aws-cloud-services

What this skill does

# AWS Cloud Services

A comprehensive skill for building, deploying, and managing cloud infrastructure on Amazon Web Services (AWS). Master S3 object storage, Lambda serverless functions, DynamoDB NoSQL databases, EC2 compute instances, RDS relational databases, IAM security, CloudFormation infrastructure as code, and enterprise-grade cloud architecture patterns.

## When to Use This Skill

Use this skill when:

- Building scalable cloud applications on AWS infrastructure
- Implementing serverless architectures with Lambda and API Gateway
- Managing object storage and file uploads with S3
- Designing NoSQL database solutions with DynamoDB
- Deploying EC2 instances and managing compute resources
- Setting up RDS databases for relational data storage
- Implementing IAM security policies and access control
- Automating infrastructure deployment with CloudFormation
- Architecting multi-region, highly available systems
- Optimizing cloud costs and performance
- Migrating on-premises applications to AWS
- Implementing event-driven architectures
- Building data pipelines and analytics solutions
- Managing secrets and credentials securely
- Setting up CI/CD pipelines with AWS services

## Core Concepts

### AWS Fundamentals

AWS is Amazon's comprehensive cloud computing platform offering 200+ services across compute, storage, databases, networking, security, and more.

#### Key Concepts

**Regions and Availability Zones**
- **Regions**: Geographic areas with multiple data centers (e.g., us-east-1, eu-west-1)
- **Availability Zones (AZs)**: Isolated data centers within a region
- **Edge Locations**: CDN endpoints for CloudFront content delivery
- **Local Zones**: Extensions of regions for ultra-low latency

**AWS Account Structure**
- **Root Account**: Primary account with full access (use sparingly)
- **IAM Users**: Individual user accounts with specific permissions
- **IAM Roles**: Temporary credentials for services and applications
- **Organizations**: Multi-account management for enterprises

**Service Categories**
- **Compute**: EC2, Lambda, ECS, EKS, Fargate
- **Storage**: S3, EBS, EFS, Glacier
- **Database**: RDS, DynamoDB, Aurora, ElastiCache, Redshift
- **Networking**: VPC, Route 53, CloudFront, API Gateway, ELB
- **Security**: IAM, Cognito, Secrets Manager, KMS, WAF
- **Infrastructure**: CloudFormation, CDK, Systems Manager
- **Monitoring**: CloudWatch, X-Ray, CloudTrail

### AWS SDK for JavaScript v3

The AWS SDK v3 is modular, tree-shakable, and optimized for modern JavaScript/TypeScript applications.

#### Key Improvements

**Modular Architecture**
```javascript
// v2 (monolithic)
const AWS = require('aws-sdk');
const s3 = new AWS.S3();

// v3 (modular)
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
const client = new S3Client({ region: 'us-east-1' });
```

**Command Pattern**
- Each operation is a command class
- Clear separation between client and commands
- Better TypeScript support and type inference

**Middleware Stack**
- Customizable request/response pipeline
- Built-in retry and exponential backoff
- Request signing and authentication

### Identity and Access Management (IAM)

IAM controls authentication and authorization across all AWS services.

#### Core IAM Components

**Users**
- Individual identities with long-term credentials
- Access keys for programmatic access
- Passwords for console access
- MFA (Multi-Factor Authentication) support

**Groups**
- Collections of users
- Attach policies to manage permissions collectively
- Users can belong to multiple groups

**Roles**
- Temporary credentials assumed by users, services, or applications
- Cross-account access
- Service-to-service communication
- Federation with external identity providers

**Policies**
- JSON documents defining permissions
- Identity-based policies (attached to users/groups/roles)
- Resource-based policies (attached to resources like S3 buckets)
- Service control policies (SCPs) for Organizations

#### Policy Structure

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}
```

**Policy Elements**
- **Effect**: Allow or Deny
- **Action**: Services and operations (e.g., s3:GetObject)
- **Resource**: ARN of resources affected
- **Condition**: Optional constraints (IP, time, MFA, etc.)
- **Principal**: Who the policy applies to (for resource-based policies)

#### Least Privilege Principle

Always grant minimum permissions necessary:
- Start with no permissions
- Add permissions incrementally as needed
- Use managed policies for common patterns
- Create custom policies for specific use cases
- Regularly audit and remove unused permissions

### Credential Management

#### Credential Chain

The SDK searches for credentials in this order:

1. **Environment variables**: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
2. **Shared credentials file**: ~/.aws/credentials
3. **Shared config file**: ~/.aws/config
4. **IAM role (EC2/ECS/Lambda)**: Instance metadata service
5. **Process credentials**: From a custom executable

#### Best Practices

- **Never hardcode credentials** in source code
- **Use IAM roles** for EC2, Lambda, ECS
- **Use temporary credentials** whenever possible
- **Rotate access keys** regularly (90 days recommended)
- **Use AWS Secrets Manager** for application secrets
- **Enable MFA** for privileged accounts
- **Use AWS SSO** for centralized access management

### Regions and Endpoint Configuration

```javascript
import { S3Client } from '@aws-sdk/client-s3';

// Specify region explicitly
const client = new S3Client({
  region: 'us-west-2',
  endpoint: 'https://s3.us-west-2.amazonaws.com' // Optional custom endpoint
});

// Use default region from environment/config
const defaultClient = new S3Client({}); // Uses AWS_REGION or default region
```

## S3 (Simple Storage Service)

S3 is AWS's object storage service for storing and retrieving any amount of data from anywhere.

### Core S3 Concepts

#### Buckets

- **Globally unique names**: Must be unique across all AWS accounts
- **Regional resources**: Created in a specific region
- **Unlimited objects**: No limit on number of objects
- **Bucket policies**: Resource-based access control
- **Versioning**: Keep multiple versions of objects
- **Encryption**: Server-side and client-side encryption

#### Objects

- **Key-value store**: Key is the object name, value is the data
- **Metadata**: System and user-defined metadata
- **Size limit**: 5TB per object
- **Multipart upload**: For objects > 100MB (required for > 5GB)
- **Storage classes**: Standard, IA, Glacier, etc.

#### S3 Storage Classes

**S3 Standard**
- Frequently accessed data
- 99.99% availability
- Millisecond latency

**S3 Intelligent-Tiering**
- Automatic cost optimization
- Moves data between access tiers

**S3 Standard-IA (Infrequent Access)**
- Lower cost for infrequently accessed data
- Retrieval fees apply

**S3 One Zone-IA**
- Single AZ storage for less critical data
- 20% cheaper than Standard-IA

**S3 Glacier**
- Long-term archival
- Minutes to hours retrieval
- Very low cost

**S3 Glacier Deep Archive**
- Lowest cost storage
- 12-hour retrieval
- Ideal for compliance archives

### S3 Operations

#### Upload Objects

```javascript
import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { readFileSync } from 'fs';

const client = new S3Client({ region: 'us-east-1' });

// Simple upload
const uploadFile = async (bucketName, key, filePath) => {
  const fileContent = readFileSync(filePath);

  const command = new PutObjectCommand({
    Bucket: bucketName,
    Key: key,
    Body: fileContent,
    ContentType: 'image/jpeg', // Optional
    Metadata: { // Optional custom metadata
      'uploaded-by': 'user-123',
      'upload-date': new Date().toISOStri