

Memcached vs. Redis: The First Choice

Redis Cluster Mode: Disabled vs. Enabled

Global Datastore: Going Multi-Region

Cache Eviction Policies and TTL Strategy

Cache Invalidation Patterns

MemoryDB: The Durable Redis

Introduction: When Cache Becomes Database

Durability Architecture: The Transaction Log

MemoryDB vs. ElastiCache: The Decision Matrix

Cluster Architecture: Sharding and Replication

Snapshots, Restore, and Disaster Recovery

Failover Mechanics: What Actually Happens When a Node Dies

OpenSearch Service: Advanced Architecture

Introduction: Beyond the Search Box

The Brain vs. The Body: Dedicated Master Nodes

The Storage Tiers: Hot, Warm, and Cold

Deep Dive: How UltraWarm Works

Cross-Cluster Search: The Federation

Cross-Cluster Replication (CCR)

Streaming & Messaging: Kinesis Mastery

Introduction: Streams vs. Firehose

Kinesis Data Streams: Sharding Physics

Enhanced Fan-Out: Breaking the Read Limit

Kinesis Firehose: The Buffer Logic

Kinesis vs. SQS: Choosing the Right Tool

Amazon MSK: Kafka Re-Architected

Introduction: Kafka without the Headache

ZooKeeperless Mode (KRaft)

Tiered Storage: Infinite Retention

MSK Serverless: Zero-Capacity Planning

Identity & Auth: Amazon Cognito User Pools

Introduction: User Pools vs. Identity Pools

The Authentication Flow: OIDC & JWTs

The Hosted UI: Authentication out of the Box

User Pool Configuration: The Key Settings

Triggers: The Logic Hooks (Lambda)

Identity & Auth: Cognito Identity Pools

Introduction: The AWS Vending Machine

Authentication vs. Authorization Roles

The Flow: From App to S3

Row-Level Security: IAM Policy Variables

Identity Pool vs. User Pool — Knowing Which to Use

CloudWatch Advanced: Insights, Filters, & Alarms

Introduction: Stop Grepping Production

CloudWatch Logs Insights

Metric Filters: Logs to Metrics

Composite Alarms

Deep Observability: AWS X-Ray & Distributed Tracing

Introduction: The Distributed Needle in a Haystack

X-Ray Architecture: The Daemon & The UDP Sidecar

Sampling Rules: Managing Cost & Noise

Segments vs. Subsegments: The Anatomy of a Trace

Annotations vs. Metadata: Making Traces Searchable

The X-Ray Service Map: Reading Your Architecture's Health

Backup & Recovery: AWS Backup Mastery

Introduction: From Scripts to Policy

Cross-Region & Cross-Account Copies

Vault Lock: The Indestructible Safety Net

Backup Plans, Schedules, and Lifecycle Rules

CLI & SDK Setup: Automating the Cloud

Introduction: The Builder's Tools

Initial Configuration: Your First aws configure

Profiles: Managing Multiple AWS Accounts

Credential Provider Chain: The Hierarchy of Config

MFA on CLI: The Access Denied Trap

Boto3 Session Management: Writing Correct Python Code

Hybrid Cloud & Edge: Bridging the Gap

Introduction: Physics and The Law

AWS Outposts: Cloud in a Box

Systems Manager (SSM) for Hybrid Environments

Choosing the Right Hybrid Tool

AWS IoT: Connecting the Physical World

IoT Core: The Message Broker

Device Shadows: Talking to Ghosts

IoT Greengrass: Lambda at the Edge

IoT Rules Engine: Routing Data to AWS Services

End User Computing (EUC): WorkSpaces & AppStream 2.0

Introduction: Desktop vs. Application

Amazon WorkSpaces: The Persistent Desktop

Amazon AppStream 2.0: The Ephemeral Stream

VDI Patterns in the Cloud

Control Tower & Landing Zones: Multi-Account Mastery

Introduction: The Multi-Account Reality

The Landing Zone: What Gets Built

The Account Vending Machine (Account Factory)

AWS Organizations & OUs: The Hierarchy

Service Control Policies (SCPs): The Guardrails

Control Tower Guardrails vs. SCPs: Understanding the Difference

AWS VPC Lattice: Application Networking Simplified

Introduction: Wiring vs. Directory

The Core Hierarchy

The "Killer Feature": Overlapping IPs

Zero Trust: IAM Auth Policies

Lattice vs. Alternatives: When to Use What

AWS Nitro Enclaves: The Digital Vault

Introduction: The Root User Problem

Architecture: The Isolated Sibling

Cryptographic Attestation: The ID Badge

Resource Allocation: Stealing from the Parent

AWS Fault Injection Service (FIS): Chaos Engineering

Introduction: Breaking Things on Purpose

The Experiment Anatomy: Templates, Actions, Targets, and Stop Conditions

Deep Dive: The SSM Integration for OS-Level Faults

Designing Safe Chaos Experiments: The GameDay Workflow

This is one of 18 chapters

Get every chapter — Kubernetes, Terraform, SRE, distributed systems, and more — with fast daily review built in.