Amazon Web Services
Also known as: AWS
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Amazon Web Services?
Amazon Web Services (AWS) is the world's most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally.
As the pioneer of modern cloud computing, AWS provides on-demand infrastructure, platform, and software services with pay-as-you-go pricing. It abstracts physical data centers into scalable, programmatic APIs, enabling everything from simple web hosting to complex machine learning pipelines and exabyte-scale data lakes.
AWS's vast ecosystem defines many of the architectural patterns used in modern software engineering. Its core primitives—like EC2 (compute), S3 (storage), and VPC (networking)—serve as the foundational building blocks for millions of enterprise, startup, and government workloads.
Providing highly reliable, scalable, low-cost cloud infrastructure and managed services on demand.
- Hosting globally distributed web applications and APIs
- Building enterprise data lakes and analytics pipelines
- Deploying serverless and containerized microservices
- Running mission-critical enterprise workloads and disaster recovery
Explore related technologies
Sub-technologies
Diagnose and connect Amazon Web Services
Exact failure lookups, verified technology boundaries and reusable operational artifacts.
33+ resources for Amazon Web Services
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Amazon Web Services
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(3)
Start here: understand the core vocabulary.
Graduate Learning(8)
Build practical knowledge and hands-on skills.
- How to Validate a Cloud Infrastructure Task in Amazon Web ServicesOpen
- Enforcing AWS Auto Scaling Health Checks for Resilient EC2Open
- Building Site-to-Site VPN Failover Between Branch and AWSOpen
- Enforcing AWS Resource Tagging with Tag Policies and SCPsOpen
- Locking Down Production RDS Backups with AWS Backup Vault LockOpen
- Automated EC2 Patch Compliance with AWS Systems ManagerOpen
- Configuring AWS Budgets and Cost Anomaly Detection for ProductionOpen
- Building a Governed AWS Landing Zone with Entra ID FederationOpen
Ops Playbooks(7)
Operate, maintain and improve it in production.
- Standardising Serverless & Software Edge Runtimes with AWS LambdaOpen
- Recovering Serverless & Software Edge Runtimes Safely with AWS LambdaOpen
- Serverless & Software Edge Runtimes Change Control with AWS LambdaOpen
- Making Serverless & Software Edge Runtimes Repeatable with AWS LambdaOpen
- Standardising a Serverless & Software Edge Runtime Workflow with AWS LambdaOpen
- Replacing Manual Multi-Cloud Work with a Verifiable AWS WorkflowOpen
- A Practical Workflow for Serverless Edge Runtimes with AWS LambdaOpen
Daily Triage(1)
Practise diagnosis through bounded engineering scenarios.
Config Traps(12+)
Recognise and avoid known failure modes.
- RDS Security Group Rule Referencing a Shared SG Lets All Its Members Reach the DatabaseAn RDS rule that allows traffic from a security group ID looks tightly scoped but silently grants access to every future member of that shared group. Open
- A CloudTrail Trail Marked 'Logging' That Silently Excludes Data EventsA CloudTrail trail can report IsLogging true while data events for S3 and Lambda remain fully disabled, leaving no forensic record of object access or function invocations despite an apparently healthy trail status. Open
- iam:PassRole Without a Service Condition Lets Any User Escalate to AdminA broad iam:PassRole grant without a PassedToService condition lets low-privilege users attach administrator roles to resources they launch, silently escalating privilege with no denied-call signal. Open
- Bucket-Level Public Access Block Silently Loses to a Permissive Bucket ACLEnabling S3 Public Access Block at the bucket level does not remove a pre-existing permissive bucket ACL; the ACL grant can remain active until it is directly corrected and account-level Block Public Access is confirmed. Open
- A Security Group Referencing Itself Silently Opens Every Port Inside a VPCA self-referencing security group rule looked like a safe intra-tier allowance, but an unscoped port range from an old troubleshooting session let every instance in the group reach every other instance on every port. Open
- AWS IAM Policy Design Defaults Silently Override Expected SafeguardsAn AWS IAM policy relying on implicit defaults for resource scoping fails to restrict access when new services are added, leading to unintended privilege escalation. Open
- SCP Allow-List Still Permits Everything When FullAWSAccess Stays AttachedAttaching a restrictive SCP without detaching the default FullAWSAccess policy leaves every account in the OU with unrestricted access, because AWS Organizations combines allow-type SCPs by union rather than intersection. Open
- Lambda Role Changes Don't Revoke Resource-Policy Invoke AccessA team revokes an external partner's Lambda access by editing the execution role, but the invoke grant actually lives in a separate resource-based policy and remains active until removed directly. Open
- RDS Publicly Accessible No Leaves an Open Security Group Rule LivePubliclyAccessible No only removes an RDS instance's public IP; a leftover 0.0.0.0/0 security group rule keeps the database reachable from anywhere already inside the VPC, and can be silently reactivated by a restore or replica promotion. Open
- Service Control Policies Never Restrict the AWS Organizations Management AccountA Root-level SCP looks like an organization-wide guardrail, but AWS Organizations never enforces SCPs against the management account, leaving its root user and IAM principals unconstrained. Open
- EC2 Instances Without IMDSv2 Enforcement Let SSRF Steal IAM Role CredentialsLeaving IMDSv1 permitted on an EC2 instance turns an ordinary SSRF bug into a route to the instance's live IAM role credentials. Here is the exact misconfiguration, the diagnosis, the fix and the rollback boundary. Open
- S3 Default Bucket Encryption Skips Every Object Uploaded Before It Was EnabledTurning on Amazon S3 default bucket encryption looks like a bucket-wide fix, but it only governs new writes. Objects already stored before the change remains untouched, and audits that trust the flag alone miss it. Open
Incident Runbooks(2)
Stabilise, recover and validate during incidents.
- AWS Step Functions Execution Timeout: Diagnose States.TimeoutDiagnose an AWS Step Functions States.Timeout by separating workflow, task, heartbeat, HTTP Task and downstream-service limits, then change retry, catch or timeout policy only after duplicate side effects and execution type are understood. Open
- AWS DRS Replication Agent Crash or Agent Not SeenDiagnose an AWS Elastic Disaster Recovery replication agent crash or AGENT_NOT_SEEN state by checking the source service, agent logs, regional endpoint access and TCP 1500 path before any restart or reinstall that could trigger a rescan and affect RPO. Open