Cloud Infrastructure & Hyperscaler Architecture

VPCs, Subnets, IAM Delegation, Load Balancers & S3

7 modules, 34 lessons: The Cloud Proposition; Identity and Access Management; The Network; Compute Options; Storage Types; Databases and Observability; Cost, Automation, and Handover.

Intermediate · 2 hours · 34 lessons · 73 labs

Who it is for

Intermediate level.

For engineers and technical staff who want to build on AWS with access, networking and cost designed in from the start, and for security and governance people who review cloud designs.

What you don't need yet:

What helps:

Before you start:

Take first:

Take next:

Learning paths:

Nobody needs to know everything before they start. Each course builds on the one before, so a learning path takes you there step by step.

Labs

73 labs, 1 of them graded: you write the code, it runs, and graded labs check the result. The outline lists each lesson's labs.

What is free

Start free: First module free with an account. Pro: Every course, lab, handbook, practice exam and certificate.

Course outline

The Cloud Proposition

  1. Capital to Operating Expenditure (2 labs): You can explain what changes when a server stops being something you buy and becomes something you rent by the hour, read a real on-demand price out of the AWS pricing API, and say which costs the change removes and which ones it quietly adds.
  2. Elasticity and Scale (2 labs): You can distinguish scalability from elasticity, choose between growing an instance and adding instances, read the account limits that decide how far you can actually grow, and name what an application must give up to be scaled horizontally.
  3. The Shared Responsibility Model (4 labs): You can say which parts of a running system AWS operates and which parts remain yours, show that the line moves depending on the service you chose, and demonstrate that AWS enforces exactly the rules you wrote and no others.
  4. Regions, Availability Zones and Reliability (3 labs): You can choose a region for the right reasons, explain what an availability zone actually is, tell a zone name from a zone ID and say why the difference matters, and justify spreading a system across zones as the first reliability decision.

Identity and Access Management

  1. IAM as the Foundation (4 labs): You can explain how AWS identifies a caller, distinguish authentication from authorisation, and choose a role or user for a task without handing out unnecessary permanent credentials.
  2. Users, Groups and Roles (3 labs): You can organise human access with groups, give workloads roles, and recognise when an IAM user or access key is the wrong identity for a task.
  3. Policies and Least Privilege (7 labs): You can read and write a policy statement part by part, narrow a wildcard policy down to the actions and resources a service really needs, and prove with the simulator that the narrowed version still permits the work and nothing else.
  4. The Danger of Long-Lived Keys (3 labs): You can spot long lived access keys in code and logs, explain why rotation alone is not containment, and replace a workload key with temporary role credentials.
  5. Policy Simulation and Dry Runs (5 labs): You can find out whether a policy document means what you intended, whether an existing identity is permitted to make a call, and whether a real request would be accepted, all without creating a resource or spending anything.

The Network

  1. Virtual Private Clouds (1 lab): You can explain what a VPC isolates and choose a sensible address range before adding subnets and routes.
  2. Subnets: Public and Private (3 labs): You can classify a subnet by its route table, place internet facing and internal workloads in the right subnet, and explain why a private workload still needs an egress path for updates.
  3. Route Tables and Internet Gateways (2 labs): You can read a route table, identify its local route, and explain how an internet gateway changes reachability.
  4. Network Address Translation (1 lab): You can explain why private workloads use NAT for outbound traffic and identify its availability and cost tradeoffs.
  5. Security Groups and Firewalls (2 labs): You can write narrow security group rules and explain how stateful filtering differs from subnet level network controls.
  6. Load Balancing and DNS (1 lab): You can place a load balancer in public subnets, route a domain name to it, and keep application targets private.

Compute Options

  1. Elastic Compute Cloud (EC2) (2 labs): You can separate an EC2 image, capacity type, network placement, role, and storage choice, then explain the lifecycle of a virtual machine.
  2. Containers on AWS (ECS and EKS) (2 labs): You can distinguish a container image from the service that runs it and choose between a managed container service and managed Kubernetes for a workload.
  3. Serverless Compute (Lambda) (2 labs): You can explain Lambda's event driven execution model, choose a suitable function boundary, and account for timeout, concurrency, and observability limits.
  4. Comparing Compute Options (2 labs): You can compare virtual machines, containers, and functions by control, operational burden, scaling shape, and workload fit.
  5. Auto Scaling Groups (2 labs): You can explain how an Auto Scaling Group maintains desired capacity, separates replacement from scaling, and uses health checks and instance templates safely.

Storage Types

  1. Object, Block, and File Storage (1 lab): You can choose object, block, or file storage by access pattern, sharing model, and durability need.
  2. S3: Buckets and Objects (1 lab): You can explain the bucket and object model in S three and design names, prefixes, and lifecycle boundaries.
  3. S3: Permissions, Tiers, and Policies (1 lab): You can keep an S three bucket private, grant narrow access, and choose storage tiers from real access patterns.
  4. Elastic Block Store (EBS) (1 lab): You can plan an EBS volume for an instance, explain snapshots, and avoid treating a disk as a complete backup strategy.
  5. Elastic File System (EFS) (1 lab): You can decide when EFS fits shared files and explain mount targets, throughput, and access controls.

Databases and Observability

  1. Managed Relational Databases (RDS) (3 labs): You can decide when a managed relational database fits, separate compute from storage and availability choices, and describe the backup, network and credential boundaries an RDS deployment needs.
  2. NoSQL and DynamoDB (1 lab): You can model a DynamoDB table from access patterns and explain partition keys, sort keys, and capacity choices.
  3. When to Pick Which Database (1 lab): You can choose a managed relational or non relational database from consistency, query, relationship, and scale requirements.
  4. Observability with CloudWatch (1 lab): You can distinguish metrics, logs, and traces, then choose CloudWatch signals that explain a service failure.
  5. Metrics, Logs, and Alarms (1 lab): You can build an actionable alarm with a clear owner, threshold, runbook, and recovery review.

Cost, Automation, and Handover

  1. Cost, Budgets, and Tagging (3 labs): You can assign cloud ownership with tags, distinguish a budget alert from a spending limit, and build a cost review that connects usage to a responsible team.
  2. How Bills Actually Get Large (3 labs): You can trace the common paths from a small cloud experiment to a large bill, rank the cost drivers worth investigating, and put a stop condition around temporary work.
  3. The Console versus the CLI (1 lab): You can choose the console or CLI for discovery and operation while keeping repeatable actions reviewable.
  4. Infrastructure as Code (Handover to Terraform) (1 lab): You can describe what Terraform should own after this fundamentals course and carry forward the network, identity, storage, and cost contracts.

Certification courses