Skip to main content

AWS Concepts

A cloud platform as large as AWS can seem overwhelming if you start by memorising individual services. The more effective approach is to first understand the platform’s own organising ideas: how it structures infrastructure around the globe, how it models accounts and identity, how its networks are built, and how governance keeps environments secure and manageable. These foundational concepts recur in every architecture, every service, and every operational practice.

This section of CloudComputingDevPro collects the conceptual building blocks of AWS. Each page explains a single idea in depth, connecting it to related concepts and to the wider Cloud Foundations you already know. Use this hub to discover the mental model behind AWS before you dive into its service catalogue.

Learning Path​

AWS concepts are the bridge between vendor‑neutral cloud fundamentals and the specific services you will later use. The recommended sequence is:

Cloud Foundations

↓

AWS Concepts (this section)

↓

AWS Services

↓

AWS Architecture

↓

AWS Best Practices

Investing time in concepts prevents the common mistake of knowing what a service is called without understanding why it exists or how it fits into a design. A developer who understands AWS’s account model, for instance, can immediately reason about multi‑account strategies; someone who understands the VPC networking model can design secure network topologies before ever looking at a firewall rule.

Global Infrastructure​

AWS operates one of the world’s largest distributed infrastructures, and its physical layout directly affects latency, resilience, data residency, and service availability. These pages explain the building blocks.

  • AWS Global Infrastructure – An overview of how AWS organises its worldwide presence into regions, zones, and edge points, and why that structure matters for architecture.
  • Regions – Large geographic areas containing multiple, physically separate Availability Zones; the primary boundary for data residency and service selection.
  • Availability Zones – Independent failure domains within a region, each consisting of one or more discrete data centres with dedicated power, cooling, and networking.
  • Edge Locations – Globally distributed points of presence that bring content delivery, DNS resolution, and security filtering closer to end users.
  • Local Zones – An extension of a region that places compute, storage, and networking resources closer to large population centres for single‑digit millisecond latency.
  • Wavelength – Infrastructure designed to embed AWS compute and storage at the edge of 5G networks, enabling ultra‑low‑latency applications.
  • Outposts – Fully managed racks of AWS hardware installed in customer data centres, bringing AWS services and operating models on‑premises.

Identity & Organization​

AWS organises resources and access around accounts, identity, and organisational hierarchies. Understanding this model is essential for security, billing, and multi‑team governance.

  • AWS Account – The basic security and billing container for all AWS resources; every resource belongs to exactly one account.
  • AWS Organizations – A service for centrally managing multiple AWS accounts, including consolidated billing, policy enforcement, and account creation.
  • Organizational Units (OU) – Logical groups of accounts within an organisation that allow you to apply policies and controls at scale.
  • IAM – The service that defines who (users, roles, federated identities) can access which AWS resources under what conditions.
  • IAM Identity Center – A central place to manage workforce access to multiple AWS accounts and business applications using existing identity sources.
  • Resource Access Manager (RAM) – A service that enables sharing of select AWS resources across accounts within an organisation, avoiding resource duplication.

Networking Concepts​

AWS networking is built around the Virtual Private Cloud (VPC) and a set of connectivity primitives that together define how traffic flows, how networks are isolated, and how on‑premises environments connect.

  • Amazon VPC – A logically isolated virtual network that you define within an AWS region, where you control IP addressing, subnets, and routing.
  • Subnet – A segment of a VPC’s IP address range, tied to a specific Availability Zone, used to group and isolate resources.
  • Route Table – A set of rules that determine where network traffic from a subnet or gateway is directed.
  • Internet Gateway – A horizontally scaled, redundant VPC component that enables communication between a VPC and the public internet.
  • NAT Gateway – A managed service that allows instances in a private subnet to initiate outbound traffic to the internet while preventing inbound connections.
  • Transit Gateway – A central hub that interconnects VPCs, VPN connections, and Direct Connect links, simplifying large‑scale network architecture.
  • VPC Peering – A direct, private network connection between two VPCs that enables routing of traffic using private IP addresses.
  • AWS PrivateLink – A way to privately access services hosted on AWS without exposing traffic to the public internet, using endpoint‑based connectivity.

Governance & Operations​

Governance concepts help you manage security, compliance, cost, and operational consistency across single accounts and multi‑account environments.

  • Shared Responsibility Model – The division of security and compliance duties between AWS (security of the cloud) and the customer (security in the cloud).
  • AWS Control Tower – A service that automates the setup of a well‑architected, multi‑account AWS environment with pre‑configured governance guardrails.
  • Landing Zone – A custom‑built or Control Tower‑based multi‑account foundation that includes identity, networking, logging, and security baselines.
  • Multi‑Account Strategy – An approach that organises workloads into separate AWS accounts based on environment, team, or business unit to improve isolation and management.
  • Tagging Strategy – A consistent scheme for applying metadata to AWS resources, enabling cost allocation, automation, and compliance tracking.
  • AWS Organizations SCP – Service Control Policies that set permission boundaries at the organisation or OU level, restricting what actions accounts can perform even if IAM allows them.
  • Resource Governance – The policies and processes used to control how resources are provisioned, configured, and maintained across an AWS environment.
  1. Learn Cloud Foundations – the universal concepts shared by all cloud platforms.
  2. Understand AWS Global Infrastructure – regions, zones, and edge.
  3. Learn AWS Identity and Organization – accounts, IAM, and multi‑account structure.
  4. Learn AWS Networking Concepts – VPC, subnets, and connectivity models.
  5. Continue to AWS Services – explore compute, storage, databases, and beyond.
  6. Study AWS Architecture – apply concepts to design resilient, scalable systems.
  7. Apply AWS Best Practices – embed security, cost, and operational excellence into your work.

Continue Learning​

  • AWS Services – Detailed coverage of the service families that run on top of these concepts.
  • AWS Architecture – Patterns and frameworks for designing production‑ready systems.
  • AWS Best Practices – Operational and security guidance for everyday engineering.
  • Cloud Foundations – Revisit the vendor‑neutral fundamentals that underpin the entire platform.