跳到正文

本页主要内容为英文。翻译此页

技能与技术

AWS roadmap

Learn the AWS services that matter most for developers and cloud engineers, with cost control from day one and a path to certification.

时间
⏱ 6–8 weeks
Level
Intermediate
Steps
6 steps
Architecture ↓Cheat sheet ↓5 interview Q&As ↓
分享

The roadmap

Click a step to open the full guide.

Best architecture: a three-tier web app on AWS

A common, well-architected AWS setup.

AWS three-tier

  1. Route 53 · CloudFront · WAF
  2. Application Load Balancer (public subnets)
  3. ECS Fargate tasks (private subnets, autoscaled)
  4. RDS Multi-AZ · ElastiCache · S3
  5. CloudWatch · Secrets Manager · IaC (CDK/Terraform)

Why it's built this way

  • Private subnets compute and data; only the ALB is public. 年
  • Multi-AZ database and autoscaled containers.
  • Secrets Manager credentials; 年 IAM roles access. 年

AWS cheat sheet

The essentials on one screen. Bookmark it for revision.

Which service?

Virtual serverEC2
ContainersECS/Fargate, EKS (Kubernetes)
FunctionsLambda
FilesS3 (+ CloudFront CDN)
SQL databaseRDS / Aurora
NoSQLDynamoDB
Queue / eventsSQS / SNS / EventBridge
SecretsSecrets Manager / Parameter Store
MonitoringCloudWatch
Foundation modelsBedrock

CLI

Configureaws configure sso
Who am Iaws sts get-caller-identity
List bucketsaws s3 ls
Uploadaws s3 cp file.txt s3://bucket/
Sync folderaws s3 sync ./site s3://bucket/

Improve performance

  • Put CloudFront in front of static files and APIs to serve users from nearby edge locations.
  • Choose the region closest to users (Mumbai for India).
  • Use auto scaling for EC2/ECS and right-size instances from CloudWatch metrics.
  • Add caching (ElastiCache) and read replicas for read-heavy databases.
  • Use queues to smooth spikes and keep APIs fast.

Security checklist

  • MFA everywhere; no root user for daily work; no long-lived access keys.
  • Least-privilege IAM roles for every service.
  • Private subnets for servers and databases; block public S3 access.
  • Encrypt data at rest (KMS) and in transit (TLS).
  • Turn on CloudTrail, GuardDuty and budget alerts.
  • Store secrets in Secrets Manager, never in code or environment files in Git.

Most important interview questions

Click a question to see a strong answer. Each step also has its own questions.

1How do you design a highly available web app on AWS?

Multiple AZs, load balancer, auto scaling app tier, Multi-AZ RDS, S3 + CloudFront for static content, health checks and backups.

2How do you control AWS costs?

Budgets and alerts, right-sizing, auto scaling, Savings Plans/Reserved capacity for steady loads, Spot for flexible jobs, S3 lifecycle rules, and deleting unused resources.

3the difference between horizontal and vertical scaling 是什么？

Vertical: a bigger machine. Horizontal: more machines behind a load balancer; preferred for availability and elasticity.

4How do you secure an S3 bucket?

Block public access, use bucket policies with least privilege, encryption, versioning, access logging, and CloudFront origin access control for public content.

5CloudFormation / CDK 是什么？

AWS's infrastructure-as-code tools: CloudFormation uses templates; CDK lets you define infrastructure in programming languages and generates CloudFormation.

Related 条学习路线

6

Cloud Engineer

6 steps · 5–7 months · Intermediate

Design, build and run systems on AWS, Azure or Google Cloud.

View roadmap →
5

Docker & Kubernetes

5 steps · 4–6 weeks · Intermediate

Package apps and run them anywhere.

View roadmap →
6

Backend Developer

6 steps · 5–6 months · Intermediate

Build the APIs, databases and services behind apps.

View roadmap →
1

AWS · Step 1 of 6 · 3 days

Account, billing and IAM

Set up safely.

Secure the root account with MFA and never use it day to day. Create a budget alert before launching anything. IAM controls who can do what.

What you'll learn

  • Root user protection and MFA
  • Billing alerts and budgets
  • IAM users, groups and roles
  • Policies and least privilege
  • Regions and availability zones

AWS global layout

  • AWS global
  • Region: ap-south-1 (Mumbai)
  • Availability Zone a
  • Availability Zone b
  • Availability Zone c
  • Region: us-east-1
  • …

Key concepts

IAM
Identity and Access Management: who can do what in your account.
Policy
A JSON document that allows or denies actions on resources.
Role
Temporary permissions a service or person can assume; safer than long-lived keys.
Region / AZ
A geographic area / a separate data centre within it.

Step by step

  1. 1.1

    Protect the root user

    Turn on MFA; lock the root user away.

  2. 1.2

    Set a budget

    Create a monthly budget with email alerts at 50%, 80% and 100%.

  3. 1.3

    Create an admin identity

    Use IAM Identity Center or an IAM user with MFA for daily work.

  4. 1.4

    Choose a region

    Mumbai (ap-south-1) for Indian users; keep practice in one region.

Notes

  • Roles (temporary credentials) are safer than long-lived access keys.

Tips & tricks

  • Choose one region near your users, such as Mumbai (ap-south-1) for India.

Interview questions

IAM user vs IAM role?

A user has long-term credentials for a person or app. A role has no permanent credentials; it's assumed temporarily by services, apps or users, which is safer.

the principle of least privilege 是什么？

Grant only the permissions needed for a task, nothing more, and review them regularly.

The quick way to study this

Set up MFA, a budget alert and an admin IAM user in the first hour.

2

AWS · Step 2 of 6 · 1 week

Compute and storage

EC2, S3 and EBS.

EC2 gives you virtual servers; S3 stores files at huge scale. Many apps use S3 for uploads and static website hosting.

What you'll learn

  • EC2 instances and types
  • Security groups
  • S3 buckets and storage classes
  • EBS volumes
  • AMIs and snapshots

Storage options

S3

  • Files/objects via API
  • Unlimited, very durable
  • Uploads, backups, static sites

EBS

  • Disk for one EC2
  • Block storage
  • OS and databases on EC2

EFS

  • Shared file system
  • Many servers at once
  • Shared content

Key concepts

EC2
Virtual servers you rent by the second or hour.
S3
Object storage for files of any size with very high durability.
Security group
A stateful firewall around your instance.

Step by step

  1. 2.1

    Launch EC2

    Pick an instance type, key pair and security group; SSH in.

  2. 2.2

    Use S3

    Create a private bucket; upload and download files; try versioning.

  3. 2.3

    Attach storage

    EBS volumes for EC2 disks; snapshots for backups.

Notes

  • Keep S3 buckets private unless they must be public.

Tips & tricks

  • Stop instances when not in use to save money.

Interview questions

How do you host a static website on AWS?

Put files in S3 and serve them through CloudFront (CDN) with HTTPS from ACM certificates, keeping the bucket private with origin access control.

The quick way to study this

Launch an EC2 instance, host a small site and store files in S3.

3

AWS · Step 3 of 6 · 1 week

Networking with VPC

Private networks in the cloud.

A VPC is your private network. Put public-facing load balancers in public subnets and servers and databases in private ones.

What you'll learn

  • VPCs and subnets
  • Route tables and internet gateways
  • NAT gateways
  • Security groups vs NACLs
  • Load balancers

A classic 3-tier VPC

  1. Internet
  2. Application Load Balancer (public subnets)
  3. App servers / containers (private subnets)
  4. Database (private subnets, no internet)

Key concepts

VPC
Your private network inside AWS.
Subnet
A slice of the VPC in one AZ; public if it routes to an internet gateway.
NAT gateway
Lets private servers reach the internet without being reachable from it.

Step by step

  1. 3.1

    Create a VPC

    Pick a CIDR range like 10.0.0.0/16.

  2. 3.2

    Public and private subnets

    Spread across two AZs for availability.

  3. 3.3

    Routing

    Internet gateway for public subnets; NAT gateway for private outbound.

  4. 3.4

    Load balancer

    Application Load Balancer in public subnets, servers in private.

Notes

  • NAT gateways cost money per hour; delete practice ones.

Tips & tricks

  • Draw your VPC before building it.

Interview questions

Security groups vs NACLs?

Security groups are stateful and attached to resources (allow rules only). NACLs are stateless and attached to subnets (allow and deny rules).

The quick way to study this

Build a VPC with public and private subnets and a load balancer.

4

AWS · Step 4 of 6 · 1 week

Databases and serverless

RDS, DynamoDB and Lambda.

Managed databases remove admin work. Lambda runs code without servers and charges per request, great for APIs and background jobs with spiky traffic.

What you'll learn

  • RDS for PostgreSQL
  • DynamoDB basics
  • Lambda functions
  • API Gateway
  • Event-driven patterns (SQS, SNS, EventBridge)

A serverless API

  1. Client
  2. API Gateway
  3. Lambda function
  4. DynamoDB / RDS
  5. Response

Key concepts

Serverless
Run code without managing servers; pay per use.
Cold start
Extra delay when a new Lambda environment starts.
Decoupling
Using queues/events so services don't depend on each other directly.

Step by step

  1. 4.1

    RDS

    Launch managed PostgreSQL in private subnets with automated backups.

  2. 4.2

    Lambda

    Write a function triggered by API Gateway or an S3 upload.

  3. 4.3

    Events and queues

    SQS for queues, SNS for fan-out, EventBridge for event routing.

  4. 4.4

    DynamoDB

    Key-value/document database for massive scale with simple access patterns.

Notes

  • Lambda has time and memory limits; long jobs need other services.

Tips & tricks

  • Build a serverless API: API Gateway + Lambda + DynamoDB.

Interview questions

When would you choose Lambda vs EC2/containers?

Lambda for spiky, event-driven or short tasks with no servers to manage. Containers/EC2 for long-running, steady, high-throughput workloads or special runtime needs.

The quick way to study this

Deploy one Lambda function behind an API endpoint.

5

AWS · Step 5 of 6 · 1 week

Containers, IaC and AI services

Modern deployment on AWS.

ECS with Fargate runs containers without managing servers. Infrastructure as code (CDK, CloudFormation or Terraform) makes setups repeatable. Amazon Bedrock offers access to many foundation models through one API.

What you'll learn

  • ECR and ECS / Fargate
  • EKS overview
  • CloudFormation or CDK
  • Amazon Bedrock for foundation models
  • CloudWatch logs and alarms

Container deployment on AWS

  1. Git push
  2. CI builds image
  3. Push to ECR
  4. ECS/Fargate deploys
  5. ALB routes traffic
  6. CloudWatch monitors

Key concepts

ECS / Fargate
Run containers on AWS; Fargate means AWS manages the servers.
Infrastructure as code
Your cloud setup written as reviewable, repeatable code.
Amazon Bedrock
One API to use many foundation models inside AWS.

Step by step

  1. 5.1

    Push an image

    Build a Docker image and push it to ECR.

  2. 5.2

    Run on Fargate

    ECS service with a task definition; no servers to manage.

  3. 5.3

    Infrastructure as code

    Describe it all in CDK, CloudFormation or Terraform.

  4. 5.4

    Observe

    CloudWatch logs, metrics, alarms; try Bedrock for foundation models.

Notes

  • Tag every resource so you can track costs.

Tips & tricks

  • Write your infrastructure in code once you have clicked through it a first time.

Interview questions

How would you deploy a containerised API on AWS?

Image in ECR → ECS Fargate service in private subnets → ALB in public subnets with HTTPS → RDS in private subnets → secrets in Secrets Manager → CloudWatch alarms → all defined in IaC with CI/CD.

The quick way to study this

Deploy a containerised FastAPI app on Fargate with CloudWatch alarms.

Docker & Kubernetes roadmap →
6

AWS · Step 6 of 6 · 2 weeks

Certification

Validate your skills.

Certifications structure your learning and help with recruiters, especially for cloud roles. Solutions Architect Associate is the most popular next step after the foundational exam.

What you'll learn

  • Cloud Practitioner (foundational)
  • Solutions Architect Associate
  • Well-Architected Framework
  • Practice exams

Well-Architected pillars

Well-Architected
  • Operational excellence
  • 安全
  • Reliability
  • Performance efficiency
  • Cost optimisation
  • Sustainability

Key concepts

Well-Architected Framework
AWS's six pillars: operational excellence, security, reliability, performance, cost, sustainability.
Shared responsibility
AWS secures the cloud; you secure what you put in it.

Step by step

  1. 6.1

    Learn the exam guide

    Read the official domains and weighting.

  2. 6.2

    Hands-on labs

    Build each service at least once.

  3. 6.3

    Practice exams

    Take timed tests; study every wrong answer.

Notes

  • Hands-on practice matters more than memorising.

Tips & tricks

  • Take full practice exams under time limits.

Interview questions

Explain the shared responsibility model.

AWS is responsible for the security of the cloud (hardware, facilities, core services); you're responsible for security in the cloud (data, IAM, configuration, patching your OS).

The quick way to study this

Two weeks of practice exams after hands-on work is usually enough for the foundational exam.

Cloud Engineer roadmap →

分享此页