AWS Cloud Services Hub

Amazon Web Services (AWS) is Amazon’s public cloud: several hundred managed services, from virtual machines and object storage to databases, analytics, and machine learning, rented on demand through APIs and billed by usage. This hub introduces the concepts every AWS design depends on (global infrastructure, accounts, shared responsibility, and pricing) and links to focused guides for each service area.

Guides

How the services fit together

A typical web workload draws on every guide at once. Requests enter through the networking edge, run on compute in private subnets, and persist state in managed databases and storage; security controls govern every layer, and infrastructure-as-code and monitoring wrap the whole system.

flowchart TB
    Users([Users]) --> Edge["Networking edge<br/>Route 53 · CloudFront · ALB / API Gateway"]
    Edge --> Compute["Compute<br/>EC2 · ECS / Fargate · Lambda"]
    Compute --> DB["Databases<br/>Aurora / RDS · DynamoDB · ElastiCache"]
    Compute --> Storage["Storage<br/>S3 · EBS · EFS"]
    Compute --> Msg["Messaging<br/>SQS · SNS · EventBridge"]
    Msg --> Compute
    Sec["Security<br/>IAM · KMS · WAF"] -. governs .-> Edge
    Sec -. governs .-> Compute
    Sec -. governs .-> DB
    IaC["Infrastructure as code<br/>CloudFormation · CDK"] -. provisions .-> Compute
    Obs["Monitoring<br/>CloudWatch · X-Ray"] -. observes .-> Compute

Core concepts

Global infrastructure

flowchart TB
    G[AWS global network] --> R1["Region<br/>e.g. us-east-1"]
    G --> R2["Region<br/>e.g. eu-west-1"]
    G --> E["Edge locations<br/>CloudFront · Route 53 · Global Accelerator"]
    R1 --> AZ1["Availability Zone a<br/>one or more data centers"]
    R1 --> AZ2["Availability Zone b"]
    R1 --> AZ3["Availability Zone c"]
    R1 -. extends to .-> LZ["Local Zones · Wavelength ·<br/>Outposts (on premises)"]

AZ names such as us-east-1a are mapped to physical zones differently in each account; use AZ IDs (use1-az1) when coordinating placement across accounts.

Some services are global rather than regional (IAM, Route 53, CloudFront, Organizations), and their control planes are hosted in us-east-1. That is why CloudFront certificates must be issued in ACM in us-east-1, and why billing metrics appear only there.

Accounts and organizations

An AWS account is the fundamental boundary for resources, permissions, quotas, and billing. Production environments use many accounts rather than one:

• AWS Organizations groups accounts into organizational units (OUs), consolidates billing, and applies service control policies (SCPs) and resource control policies (RCPs) that cap what any identity or resource in those accounts can do.
• AWS Control Tower sets up a multi-account landing zone with log-archive and audit accounts, guardrails, and account vending.
• IAM Identity Center provides single sign-on for people across all accounts, issuing short-lived credentials instead of long-lived IAM users and access keys.

A common layout separates security tooling, logging, shared networking, and each workload’s dev, staging, and production environments into their own accounts. Account boundaries limit blast radius far more reliably than IAM policies within one account. See Security.

Shared responsibility

AWS is responsible for security of the cloud: physical facilities, hardware, the hypervisor, and the managed-service software. The customer is responsible for security in the cloud: identities and permissions, network exposure, encryption choices, patching of anything the customer operates, and application code. The line moves with the service: on EC2 you patch the operating system; on Lambda, Fargate, or DynamoDB, AWS does. Most real-world AWS breaches trace back to the customer side of the line: overly broad IAM permissions, leaked access keys, and publicly exposed storage.

Pricing model

• On-demand, usage-based billing per second, hour, request, or GB, with no upfront commitment.
• Commitment discounts: Savings Plans and Reserved Instances trade a one- or three-year spend commitment for substantially lower rates on steady workloads.
• Spot capacity: spare EC2 and Fargate capacity at a steep discount, reclaimable with a two-minute warning; suited to fault-tolerant and batch work.
• Data transfer: inbound traffic is free; outbound to the internet, cross-Region, and cross-AZ traffic is billed, and NAT gateway processing is a frequent surprise. Architecture decisions often matter more to the bill than instance choices.
• Free Tier offers limited usage and credits for new accounts.

Cost visibility needs deliberate setup: cost allocation tags, AWS Budgets alerts, and Cost Explorer. See Cost Optimization.

Well-Architected Framework

The AWS Well-Architected Framework is AWS’s review methodology, organised into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. The Well-Architected Tool in the console walks a workload through the questions for each pillar and records improvement items; specialised lenses extend it to serverless, SaaS, machine learning, and other domains.

Learning path

See Also

• Terraform - Multi-cloud infrastructure as code
• Kubernetes - Container orchestration, including EKS
• Docker - Container fundamentals
• Networking Fundamentals - Protocols and concepts underneath VPC design
• Observability - Metrics, logs, and traces in general
• Distributed Systems - Consistency, replication, and failure handling behind cloud architectures