AWS core services: IAM, EC2, S3, RDS and Lambda

What you'll do: open an AWS account safely, set up a limited user, store a file in S3, start (and stop) an EC2 server, understand when to use RDS, and run a Lambda function. Prerequisites: the lessons *Linux command line essentials* and *Cloud fundamentals*, a laptop with a terminal, and a debit or credit card for sign-up. Console screens change often, so follow the names of things rather than exact button positions.

Sign up at the AWS website. At the time of writing (2026), AWS accounts created after mid-July 2025 choose between a free plan and a paid plan. The free plan gives a credit balance (AWS advertised up to $200 for new customers: part at sign-up, part earned by trying some services) and lasts up to six months or until credits are used, whichever comes first; it cannot be extended. A free-plan account has some services restricted until you upgrade to the paid plan. Older accounts may still be on the previous 12-month free tier model. These rules change, so read the current page at aws.amazon.com/free before you sign up.

IAM (Identity and Access Management) decides which identity may perform which action on which resource. Four pieces:

User: a person or program with credentials. Group: a set of users sharing permissions. Role: an identity that is assumed temporarily, with no password of its own; services such as EC2 and Lambda use roles. Policy: a JSON document that lists allowed or denied actions.

The golden rule is least privilege: give only the permissions needed. By default everything is denied until a policy allows it.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::brewbean-menu-YOURNAME",
        "arn:aws:s3:::brewbean-menu-YOURNAME/*"
      ]
    }
  ]
}

Allows reading and listing one bucket only. Effect is Allow or Deny, Action is the API call, Resource is identified by an ARN (Amazon Resource Name). Replace YOURNAME to match your bucket.

For your own daily user, AWS recommends IAM Identity Center for people; a simpler path for learning is an IAM user in a group with the AWS managed policy AdministratorAccess. That is powerful: protect it with MFA, and never create access keys unless you need the command line. For apps running on AWS, prefer roles over keys.

S3 stores files as objects inside buckets. A bucket name is globally unique across all AWS customers. Objects are accessed by key (the file path), over HTTP and the API. S3 is used for images, backups, logs, static websites and data lakes. It is not a file system you mount like a disk, and it is not a database.

# bucket names must be unique, lowercase, no spaces
export BUCKET=brewbean-menu-yourname-2026
aws s3 mb s3://$BUCKET --region ap-south-1

echo '[{"id":"espresso","price":120}]' > menu.json
aws s3 cp menu.json s3://$BUCKET/menu.json
aws s3 ls s3://$BUCKET
aws s3 cp s3://$BUCKET/menu.json downloaded.json
cat downloaded.json

New buckets are private by default and block public access. Keep it that way.

To share a private file for a short time, create a presigned URL, which is a link that works for a limited period:

aws s3 presign s3://$BUCKET/menu.json --expires-in 300

Prints a long URL that anyone with it can open for 300 seconds.

EC2 gives you a virtual machine. You pick an AMI (the operating system image, for example Amazon Linux or Ubuntu), an instance type (CPU and memory, such as t3.micro), a key pair (for SSH login), a security group (a firewall of allowed ports), and storage. You pay while the instance is running (per second, with a minimum for Linux). Free plans limit which instance types you can use; the launch screen marks eligible ones.

Security groups work like a firewall list: they only allow, never deny, and are stateful (replies to allowed traffic are let back). An SSH rule open to 0.0.0.0/0 invites password-guessing bots, so restrict it.

RDS runs a database engine (PostgreSQL, MySQL, MariaDB and others) for you: installation, backups, patching and optional replicas in another availability zone. You still design tables and queries (see the Backend track). You could install Postgres on an EC2 machine yourself, but then backups, upgrades and failover become your job.

For learning, create a small PostgreSQL instance only if your plan allows it, and delete it when done. Key settings: engine and version, instance class, storage, a username and strong password, and Public access = No unless you have a reason. Put it in a security group that allows port 5432 only from your app's security group. Your app then connects with a host name that RDS shows (the endpoint), for example through postgresql://user:password@ENDPOINT:5432/dbname.

Lambda runs your function in response to an event: an HTTP request, a file landing in S3, a schedule. You upload code; AWS runs it on demand and bills per request and per duration. No requests, no compute cost. Limits include a maximum run time of 15 minutes and cold starts (the first call after idle is slower). The Serverless applications lesson builds on this.

import json


def lambda_handler(event, context):
    name = (event or {}).get("name", "friend")
    return {
        "statusCode": 200,
        "body": json.dumps({"message": f"Welcome to Brew & Bean, {name}!"}),
    }

The handler receives the triggering event and a context object. The returned dict mimics an HTTP response.

aws lambda invoke --function-name welcome --cli-binary-format raw-in-base64-out --payload '{"name":"Ravi"}' response.json
cat response.json

Runs the function from the CLI. The flag lets the CLI accept a plain JSON payload. On Windows PowerShell, quoting the JSON differs; use the console test if it gives trouble.

Lambda automatically writes logs to CloudWatch Logs, and its execution role decides what AWS resources it may touch. To let it read your S3 bucket you attach a policy like the one shown earlier to that role, not an access key in the code.

Act as an AWS security reviewer. Here is an IAM policy:

```
[paste policy JSON]
```

Explain in plain English what it allows, point out anything broader than needed (wildcards, missing Resource limits), and rewrite it to follow least privilege for this task: [describe what the app must do].

What to expect: Check that the rewritten policy lists specific actions and resource ARNs. Test it in a throwaway account before relying on it.

Frequent questions: the difference between a user, a role and a policy; why avoid root and access keys; S3 versus EBS versus EFS (object, block disk for one server, shared file system); what a security group is; when you would choose Lambda over EC2; and why RDS instead of self-managed databases. Practical answers that mention least privilege, MFA and cleanup show good habits.