AWS Fundamentals for Developers
EC2, S3, Lambda, RDS, IAM, and the networking concepts every backend dev needs
Explanation
AWS dominates cloud infrastructure. For a backend/automation developer role, you need the core services and when to use each — not certification-level depth.
Compute:
- EC2 — virtual servers ("rent a Linux/Windows machine"). You manage the OS, scaling, and patching.
- Lambda — serverless functions. Upload code; AWS runs it on-demand in response to triggers (HTTP request, S3 upload, schedule). You pay per invocation — no server to manage.
Storage:
- S3 (Simple Storage Service) — object storage for files (images, backups, logs, datasets), organized into "buckets". Not a filesystem — accessed via API/SDK. ``python import boto3 s3 = boto3.client('s3') s3.upload_file('report.csv', 'my-bucket', 'reports/report.csv') s3.download_file('my-bucket', 'reports/report.csv', 'local.csv')
Databases:
- RDS — managed relational databases (Postgres, MySQL). AWS handles backups, patching, replication.
- DynamoDB — managed NoSQL key-value/document database that scales automatically.
IAM (Identity & Access Management):
- Users — people or applications with long-term credentials
- Roles — temporary permissions *assumed* by a service (e.g. an EC2 instance assumes a role to read from S3 — no hardcoded credentials needed)
- Policies — JSON documents defining which actions are allowed on which resources
- Principle of least privilege — grant only the permissions a task needs, nothing more
Networking basics:
- Region — a geographic area (e.g. us-east-1)
- Availability Zone (AZ) — an isolated datacenter within a region; deploying across multiple AZs adds redundancy
- Security Group — a virtual firewall controlling inbound/outbound traffic to EC2/RDS instances
- VPC — an isolated virtual network where your resources live
Secrets & config:
Never hardcode credentials in source code. Use environment variables for local dev, and AWS Secrets Manager or Parameter Store in production — the running service fetches secrets at request time using its IAM role's permissions.
Lambda handler shape:
python def lambda_handler(event, context): name = event.get('name', 'world') return { 'statusCode': 200, 'body': f'Hello, {name}!' } `` Triggered by API Gateway (HTTP), S3 events, EventBridge schedules, SQS messages, and more.
Examples
boto3: upload and list files in S3
boto3 is the AWS SDK for Python — clients map closely to AWS API calls. Credentials come from the environment or an IAM role, never hardcoded
import boto3
s3 = boto3.client('s3')
# Upload a local file to a bucket
s3.upload_file('invoice.pdf', 'company-invoices', '2026/06/invoice.pdf')
# List objects under a prefix
response = s3.list_objects_v2(Bucket='company-invoices', Prefix='2026/06/')
for obj in response.get('Contents', []):
print(obj['Key'], obj['Size'])Lambda triggered by an S3 upload
A common serverless pattern: an S3 "object created" event triggers a Lambda that processes the file — no server runs until a file is uploaded
import boto3
s3 = boto3.client('s3')
def lambda_handler(event, context):
# event contains details about the S3 object that triggered this
record = event['Records'][0]
bucket = record['s3']['bucket']['name']
key = record['s3']['object']['key']
obj = s3.get_object(Bucket=bucket, Key=key)
contents = obj['Body'].read().decode('utf-8')
# ... process the uploaded file ...
return {'statusCode': 200, 'processed': key}How well did you understand this?
Next in AWS Basics
AWS VPC & Networking