AWS

Almost every AWS API call is regional — resources live in a specific region (e.g. us-east-1, eu-central-1) and don’t automatically exist elsewhere. The CLI reads credentials and a default region from a profile stored in ~/.aws/credentials and ~/.aws/config. Using a named profile (not the unnamed default) keeps work and personal accounts apart and makes the active identity explicit on every command via --profile. Verify who you are with aws sts get-caller-identity before doing anything that creates resources.

S3 (Simple Storage Service) is object storage: you put and get objects (files) by key inside a bucket, over HTTP, with eleven-nines of durability. It is the backbone of countless AWS architectures — static assets, backups, data-lake files, build artifacts. Bucket names are globally unique across all AWS accounts, so pick something specific. Outside us-east-1, create-bucket requires a LocationConstraint naming the region; us-east-1 is the one region that rejects it. New buckets are private by default — that default is a feature, not a limitation.

IAM (Identity and Access Management) is how AWS decides who can do what to which resource. It is the most powerful — and steepest — part of AWS. The discipline that keeps you safe is least privilege: grant the narrowest set of Actions on the most specific Resource ARN that the job needs, and nothing more. Never reach for "Action": "*" or "Resource": "*" in real work. A policy is JSON with Effect, Action, and Resource; an explicit Deny always wins over any Allow. Object-level actions (s3:GetObject) need the /* ARN; bucket-level actions (s3:ListBucket) need the bare bucket ARN.

EC2 (Elastic Compute Cloud) gives you virtual machines you fully control. It is the most flexible compute on AWS and the foundation many higher-level services run on, but it is also the one you must remember to turn off — instances bill per second while running. Choose an instance type (t3.micro is small and free-tier eligible in many regions), an AMI (the OS image), a key pair for SSH, and a security group (a stateful firewall). For most modern apps you’ll graduate from raw EC2 to a managed runner like Fargate (next Steps) — but knowing EC2 makes every higher-level service legible.

ECS (Elastic Container Service) is AWS’s container orchestrator; Fargate is its serverless launch type — you describe a task (image, CPU, memory, env) and AWS runs the container without you provisioning or patching EC2 hosts. The image lives in ECR (Elastic Container Registry), a private Docker registry in your account. This is the “service-per-job” mindset in action: rather than a hand-managed VM, you pick the managed runner that matches the workload — Fargate for steady containers, Lambda for event-driven bursts. You wire a task execution role (so ECS can pull the image and write logs) separately from the task role (the permissions your app code gets) — keeping them distinct is least privilege again.

RDS (Relational Database Service) runs managed relational databases — patching, backups, failover, and replicas are handled for you. Aurora is AWS’s cloud-native engine that is wire-compatible with PostgreSQL (and MySQL), with storage that auto-scales and replicates across Availability Zones. You get the full Postgres SQL surface — ACID transactions, joins, JSON, indexes — without running the box yourself. Put the cluster in private subnets and reach it only from your app’s security group; never expose a database to the public internet. Store the password in Secrets Manager, not in code.

DynamoDB is a fully managed NoSQL key-value and document database with single-digit-millisecond latency at any scale and no servers to size. It shines for high-throughput, access-pattern-driven workloads — user sessions, event logs, leaderboards, shopping carts — where you query by known keys rather than ad-hoc joins. You design around a partition key (which shard the item lives on) and an optional sort key (ordering within a partition), and you Query by key — DynamoDB deliberately makes full-table Scans expensive to steer you toward key-based access. It is the opposite trade-off to Aurora: give up flexible SQL, gain effortless horizontal scale. Pick the store per job, not per habit.

ElastiCache is AWS’s managed in-memory data store, offered with the Redis OSS / Valkey engine. Redis sits in front of your database: cache the results of expensive queries, store ephemeral session state, or back real-time features (counters, pub/sub, leaderboards) that would hammer a relational store. The managed service handles provisioning, patching, failover, and (in cluster mode) sharding. Like a database, keep it in private subnets reachable only from your app’s security group — Redis has no authentication by default beyond the network boundary, so the network is the control. The app talks to it with any standard Redis client over the cluster’s endpoint.

Clicking in the console doesn’t scale and isn’t reproducible. CloudFormation is AWS’s native IaC: you declare resources in a template and AWS reconciles your account to match, tracking everything as a stack you can update or delete atomically. The CDK (Cloud Development Kit) lets you write that template in a real language (TypeScript, Python, Go, Java) with types, loops, and abstractions, then synthesizes it to CloudFormation. You get review-able diffs (cdk diff), repeatable environments, and one source of truth for the bucket, table, cluster, and roles you created by hand in earlier Steps. Least privilege scales here too: CDK grant helpers (e.g. bucket.grantRead(fn)) emit the minimal policy automatically.

You could run game servers on raw EC2 — but session-based multiplayer needs more: placing players onto the least-loaded server with spare slots, scaling fleets up and down with demand, and matchmaking players into balanced sessions. GameLift is the purpose-built service for exactly this: you upload a dedicated server build, GameLift runs it across managed fleets, tracks game sessions and their available player slots, and (via FlexMatch) matches players by rules you define. This is AWS’s breadth advantage made concrete — a managed primitive for a problem most clouds leave you to solve yourself. It’s the load-bearing service behind a real-time arena backend.

A VPC (Virtual Private Cloud) is your own isolated network in AWS. The standard pattern: public subnets hold internet-facing pieces (a load balancer, a NAT gateway), while private subnets hold the parts that must never accept inbound traffic from the internet — your Aurora cluster, your ElastiCache node, your Fargate tasks. Security groups are stateful, allow-only firewalls attached to resources; you let the app reach the database by referencing the app’s security group as the source in the database’s group, rather than opening a CIDR range. Private resources reach out (for updates, AWS APIs) through a NAT gateway or VPC endpoints. Getting this layout right is what keeps a database off the public internet — the network is the first and last line of least privilege.