One Physical Server (AWS hardware)
    ├── EC2 Instance 1 → Your App Server
    ├── EC2 Instance 2 → Your Database Server
    ├── EC2 Instance 3 → Someone else's workload
    └── EC2 Instance 4 → Another customer's app

IaaS → Most Control, Most Responsibility (you)
PaaS → Balanced
SaaS → Least Control, Least Responsibility (provider handles all)

Why This Matters for DevOps

High Availability:** Deploy your app across 2+ AZs — if one fails, the other keeps running
Disaster Recovery:** Use a second Region as backup
Low Latency:** Choose Region closest to your users (for India → Mumbai `ap-south-1`)
Data Residency:** Some data must stay in a specific country — choose that Region

> 🇮🇳 India: AWS Mumbai Region (`ap-south-1`) is the go-to for Indian companies due to data residency compliance and low latency.

---

🎓 AWS Certification Roadmap

FOUNDATIONAL (Start Here)
└── AWS Certified Cloud Practitioner (CLF-C02)
      ↓
ASSOCIATE LEVEL (Pick your path)
├── Solutions Architect Associate (SAA-C03)  ← Most Popular
├── Developer Associate (DVA-C02)
└── SysOps Administrator Associate (SOA-C02)
      ↓
PROFESSIONAL LEVEL
├── Solutions Architect Professional
└── DevOps Engineer Professional  ← Your Target!
      ↓
SPECIALTY
├── Security
├── Networking
├── Data Analytics
├── Machine Learning
└── Database

## 🔐 AWS Account Setup (Free Tier)

### What is Free Tier?

AWS gives you **12 months free** access to many services when you sign up. Great for learning!

### Free Tier Highlights

* EC2: 750 hours/month (`t2.micro` or `t3.micro`)
* S3: 5 GB storage
* Lambda: 1 million requests/month
* RDS: 750 hours/month

### Step-by-Step Account Creation

**Step 1:** Go to `https://aws.amazon.com` → Click **"Create an AWS Account"**

**Step 2:** Enter your email address + choose a unique account name

**Step 3:** Create a strong password (this is your Root user password — keep it safe!)

**Step 4:** Enter contact information (personal or business)

**Step 5:** Add a valid credit/debit card (AWS does a $1 verification charge — it's reversed)

**Step 6:** Phone OTP verification

**Step 7:** Select **Free tier** support plan

> ⚠️ **Warning:** After creating the account, your very first action should be enabling MFA on the Root account.

---

## 🔒 What is MFA and Why It Matters

### MFA = Multi-Factor Authentication

Normal login = Password only (1 factor)

MFA login = Password + OTP from your phone (2 factors)

Even if someone steals your password, they cannot log in without your phone.

### Root Account — The Most Dangerous Account

The Root user is the master account — it has unrestricted access to everything in your AWS account. If this gets compromised, an attacker can:

* Delete all your resources
* Rack up massive bills
* Steal all your data

**That's why: Enable MFA on Root account IMMEDIATELY.**

### Steps to Enable MFA on Root Account

**Recommended Apps:** Google Authenticator | Authy | Microsoft Authenticator

---

## 👤 IAM — Identity and Access Management

### What is IAM?

IAM is AWS's access control system. It answers the question:

> **"Who can do what on which AWS resource?"**

### IAM Key Concepts

| Term       | What it is                         | Real World Analogy              |
| ---------- | ---------------------------------- | ------------------------------- |
| Root User  | Master account, full control       | CEO with all keys               |
| IAM User   | Individual person account          | Employee with access card       |
| IAM Group  | Collection of users                | Department (e.g., DevOps team)  |
| IAM Policy | JSON document defining permissions | Access control list             |
| IAM Role   | Temporary permissions for services | Contractor badge (time-limited) |

### Why NOT Use Root for Daily Work?

The Root account is like a nuclear launch button — powerful but dangerous.

Best practice:

✅ Create an IAM User with Admin access for daily work

✅ Lock the Root account away

✅ Never share Root credentials with anyone

### Step-by-Step: Create IAM User

### IAM Permission Policies

| Policy              | What it Allows          | Use When              |
| ------------------- | ----------------------- | --------------------- |
| AdministratorAccess | Everything              | Learning / Admin work |
| PowerUserAccess     | All services except IAM | Developer             |
| ReadOnlyAccess      | View only               | Auditor / Monitoring  |

### Principle of Least Privilege

> Give users only the permissions they need — nothing more.

A developer doesn't need billing access. A tester doesn't need to delete EC2 instances. Always assign minimum required permissions.

---

## 🔁 IAM Sign-in Flow

---

## 🚨 COMMON MISTAKES (Avoid These!)

| Mistake                                | Why It's Bad                       | Correct Approach               |
| -------------------------------------- | ---------------------------------- | ------------------------------ |
| Using Root for daily tasks             | If compromised, everything is lost | Create and use IAM user        |
| No MFA on Root                         | Password alone is not enough       | Enable MFA immediately         |
| Giving AdministratorAccess to everyone | Violates least privilege           | Assign only needed permissions |
| Sharing access keys publicly (GitHub)  | Attackers scan GitHub for keys     | Use IAM Roles, not access keys |
| Not downloading credentials CSV        | You can't retrieve password later  | Download and store securely    |
| Ignoring billing alerts                | Surprise bills!                    | Set up AWS Budgets + alerts    |

---

## 💼 INTERVIEW QUESTIONS

### Easy (Freshers)

**Q1: What is cloud computing?**

**A:** Cloud computing is the delivery of IT services (compute, storage, networking) over the internet on a pay-as-you-go basis, eliminating the need to own physical hardware.

**Q2: What is the difference between IaaS, PaaS, and SaaS?**

**A:** IaaS gives you raw infrastructure (like EC2), PaaS gives you a platform to deploy code (like Elastic Beanstalk), and SaaS gives you a ready-to-use software product (like Gmail). As you move from IaaS → PaaS → SaaS, you manage less but also control less.

**Q3: What is an AWS Region and Availability Zone?**

**A:** A Region is a geographic location (e.g., Mumbai) that contains multiple isolated data centers called Availability Zones (AZs). Each AZ is independent but connected with high-speed links to enable high availability.

**Q4: What is IAM in AWS?**

**A:** IAM (Identity and Access Management) is AWS's service to control who can access AWS resources and what actions they can perform. It uses users, groups, roles, and policies.

**Q5: Why should you not use the Root account for daily tasks?**

**A:** The Root account has unrestricted access to everything. If compromised, an attacker gains complete control. IAM users with specific permissions should be used for daily operations following the principle of least privilege.

### Intermediate

**Q6: What is MFA and why is it important in AWS?**

**A:** MFA (Multi-Factor Authentication) requires a second verification step (OTP from phone app) beyond just a password. It prevents unauthorized access even if credentials are stolen.

**Q7: What is the difference between a Public, Hybrid, and Private cloud?**

**A:** Public cloud (everything on AWS), Hybrid (mix of cloud + on-premise, most common in enterprises), Private cloud (resources in your own data center).

**Q8: What is the Principle of Least Privilege?**

**A:** Granting users only the minimum permissions needed to do their job — nothing more. Reduces the blast radius if an account is compromised.

### DevOps-Focused

**Q9: How would you secure an AWS account from day one?**

**A:** Enable MFA on Root immediately, create an IAM user for daily use, apply AdministratorAccess only where needed, set up AWS CloudTrail for audit logging, enable billing alerts, and never store access keys in code repositories.

**Q10: A new DevOps engineer joins your team. How do you give them AWS access?**

**A:** Create an IAM user for them, add them to the DevOps IAM Group that has pre-configured policies (like PowerUserAccess), enable MFA on their account, and share only the IAM console URL — not the Root credentials.

## 🔬 Practice Questions

### Easy

1. You want to use a server for 3 hours to run a data processing job and then shut it down. Which cloud characteristic makes this cost-effective?

2. What does "Availability Zone" mean in AWS context?

3. Name 3 services available in the AWS Free Tier.

### Medium

1. Your company has sensitive financial data that cannot leave India due to compliance laws. Which AWS Region should you use, and what model (Public/Hybrid/Private) applies?

2. You gave your IAM user `AdministratorAccess`. Your manager says this violates security policy. What should you do instead?

3. Explain the difference between an IAM User and an IAM Role with a real-world example.

### DevOps-Focused

1. You're setting up AWS for a new startup from scratch. List the first 5 things you would do to secure the account.

2. Your Terraform script accidentally uploaded AWS Access Keys to a public GitHub repo. What is your immediate action plan?

---

## 🎯 Key Takeaways

* Cloud computing allows you to rent infrastructure on-demand instead of buying physical hardware.
* AWS provides scalability, elasticity, global reach, and pay-as-you-go pricing.
* Most enterprises operate using a Hybrid Cloud model.
* AWS infrastructure is built around Regions, Availability Zones, and Edge Locations.
* For a DevOps career path, Cloud Practitioner → SAA → DevOps Engineer Professional is a common progression.
* The Root account should only be used for account-level administration.
* MFA should be enabled immediately after account creation.
* IAM controls who can access AWS resources and what actions they can perform.
* Follow the Principle of Least Privilege when assigning permissions.
* Never expose AWS Access Keys publicly and always enable security controls from day one.

---

> 💬 This article is part of my journey learning AWS, Cloud, and DevOps from scratch. If you're also starting out, feel free to connect and share your learning experience.