Cloud foundations and global infrastructure

AWS rents computing building blocks over a network. You combine those blocks into a workload and pay for what you use.

The map

• A Region is a separate geographic area.
• An Availability Zone (AZ) is an isolated location inside a Region, made from one or more data centers with separate power and networking.
• An edge location puts content and network services close to users.
• An AWS account is a strong boundary for billing, permissions, quotas, and blast radius.
• A resource is something you create: a bucket, instance, database, queue, function, key, or network.

The simple design rule

Use multiple AZs for high availability inside one Region. Use multiple Regions only when business needs justify the extra complexity: strict disaster recovery, data residency, or globally low latency.

Shared responsibility

AWS secures the cloud: physical facilities, hardware, and the managed service platform. The customer secures what is placed in the cloud: identities, data, configuration, application code, and many operating-system duties. The exact line changes by service. With EC2 you manage more. With Lambda or DynamoDB AWS manages more of the underlying stack.

Managed services first

Choose the highest-level managed service that meets the requirement. It usually removes undifferentiated work such as patching, replication, and replacement. Do not choose it blindly: check service limits, portability, skills, latency, features, and cost at the expected scale.

Architect questions

1. Where are users and regulated data?
2. Which failures must the design survive?
3. What is the tolerated latency?
4. What must remain on premises?
5. Which teams operate the solution?
6. How will accounts and environments be separated?

Common trap

“The cloud is automatically highly available” is false. AWS supplies resilient building blocks. You must place and configure them so the workload survives the failures that matter.