AWS HOME

# ===== Account + identity =====
# Root account -> use ONLY to create the first IAM admin user, then lock away
# IAM users / roles for everyone + every service
# AWS Organizations to manage multi-account
# Identity Center (formerly SSO) for human access

# ===== Regions + AZs =====
# Region: ap-southeast-2 (Sydney), us-east-1 (N. Virginia), eu-west-1 (Dublin), ...
# Each region has multiple Availability Zones (AZ) — isolated data centres
# Most services are regional; design for multi-AZ first, multi-region only if needed

# ===== The services you actually use early =====
# Compute:    EC2, Lambda, ECS/Fargate, EKS
# Storage:    S3 (object), EBS (block), EFS (file)
# Database:   RDS (Postgres/MySQL/etc), DynamoDB (NoSQL), Aurora
# Network:    VPC, ELB, Route 53, CloudFront, API Gateway
# Messaging:  SQS (queues), SNS (topics), EventBridge (events)
# Observ.:    CloudWatch (logs, metrics, alarms), X-Ray (tracing)
# Security:   IAM, KMS, Secrets Manager, GuardDuty, WAF

# ===== Hello, S3 =====
aws s3 mb s3://my-bucket-1234
echo 'hi' > hi.txt
aws s3 cp hi.txt s3://my-bucket-1234/
aws s3 ls s3://my-bucket-1234/

# ===== Hello, Lambda + API Gateway =====
# Simplest serverless API: a function, a route, IAM policy, done.
# IaC is the right way to wire this; see Terraform / CDK / SAM.

# ===== Tools =====
# aws-cli         the canonical CLI
# AWS CDK         IaC in TS / Python / Java / .NET
# Terraform       multi-cloud IaC
# Serverless Fwk  Lambda-focused
# Console         the GUI; great for exploration, bad for repeatability

# ===== When AWS wins =====
# - Need lots of services that talk to each other
# - Enterprise compliance requirements
# - Global scale + many regions
# - Deep integration with corporate networking (Direct Connect, etc)

# ===== When AWS hurts =====
# - Cost surprises if you don't tag / alert
# - Console clickops becomes the source of truth (don't let it)
# - Steep learning curve; pick a small set of services to start

# ===== Patterns to internalise =====
# - IaC from day one — even toy projects
# - Least privilege IAM; one role per workload
# - Tag every resource with project + env + owner
# - Budget alarms + Cost Anomaly Detection before launch

# ===== Pitfalls =====
# - Root account in daily use
# - Public S3 buckets (default to BLOCK PUBLIC ACCESS at the account level)
# - NAT Gateway egress costs surprising you
# - Forgetting to scope IAM by resource (write a wildcard, regret a wildcard)

aws --version
aws sts get-caller-identity