Course · 12

How do you run servers, networks, logins and files on AWS?

This page covers the AWS building blocks that show up in almost every design interview: where AWS runs, servers (EC2), scaling, load balancers, containers, Lambda, private networks (VPC), DNS, a CDN, logins and permissions (IAM), and file storage (S3). Every number was checked on docs.aws.amazon.com on 2026-10-25.

—Words you need

Each jargon word once, in plain words glossary

01Regions, Availability Zones, edge locations

Where AWS physically runs, and why you spread across AZs core

A Region is a place in the world, such as us-east-1 (N. Virginia). Inside it are Availability Zones. An AZ is one or more data centers with their own power, network and cooling. AZs in a Region are linked by fast private networks. So you can copy data between them with low delay.

Edge locations are much smaller sites in many more cities. CloudFront (the AWS CDN, a cache close to users) runs there. They do not run your servers.

Design for "one AZ dies": run at least two copies of everything in two AZs.

Source: AWS overview: global infrastructure · S3 data protection (AZ distance) · Regions table

02Who secures what: the shared responsibility model

AWS secures the cloud; you secure what you put in it interview favourite

AWS calls this "security of the cloud" versus "security in the cloud". AWS guards buildings, hardware, and the virtualization layer (the software that splits one machine into many). You guard your data, your settings and your code. The line moves with the service. The more managed the service, the more AWS does.

"Is it AWS's fault?" Almost never for a leaked bucket or an open port: those settings are yours.

Source: aws.amazon.com/compliance/shared-responsibility-model

03EC2: renting servers

Instance families, ways to pay, and the two kinds of disk core

An EC2 instance is a virtual server. Its type name tells you its shape. In c7gn.xlarge, c is the family (compute-heavy), 7 the generation, gn extra options (Graviton CPU, more network), and xlarge the size.

You start an instance from an AMI (Amazon Machine Image: a saved disk image with the OS and your software). Baking your app into an AMI makes new servers start faster.

Ways to pay

Two kinds of disk

Steady base load on Savings Plans, spikes on On-Demand, and retry-safe batch jobs on Spot.

Source: instance type names · Savings Plans · Reserved Instances · Spot (up to 90%, marketing page) · What is EBS

04Auto Scaling groups and load balancers

Add servers when busy, remove them when quiet, and send traffic only to healthy ones core

An Auto Scaling group (ASG) keeps a fleet between a minimum and a maximum size. It starts servers from a launch template: a saved recipe with the AMI, instance type, key pair and security groups. A scaling policy decides when to change the size.

Load balancers: three kinds

A target group is the list of servers (or IPs, or Lambda functions) behind a load balancer rule. Health checks are set per target group.

Cross-zone load balancing decides if a load balancer node may send traffic to servers in other AZs. The docs example has 2 servers in AZ A and 8 in AZ B, with each AZ's node getting half the traffic:

Put an ALB in front of an ASG spread over 2+ AZs, with ELB health checks turned on, so dead servers get replaced.

Source: launch templates · scheduled scaling · ASG health checks · ALB · NLB · GWLB

05Containers (ECS, EKS, Fargate) and Lambda

Less server work as you go right: EC2 → containers → functions core

A container packs your app with everything it needs, so it runs the same anywhere. AWS gives two ways to run many containers, and two places to run them.

Lambda: functions that run on events

Lambda runs your code when something happens: an HTTP call, a file landing in S3, a queue message. You pay only while it runs. Each running copy lives in an execution environment (a small isolated sandbox). Concurrency is how many copies run at the same moment.

A cold start happens when no warm environment is free. Lambda must download your code, start the runtime and run your setup code first. After the call, Lambda freezes the environment and reuses it ("warm start").

Short, spiky, event-driven work → Lambda. Long-running or steady services → containers on Fargate or EC2.

Source: What is ECS · What is EKS · Lambda quotas

06VPC: your private network

CIDR ranges, public and private subnets, internet gateway, NAT gateway, route tables interview favourite

A VPC (virtual private cloud) is a network only you use. You give it an address range in CIDR notation, for example 10.0.0.0/16. The number after the slash says how many bits are fixed. /16 leaves 16 free bits, so 65,536 addresses.

You cut the VPC into subnets. Each subnet lives in exactly one AZ. A route table on each subnet says where traffic may go. That route table, and nothing else, makes a subnet "public" or "private".

Only load balancers (and NAT) live in public subnets. Servers and databases live in private subnets.

Source: Subnets for your VPC · NAT gateways · Subnet CIDR blocks

07Firewalls, endpoints, and joining VPCs

Security groups vs NACLs, VPC endpoints, peering vs Transit Gateway interview favourite

Stateful means the firewall remembers a conversation, so the reply gets in without a rule. Stateless means each packet is judged alone, so you must open the reply ports too.

VPC endpoints: reach AWS services without the internet

Joining VPCs

Add an S3 gateway endpoint to every VPC: free, and S3 traffic stops paying NAT per-GB fees.

Source: PrivateLink concepts · VPC peering · Transit Gateway

08Route 53 and CloudFront

DNS that can route by health, weight, delay and place; a CDN at the edge core

Route 53 is AWS's DNS (the internet's phone book: name → IP). Each record has a routing policy that decides which answer to give.

CloudFront is the AWS CDN. A user's request goes to the edge location with the lowest delay. If the file is cached there, it is returned at once. If not, CloudFront fetches it from your origin (S3, a load balancer, any HTTP server).

Latency or failover records in Route 53 plus CloudFront in front give you a fast, multi-Region front door.

Source: Choosing a routing policy · CloudFront introduction

09IAM: users, groups, roles, policies

Who may do what, and why code should borrow keys, not own them interview favourite

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListObjectsInBucket",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::bucket-name"]        // the bucket itself
    },
    {
      "Sid": "AllObjectActions",
      "Effect": "Allow",
      "Action": "s3:*Object",                          // GetObject, PutObject, DeleteObject...
      "Resource": ["arn:aws:s3:::bucket-name/*"]      // objects inside it
    }
  ]
}

Least privilege means giving only the actions a task needs, on only the resources it needs. The policy above is a good start: one bucket, not "Resource": "*".

A role has two policies. The trust policy says who may assume it. The permissions policy says what it may do. On EC2 you never call STS yourself: the instance profile does it, and the SDK picks up the keys from instance metadata.

Code gets a role, never an access key in a config file. Explicit deny always wins.

Source: IAM example: read/write one bucket · IAM best practices

10S3: object storage

Storage classes, durability, consistency, versioning, lifecycle, pre-signed URLs, encryption deep dive

S3 stores objects (a file plus metadata) in buckets. Each object has a key, its full name like photos/puppy.jpg. There are no real folders: photos/ is just a prefix of the key.

Storage classes

All classes in the docs table are designed for 99.999999999% durability, except the old Reduced Redundancy class. They differ in price, availability, retrieval time, and the minimum storage duration (you pay at least this many days even if you delete sooner).

Features you will be asked about

S3 as a static website, behind CloudFront

S3 can serve a static site (HTML, CSS, JS). But the S3 website endpoint is HTTP only. For HTTPS, put CloudFront in front. Keep the bucket private and let only CloudFront read it, using Origin Access Control (OAC).

Upload directly from the browser with a pre-signed PUT URL, so big files never pass through your servers.

Source: storage classes · versioning · lifecycle · pre-signed URLs · encryption · uploading objects · performance

11Putting it together: a typical 3-tier web app

Web, app and data tiers across two AZs design

A 3-tier app splits into a front (web), a middle (app logic) and a back (database). On AWS the usual shape is below.

In an interview, draw this first, then say how each box survives losing one AZ.

Source: sections 04–10 of this page · VPC infrastructure security

—When to use what

Situation → pick → why decision table

—Common traps

Mistakes that cost money or uptime traps

—Interview questions

20 questions, easy to design-level. Try first, then open the answer practice

—Cheat sheet

Numbers to memorise, all checked 2026-10-25 on the linked pages memorise

—Sources

All pages read on 2026-10-25 sources