AWS Core Services Complete Guide 2025: EC2, S3, RDS, Lambda, VPC, IAM Deep Dive

Region: us-east-1 (N. Virginia)
├── AZ: us-east-1a
├── AZ: us-east-1b
├── AZ: us-east-1c
├── AZ: us-east-1d
├── AZ: us-east-1e
└── AZ: us-east-1f

m6i.xlarge
│││  └─── Size (nano, micro, small, medium, large, xlarge, 2xlarge...)
│││
││└───── Additional features (i=Intel, g=Graviton, a=AMD, n=network enhanced)
│└────── Generation (higher number = newer)
└─────── Family (t=burstable, m=general, c=compute, r=memory...)

# Query the latest Amazon Linux 2023 AMI using AWS CLI
aws ec2 describe-images \
  --owners amazon \
  --filters "Name=name,Values=al2023-ami-2023.*-x86_64" \
  --query "sort_by(Images, &CreationDate)[-1].ImageId" \
  --output text

#!/bin/bash
yum update -y
yum install -y httpd
systemctl start httpd
systemctl enable httpd
echo "Hello from EC2" > /var/www/html/index.html

# Request a Spot Instance
aws ec2 request-spot-instances \
  --instance-count 1 \
  --type "one-time" \
  --launch-specification '{
    "ImageId": "ami-0abcdef1234567890",
    "InstanceType": "c5.xlarge",
    "KeyName": "my-key-pair"
  }'

# ASG definition using CloudFormation
AutoScalingGroup:
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    LaunchTemplate:
      LaunchTemplateId: !Ref LaunchTemplate
      Version: !GetAtt LaunchTemplate.LatestVersionNumber
    MinSize: 2
    MaxSize: 10
    DesiredCapacity: 4
    TargetGroupARNs:
      - !Ref ALBTargetGroup
    VPCZoneIdentifier:
      - !Ref PrivateSubnet1
      - !Ref PrivateSubnet2

# Create an EBS snapshot
aws ec2 create-snapshot \
  --volume-id vol-0123456789abcdef0 \
  --description "Daily backup"

# Restore a volume from snapshot
aws ec2 create-volume \
  --snapshot-id snap-0123456789abcdef0 \
  --availability-zone us-east-1a \
  --volume-type gp3

{
  "Rules": [
    {
      "ID": "ArchiveAndDelete",
      "Status": "Enabled",
      "Filter": {
        "Prefix": "logs/"
      },
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "STANDARD_IA"
        },
        {
          "Days": 90,
          "StorageClass": "GLACIER"
        }
      ],
      "Expiration": {
        "Days": 365
      }
    }
  ]
}

# Enable versioning
aws s3api put-bucket-versioning \
  --bucket my-bucket \
  --versioning-configuration Status=Enabled

# List object versions
aws s3api list-object-versions \
  --bucket my-bucket \
  --prefix config.json

import boto3

s3_client = boto3.client('s3')

# Generate a presigned download URL (valid for 1 hour)
url = s3_client.generate_presigned_url(
    'get_object',
    Params={
        'Bucket': 'my-bucket',
        'Key': 'reports/annual-2025.pdf'
    },
    ExpiresIn=3600
)
print(f"Download URL: {url}")

# Event notification configuration (CloudFormation)
S3Bucket:
  Type: AWS::S3::Bucket
  Properties:
    NotificationConfiguration:
      LambdaConfigurations:
        - Event: 's3:ObjectCreated:*'
          Filter:
            S3Key:
              Rules:
                - Name: prefix
                  Value: uploads/
          Function: !GetAtt ProcessingFunction.Arn

# Configure bucket as static website
aws s3 website s3://my-website-bucket/ \
  --index-document index.html \
  --error-document error.html

# Sync website files
aws s3 sync ./build/ s3://my-website-bucket/ \
  --delete \
  --cache-control "max-age=31536000"

10.0.0.0/16  → 65,536 IPs (10.0.0.0 - 10.0.255.255)
10.0.1.0/24  → 256 IPs    (10.0.1.0 - 10.0.1.255)
10.0.1.0/28  → 16 IPs     (10.0.1.0 - 10.0.1.15)

┌─────────────────────────────────────────────────────────┐
│                     VPC: 10.0.0.0/16                     │
│                                                          │
│  ┌────────────────────┐  ┌────────────────────┐         │
│  │   Public Subnet     │  │   Public Subnet     │         │
│  │   10.0.1.0/24       │  │   10.0.2.0/24       │         │
│  │   (AZ-a)            │  │   (AZ-b)            │         │
│  │                     │  │                     │         │
│  │  ┌──────────────┐  │  │  ┌──────────────┐  │         │
│  │  │  ALB / NAT GW │  │  │  │  ALB / NAT GW │  │         │
│  │  └──────────────┘  │  │  └──────────────┘  │         │
│  └────────────────────┘  └────────────────────┘         │
│            │                        │                    │
│  ┌────────────────────┐  ┌────────────────────┐         │
│  │  Private Subnet     │  │  Private Subnet     │         │
│  │  (App) 10.0.3.0/24  │  │  (App) 10.0.4.0/24  │         │
│  │                     │  │                     │         │
│  │  ┌──────────────┐  │  │  ┌──────────────┐  │         │
│  │  │  EC2 / ECS    │  │  │  │  EC2 / ECS    │  │         │
│  │  └──────────────┘  │  │  └──────────────┘  │         │
│  └────────────────────┘  └────────────────────┘         │
│            │                        │                    │
│  ┌────────────────────┐  ┌────────────────────┐         │
│  │  Private Subnet     │  │  Private Subnet     │         │
│  │  (DB) 10.0.5.0/24   │  │  (DB) 10.0.6.0/24   │         │
│  │                     │  │                     │         │
│  │  ┌──────────────┐  │  │  ┌──────────────┐  │         │
│  │  │  RDS Primary  │  │  │  │  RDS Standby  │  │         │
│  │  └──────────────┘  │  │  └──────────────┘  │         │
│  └────────────────────┘  └────────────────────┘         │
│                                                          │
│  ┌──────────┐                                            │
│  │  IGW      │  ← Internet Gateway                       │
│  └──────────┘                                            │
└─────────────────────────────────────────────────────────┘

# Create a NAT Gateway
aws ec2 create-nat-gateway \
  --subnet-id subnet-0123456789abcdef0 \
  --allocation-id eipalloc-0123456789abcdef0

# Create a security group and add rules
aws ec2 create-security-group \
  --group-name web-sg \
  --description "Web server security group" \
  --vpc-id vpc-0123456789abcdef0

aws ec2 authorize-security-group-ingress \
  --group-id sg-0123456789abcdef0 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0

# Flow Log record example
# version account-id interface-id srcaddr dstaddr srcport dstport protocol packets bytes start end action log-status
2 123456789012 eni-abc123 10.0.1.5 52.94.76.1 49761 443 6 12 1024 1625000000 1625000060 ACCEPT OK

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

# Create an instance profile and attach a role
aws iam create-instance-profile \
  --instance-profile-name EC2-S3-ReadOnly

aws iam add-role-to-instance-profile \
  --instance-profile-name EC2-S3-ReadOnly \
  --role-name S3ReadOnlyRole

# Associate the profile with an EC2 instance
aws ec2 associate-iam-instance-profile \
  --instance-id i-0123456789abcdef0 \
  --iam-instance-profile Name=EC2-S3-ReadOnly

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111122223333:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

┌──────────────────┐   Synchronous      ┌──────────────────┐
│  Primary (AZ-a)   │  Replication       │  Standby (AZ-b)   │
│                   │ ──────────────── │                   │
│  Read + Write     │  Auto Failover    │  Standby (No access)│
└──────────────────┘                   └──────────────────┘

                    ┌──────────────────┐
                    │  Read Replica 1   │  ← Read-only
               ┌──▶│  (Same Region)    │
               │    └──────────────────┘
┌──────────────┤    ┌──────────────────┐
│  Primary      │──▶│  Read Replica 2   │  ← Read-only
│  (Read+Write) │    │  (Same Region)    │
└──────────────┤    └──────────────────┘
               │    ┌──────────────────┐
               └──▶│  Read Replica 3   │  ← Cross-Region
                    │  (Different Region)│
                    └──────────────────┘

# Create Aurora Serverless v2 cluster
aws rds create-db-cluster \
  --db-cluster-identifier my-aurora-cluster \
  --engine aurora-postgresql \
  --engine-version 16.1 \
  --serverless-v2-scaling-configuration MinCapacity=0.5,MaxCapacity=16 \
  --master-username admin \
  --master-user-password MySecurePassword123

Lambda functions ──▶ RDS Proxy ──▶ RDS Instance
(thousands)         (connection    (few connections)
                     pooling)

┌─────────────┐     ┌──────────┐     ┌─────────────┐
│ API Gateway  │────▶│          │────▶│ DynamoDB    │
└─────────────┘     │          │     └─────────────┘
                    │          │
┌─────────────┐     │  Lambda  │     ┌─────────────┐
│ S3 Event     │────▶│ Function │────▶│ S3          │
└─────────────┘     │          │     └─────────────┘
                    │          │
┌─────────────┐     │          │     ┌─────────────┐
│ SQS / SNS    │────▶│          │────▶│ SQS / SNS   │
└─────────────┘     │          │     └─────────────┘
                    │          │
┌─────────────┐     │          │     ┌─────────────┐
│ EventBridge  │────▶│          │────▶│ Step Func.  │
└─────────────┘     └──────────┘     └─────────────┘

import json
import boto3

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('Users')

def lambda_handler(event, context):
    """Lambda function invoked from API Gateway"""

    http_method = event['httpMethod']
    path = event['path']

    if http_method == 'GET':
        response = table.scan()
        return {
            'statusCode': 200,
            'headers': {
                'Content-Type': 'application/json',
                'Access-Control-Allow-Origin': '*'
            },
            'body': json.dumps(response['Items'], default=str)
        }

    elif http_method == 'POST':
        body = json.loads(event['body'])
        table.put_item(Item=body)
        return {
            'statusCode': 201,
            'body': json.dumps({'message': 'Created successfully'})
        }

    return {
        'statusCode': 400,
        'body': json.dumps({'message': 'Unsupported method'})
    }

# Configure Provisioned Concurrency
aws lambda put-provisioned-concurrency-config \
  --function-name my-function \
  --qualifier prod \
  --provisioned-concurrent-executions 10

┌─────────────────────────────────────────────┐
│  Table: Orders                               │
│                                              │
│  Partition Key: userId (String)              │
│  Sort Key: orderDate (String)                │
│                                              │
│  ┌──────────┬────────────┬────────┬────────┐│
│  │ userId   │ orderDate   │ total  │ status ││
│  ├──────────┼────────────┼────────┼────────┤│
│  │ user-001 │ 2025-01-15 │ 29900  │ shipped││
│  │ user-001 │ 2025-03-20 │ 15000  │ pending││
│  │ user-002 │ 2025-02-10 │ 89000  │ delivered│
│  └──────────┴────────────┴────────┴────────┘│
│                                              │
│  GSI: StatusIndex                            │
│  Partition Key: status                       │
│  Sort Key: orderDate                         │
└─────────────────────────────────────────────┘

PK          | SK              | Data
------------|-----------------|------------------
USER#001    | PROFILE         | name, email, ...
USER#001    | ORDER#2025-001  | total, status, ...
USER#001    | ORDER#2025-002  | total, status, ...
ORG#ABC     | METADATA        | orgName, plan, ...
ORG#ABC     | MEMBER#001      | role, joinedAt, ...

User ──▶ CloudFront Edge ──▶ Origin
              │                  │
         Cache hit           Cache miss
         Return immediately  Fetch from origin

# Push an image to ECR
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com

docker tag my-app:latest 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:latest

{
  "Comment": "Order processing workflow",
  "StartAt": "ValidateOrder",
  "States": {
    "ValidateOrder": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:validate",
      "Next": "ProcessPayment"
    },
    "ProcessPayment": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:payment",
      "Next": "ShipOrder",
      "Catch": [
        {
          "ErrorEquals": ["PaymentFailed"],
          "Next": "NotifyFailure"
        }
      ]
    },
    "ShipOrder": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:ship",
      "End": true
    },
    "NotifyFailure": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:notify",
      "End": true
    }
  }
}

# Required tags example
aws ec2 create-tags \
  --resources i-0123456789abcdef0 \
  --tags \
    Key=Environment,Value=Production \
    Key=Team,Value=Backend \
    Key=Project,Value=UserService \
    Key=CostCenter,Value=CC-1234