Amazon Web Services
Also known as: AWS
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Amazon Web Services?
Amazon Web Services (AWS) is the world's most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally.
As the pioneer of modern cloud computing, AWS provides on-demand infrastructure, platform, and software services with pay-as-you-go pricing. It abstracts physical data centers into scalable, programmatic APIs, enabling everything from simple web hosting to complex machine learning pipelines and exabyte-scale data lakes.
AWS's vast ecosystem defines many of the architectural patterns used in modern software engineering. Its core primitives—like EC2 (compute), S3 (storage), and VPC (networking)—serve as the foundational building blocks for millions of enterprise, startup, and government workloads.
Providing highly reliable, scalable, low-cost cloud infrastructure and managed services on demand.
- Hosting globally distributed web applications and APIs
- Building enterprise data lakes and analytics pipelines
- Deploying serverless and containerized microservices
- Running mission-critical enterprise workloads and disaster recovery
Explore related technologies
Sub-technologies
24+ resources for Amazon Web Services
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Amazon Web Services
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Graduate Learning(8)
Build practical knowledge and hands-on skills.
- How to Validate a Cloud Infrastructure Task in Amazon Web ServicesOpen
- Enforcing AWS Auto Scaling Health Checks for Resilient EC2Open
- Building Site-to-Site VPN Failover Between Branch and AWSOpen
- Enforcing AWS Resource Tagging with Tag Policies and SCPsOpen
- Locking Down Production RDS Backups with AWS Backup Vault LockOpen
- Automated EC2 Patch Compliance with AWS Systems ManagerOpen
- Configuring AWS Budgets and Cost Anomaly Detection for ProductionOpen
- Building a Governed AWS Landing Zone with Entra ID FederationOpen
Ops Playbooks(2)
Operate, maintain and improve it in production.
Daily Triage(1)
Practise diagnosis through bounded engineering scenarios.
Config Traps(12+)
Recognise and avoid known failure modes.
- RDS PubliclyAccessible Flag Hides an Open Security Group RulePubliclyAccessible=false only blocks a public IP address; it does not scope security group ingress. A stray 0.0.0.0/0 rule left over from a migration can leave RDS reachable from any routable network. Open
- CloudTrail's IsLogging Flag Stays True While S3 Delivery Silently FailsCloudTrail's logging flag reflects configuration, not delivery. A missing bucket or KMS policy statement can stop logs landing while the trail still reports as on. Open
- Unscoped iam:PassRole Grants Let Lambda Roles Escalate to AdminA wildcard iam:PassRole grant lets an AWS Lambda deploy identity pass any role, including privileged ones, to a function it controls — a quiet path to full account escalation. Open
- Private S3 ACL Still Leaves Objects Publicly ReadableA private S3 ACL does not mean a private bucket. A leftover bucket-policy statement and partially configured Block Public Access settings can leave objects publicly readable until both layers are checked together. Open
- IAM NotResource Allow Grants Access Beyond the Tested S3 BucketA deceptive AWS IAM NotResource-plus-Allow statement grants access to every bucket except the one used for testing. Diagnose, correct and roll back safely. Open
- IAM Role Chaining Through Lambda PassRole WildcardsA deployment role that can pass any IAM role to a Lambda function inherits whatever that role can reach next, because AWS evaluates each sts:AssumeRole hop against the target's trust policy alone. Wildcarded principal patterns turn a single PassRole grant into a multi-hop climb toward administrator access that no PassRole audit alone will catch. Open
- Missing sts:ExternalId Enables Confused Deputy AttacksA shared vendor AWS account with dozens of customer cross-account roles trusts only the account ARN, not a distinct ExternalId. Any tenant holding a valid RoleArn can be redirected by the vendor's own automation into assuming a different customer's role, and CloudTrail logs it as legitimate. Open
- S3 StringLike Conditions: The Wildcard Principal EscapeA bucket policy grants Principal "*" and relies on a StringLike condition against aws:PrincipalArn to narrow access, but the glob pattern matches any account number in that ARN segment, and IAM Access Analyzer excludes the bucket from its public findings once that condition key appears, so no scanner in the account ever flags the exposure. Open
- Root Exemptions in SCPs Undo Every Deny ClauseAcross many AWS Organizations, custom Deny SCPs inherit a PrincipalArn exemption originally written to stop root lockout, so root sessions in member accounts skip every guardrail built afterwards. When root credentials are exposed, no SCP statement blocks LeaveOrganization or StopLogging, and the same session can erase the evidence. Open
- Lambda UpdateFunctionCode Bypasses the PassRole CheckA CI/CD deploy role in AWS Lambda holds lambda:UpdateFunctionCode and lambda:InvokeFunction against a function whose execution role already carries broad S3, DynamoDB and KMS access. IAM's PassRole check never fires because the role isn't being reassigned, so anyone who can push new code inherits that role's full permission set the moment it runs. Open
- RDS PubliclyAccessible Fixes Wait for Maintenance WindowAn engineer runs modify-db-instance with -no-publicly-accessible but omits -apply-immediately, so AWS defers the change to the next maintenance window while the instance keeps answering on 3306 or 5432 across 0.0.0.0/0. Security Hub, ticketing systems and the engineer all treat the exposure as closed while it remains live for days. Open
- Trust Policies With Wildcard Root ARNs Skip ExternalIdA cross-account role in AWS IAM trusts arn:aws:iam::*:root without an sts:ExternalId condition, letting any AWS account call sts:AssumeRole successfully. CloudTrail shows a valid, authenticated call, so GuardDuty and standard IAM reviews rarely flag the session as anomalous until data has already moved. Open
Incident Runbooks(1)
Stabilise, recover and validate during incidents.