What is a VPC?

A VPC is your private network inside AWS. All AWS resources (EC2, RDS, EKS) run inside a VPC. You control: IP address ranges, subnets, routing, and firewalls. Nothing is reachable from the internet unless you explicitly allow it.

Key Components

Choosing the Right Instance Type

Instance family tells you what it is optimised for. Size (small/medium/large/xlarge) tells you how much. Always start with general purpose (m6i), then right-size based on metrics after 2 weeks in production.

S3 Fundamentals

S3 is object storage — you store objects (files) identified by a key (path). Not a filesystem. Infinitely scalable, 11 nines durability (99.999999999%). Used for: backups, static websites, data lakes, application artifacts, logs, container images (ECR), Terraform state.

S3 vs EBS vs EFS

What is EKS?

EKS is AWS's managed Kubernetes service. AWS manages the control plane (API server, etcd, scheduler) — you never touch master nodes. You manage worker nodes (EC2 instances or Fargate). The same kubectl commands work on EKS as on any Kubernetes cluster.

EKS vs ECS vs Fargate

Where AWS Cost Goes — and How to Reduce It

EKS architecture vs AKS — key differences to know

IRSA — IAM Roles for Service Accounts

IRSA is the AWS equivalent of Azure Workload Identity. It links a Kubernetes ServiceAccount to an IAM Role, allowing pods to access AWS services (S3, DynamoDB, Secrets Manager) without any stored credentials.

# 1. Create IAM OIDC provider for the EKS cluster
eksctl utils associate-iam-oidc-provider --cluster myeks --approve

# 2. Create IAM role with trust policy for the ServiceAccount
eksctl create iamserviceaccount   --name payment-service-sa   --namespace production   --cluster myeks   --attach-policy-arn arn:aws:iam::123456789:policy/PaymentServicePolicy   --approve

# 3. Pod uses the ServiceAccount — gets AWS credentials automatically
# No access keys stored anywhere

Fargate for EKS — serverless nodes

Fargate eliminates node management — each pod runs on a dedicated micro-VM. You define Fargate profiles: which namespaces/labels use Fargate vs managed node groups. Best for: burst workloads, batch jobs, dev/test environments where you don't want to manage nodes. Not suitable for: DaemonSets (cannot run on Fargate), privileged pods, GPU workloads.

EKS add-ons — managed cluster components

Lambda — the key concepts

Lambda runs your code in response to events without you managing any servers. You deploy a function (Python, Node.js, Java, Go, etc.), configure what triggers it, and AWS scales it from 0 to thousands of instances automatically.

Lambda in DevOps — common uses

• Automated remediation — CloudWatch alarm triggers Lambda which restarts an ECS service or scales up capacity
• CI/CD webhook processor — API Gateway receives GitHub webhook, Lambda triggers CodePipeline
• Scheduled maintenance — EventBridge cron triggers Lambda to stop dev environments at night
• Log processing — S3 event triggers Lambda to process and forward logs to Elasticsearch
• Slack/Teams bot — API Gateway + Lambda handles slash commands from your ops chat

AWS native CI/CD stack

GitHub Actions to EKS — OIDC authentication (no stored credentials)

name: Deploy to EKS
on:
  push:
    branches: [main]

permissions:
  id-token: write   # REQUIRED for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3

    - name: Configure AWS credentials (OIDC — no secrets stored)
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::123456789:role/GitHubActionsEKSRole
        aws-region: us-east-1

    - name: Login to ECR
      run: aws ecr get-login-password | docker login --username AWS --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com

    - name: Build and push
      run: |
        docker build -t myapp:${{ github.sha }} .
        docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:${{ github.sha }}

    - name: Deploy to EKS
      run: |
        aws eks update-kubeconfig --name myeks --region us-east-1
        helm upgrade --install myapp ./charts/myapp           --set image.tag=${{ github.sha }} --atomic --wait

HA design principles on AWS

RTO and RPO — the two DR metrics

• RTO (Recovery Time Objective) — how long can the business be down? "We must be back online within 4 hours." Drives: how fast your failover automation must work.
• RPO (Recovery Point Objective) — how much data can we lose? "We cannot lose more than 15 minutes of transactions." Drives: how frequently you must backup/replicate.

DR strategies by cost and RTO