AWS (Amazon Web Services) is a cloud provider: it rents you computers, databases, networks, and hundreds of other services over the internet. Here are the AWS concepts this repository actually uses. Skim now; refer back as they appear.
Accounts and organization
- AWS Account - A container that owns resources and gets one bill. Think of it
as a tenant boundary. This project uses multiple accounts (separate accounts
for dev, staging, prod, and security) so that a mistake in dev cannot touch prod.
Each account has a 12-digit ID like
123456789012. - AWS Organizations - A feature that groups many accounts under one management account (the "root" of the org), with central billing and central policy control.
- OU (Organizational Unit) - A folder for accounts inside an Organization. You can attach policies to an OU and every account inside inherits them.
- SCP (Service Control Policy) - A guardrail policy attached to an OU or account that sets the maximum allowed permissions. Even an administrator cannot exceed an SCP. This repo uses an SCP to, for example, forbid using AWS regions outside Canada.
- Region - A geographic location where AWS has data centers, e.g.
ca-central-1(Montreal). Resources live in a region. This project's primary region isca-central-1. - AZ (Availability Zone) - One or more physically separate data centers inside
a region, e.g.
ca-central-1a,ca-central-1b. Spreading resources across AZs is how you get High Availability within a region.
Identity and permissions
- IAM (Identity and Access Management) - AWS's permission system. It controls who (a user, or a service) can do what (the actions) on which resources.
- IAM Role - An identity with a set of permissions that something can assume (temporarily become) - used by services, not logged into like a user. For example, the pipeline's build server assumes a role to be allowed to create infrastructure.
- IAM Policy - A JSON document listing allowed/denied actions. Attached to roles/users.
- Assume role - Temporarily taking on a role's permissions.
- IAM Identity Center - AWS's single sign-on. Here it is connected to Microsoft Entra (formerly Azure AD) so employees log in with their company account.
- ARN (Amazon Resource Name) - The globally unique ID of any AWS resource,
e.g.
arn:aws:s3:::my-bucket. You will see ARNs everywhere.
Networking
- VPC (Virtual Private Cloud) - Your own private, isolated network inside AWS. Everything you run lives in a VPC.
- CIDR block - A range of IP addresses written like
10.0.0.0/16. The/16says how many addresses are in the range (smaller number = bigger range). The VPC gets a big range; subnets carve smaller ranges out of it. - Subnet - A slice of the VPC's IP range, tied to one AZ. This project uses
three tiers of subnet:
- public - can reach and be reached from the internet (holds load balancers).
- app (private) - no direct inbound internet; this is where the application servers run.
- data (isolated) - most locked down; holds the database and cache.
- Internet Gateway (IGW) - The VPC's door to the public internet.
- NAT Gateway - Lets resources in a private subnet make outbound internet calls (e.g. to download updates) without being reachable from the internet.
- Route Table - Rules that decide where network traffic goes (e.g. "internet traffic goes through the NAT Gateway").
- Security Group (SG) - A virtual firewall around a resource: which ports and sources are allowed in (ingress) and out (egress).
- VPC Endpoint - A private doorway from your VPC directly to an AWS service (like S3), so traffic never leaves AWS's network. A Gateway endpoint (for S3) is free; an Interface endpoint costs money but works for more services.
Compute, data, edge
- ECS (Elastic Container Service) / Fargate - Runs your app as containers (Docker). Fargate is the "serverless" flavor where AWS manages the underlying machines for you.
- ALB (Application Load Balancer) - Distributes incoming web requests across multiple copies of your app.
- ECR (Elastic Container Registry) - AWS's private Docker image registry.
- RDS (Relational Database Service) - Managed databases; this project uses RDS for PostgreSQL. Multi-AZ means RDS keeps a standby copy in another AZ for HA.
- ElastiCache / Redis - Managed in-memory cache, used here as a fast store and realtime backplane.
- S3 (Simple Storage Service) - Object storage: you put files ("objects") into "buckets". Used for file uploads and for hosting static website files.
- CloudFront - AWS's CDN (Content Delivery Network): caches content close to users worldwide for speed.
- WAF (Web Application Firewall) - Filters malicious web traffic.
- API Gateway - A managed front door for APIs.
- Route 53 - AWS's DNS service (maps domain names like
app.example.comto resources). A hosted zone is the container for a domain's DNS records. - ACM (AWS Certificate Manager) - Issues HTTPS/TLS certificates.
- KMS (Key Management Service) - Manages encryption keys. "Encrypt with KMS" means AWS holds the key and controls who can use it.
Operations and cost
- CloudWatch - AWS's monitoring: metrics, logs, and alarms (alerts).
- CloudTrail - An audit log of every action taken in the account ("who did what, when").
- SNS (Simple Notification Service) - Sends notifications (e.g. emails) when an alarm fires.
- Budgets - Spending limits that alert you when costs approach a threshold.
- CodePipeline / CodeBuild / CodeStar Connection - AWS's own CI/CD services (covered in detail in section 13).
You now have the full vocabulary. Everything below builds on it.