CloudOpsGuide
fundamentals

AWS for DevOps Engineers: The Services That Actually Matter

Beginner
12 minutes
October 2026
CloudOpsGuide Team

AWS for DevOps Engineers: The Services That Actually Matter

AWS has 200+ services, but DevOps work concentrates on about a dozen. Learn these well and you can run real production infrastructure; the rest you can pick up when a project demands it.

Table of Contents

Compute: where code runs

  • EC2 — virtual machines. Understand instance types, AMIs, user-data bootstrapping, and security groups. Still the baseline everything else is compared against.
  • ECS/EKS — containers on AWS's own orchestrator vs. managed Kubernetes. ECS is simpler and deeply AWS-integrated; EKS buys you the Kubernetes ecosystem and portability.
  • Lambda — event-driven functions. Great for glue code, cron jobs, and spiky workloads; bad for long-running or latency-critical paths.

Storage & data

  • S3 — object storage. Learn buckets, versioning, lifecycle rules, and especially bucket policies — public-bucket misconfiguration is a classic breach vector.
  • EBS/EFS — block volumes for EC2 vs. shared filesystem.
  • RDS — managed databases. Know Multi-AZ vs. read replicas, and why automated snapshots matter.

Networking: where incidents live

  • VPC — subnets, route tables, NAT gateways. Public vs. private subnet placement is the single most important security decision in most architectures.
  • Security groups — stateful firewalls on resources. Default-deny, then open minimally.
  • ALB/NLB — load balancers. ALB speaks HTTP (paths, hostnames); NLB speaks TCP at massive throughput.
  • Route 53 — DNS, health checks, failover routing.

Identity & security

  • IAM — the service you must actually understand. Roles over users, least privilege, and never long-lived access keys in code. Instance roles and OIDC federation for CI are the modern pattern.
  • Secrets Manager / SSM Parameter Store — where credentials live instead of environment files.

Operations

  • CloudWatch — metrics, logs, alarms. Not glamorous, but it's the observability floor.
  • CloudTrail — audit log of every API call. Turn it on, ship it somewhere safe, hope you never need it.
  • Systems Manager (SSM) — Session Manager gives shell access without SSH keys or open port 22. Use it.

How to practice without a scary bill

Set a billing alarm first ($5 threshold). Use the free tier, tag everything you create, and tear down with Terraform when done. A VPC + EC2 + ALB lab costs cents per hour and teaches more than any certification video.

Related Articles

Last Updated: October 2026 Author: CloudOpsGuide Team Difficulty: Beginner Estimated Reading Time: 12 minutes