Learn AWS

A Region is a separate geographic area (like us-east-1). An Availability Zone is one or more discrete data centers within a Region, each with independent power, cooling, and networking. AZs in a Region are interconnected by low-latency links, so spreading resources across multiple AZs gives you fault tolerance against a single data-center failure.

A security group is a stateful firewall attached to an ENI/instance: return traffic is automatically allowed, and it supports allow rules only. A network ACL is a stateless firewall at the subnet level: it evaluates allow and deny rules in order and requires you to permit both inbound and outbound traffic explicitly.

Use an IAM role whenever a workload or another AWS service needs temporary credentials — for example, an EC2 instance or Lambda function accessing S3, or cross-account access. Roles issue short-lived credentials via STS and avoid long-lived access keys. IAM users are for people or legacy cases that need static credentials.

S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequently accessed data. S3 Intelligent-Tiering auto-moves objects between tiers based on access. Glacier Instant/Flexible Retrieval and Glacier Deep Archive are for archival at the lowest cost with increasing retrieval latency.

Run instances across multiple Availability Zones behind an Application Load Balancer, and put them in an Auto Scaling Group so unhealthy instances are replaced and capacity scales with demand. Keep the app stateless, store shared state in a multi-AZ database (like RDS Multi-AZ), and store assets in S3.

AWS is responsible for security 'of' the cloud — the physical infrastructure, hardware, and managed-service software. The customer is responsible for security 'in' the cloud — IAM configuration, patching guest OSes, encrypting data, configuring security groups, and application-level controls. The split shifts depending on whether the service is IaaS, PaaS, or SaaS.