W3DevOps Module · AWS: IAM Least Privilege, EC2 + EBS, S3 Hosting, VPC Subnetting and Terraform
The AWS track of my DevOps handbook: root vs IAM users, JSON policies, mounting an EBS volume, EC2 user-data bootstrapping, S3 SPA hosting, CIDR math for VPCs, and a complete Terraform script.
My production work lives mostly on Google Cloud, but AWS is where I learned the vocabulary: least-privilege IAM, security groups, public vs private subnets, infrastructure as code. This is the AWS module of the course — five lessons, 18 lab captures.
What this module covers
- AWS global infrastructure and the IAM ground rules (never use root; roles over keys)
- Writing a least-privilege JSON policy
- EC2 anatomy, formatting and mounting an extra EBS volume, and User Data bootstrap scripts
- S3 storage classes and hosting a React/Vue SPA with correct 404 routing
- VPC CIDR math (
/16vs/24), IGW, NAT and route tables - Terraform:
init → plan → apply → destroywith a full EC2 + Security Group + S3 example
Lessons in this module
- AWS Cloud Architecture & Identity Access Management (IAM) — Amazon Web Services (AWS) is the world's most comprehensive cloud computing platform. Before launching servers, understanding its global infrastructure and identity security model is mandatory.
- Amazon EC2 (Elastic Compute Cloud) & EBS Volumes — Amazon EC2 provides resizable virtual compute capacity in the cloud. It eliminates the need to invest in on-premise hardware up front, letting you launch hundreds of virtual servers in seconds.
- Amazon S3 (Simple Storage Service) & Static Hosting — Amazon S3 provides object storage designed for 99.999999999% (11 9's) of data durability. Unlike block storage (EBS) or filesystem storage (EFS), S3 stores data as objects with metadata and a unique key…
- Amazon Virtual Private Cloud (VPC) Networking — A VPC is your own logically isolated private virtual data center inside AWS. It gives you complete control over your virtual networking environment, including IP address ranges, subnets, route tables, and…
- Infrastructure as Code (IaC) with Terraform on AWS — Clicking in the AWS Console is prone to human error and cannot be reviewed or version controlled. Terraform allows you to define your entire AWS infrastructure declaratively in code, store it in Git, and…
Start with Lesson 12: AWS Cloud Architecture & Identity Access Management (IAM) — every lesson links to the next, and you can mark each one complete.
The same ideas on Google Cloud
The lesson that carried over most directly is "roles over keys". In AWS it's an IAM role on the EC2 instance instead of access keys on disk. On GCP my CI pipelines use Workload Identity Federation: GitHub Actions exchanges its OIDC token for short-lived Google credentials, so there is no service-account JSON key in GitHub secrets at all. CryptoEdge and The Part Timer both deploy that way — see How I Ship 23 Projects for the full workflow files.
Next in the series: Google Cloud fundamentals.
Keep going: Start the module → · Full course outline · Self Guide
Finished this one?
Part of Self Guide · Stage 5: AWS fundamentals. Progress is saved in this browser.
