Free lesson · AWS Fundamentals

The AWS service landscape

Easy5 min read

A Map Before The Territory

AWS has over two hundred services with names that mostly do not describe what they do. Encountering them one at a time, in the order a tutorial happens to introduce them, is disorienting.

This topic gives you the skeleton. You are not learning any service here - you are learning the shape of the catalog so that every service you meet later has somewhere to go.

The organising insight: almost every AWS service is a managed version of something you already understand. A database. A queue. A load balancer. A DNS server. A file system. The service names are unfamiliar; the primitives underneath are not.

The Layers

graph TD
    G[Governance and Cost<br/>Organizations, Config, Budgets]
    S[Security and Identity<br/>IAM, KMS, GuardDuty, WAF]
    O[Observability<br/>CloudWatch, X-Ray, CloudTrail]
    A[Application Services<br/>Integration, Analytics, AI/ML]
    D[Data<br/>Databases, Storage, Caching]
    C[Compute<br/>EC2, Lambda, ECS, EKS]
    N[Networking<br/>VPC, ELB, Route 53, CloudFront]
    I[Global Infrastructure<br/>Regions, AZs, Edge]
    A --> D
    D --> C
    C --> N
    N --> I
    S -.-> A
    S -.-> D
    S -.-> C
    O -.-> A
    O -.-> C
    G -.-> S

This diagram shows the AWS service catalog as layers. At the base is global infrastructure, comprising Regions, Availability Zones, and edge locations. Networking sits above it with VPC, load balancing, Route 53, and CloudFront. Compute sits above networking with EC2, Lambda, ECS, and EKS. Data sits above compute with databases, storage, and caching. Application services sit at the top with integration, analytics, and AI/ML. Cutting across all layers are three cross-cutting concerns: security and identity, observability, and governance and cost.

Five stacked layers, three cross-cutting concerns. Every service you meet belongs somewhere on this picture.

The Layers, Service By Service

Global Infrastructure

Not services - the substrate. Regions, Availability Zones, edge locations, Local Zones, Outposts. Module 01 covers this, and it comes first because every other decision inherits from it.

Networking

Where your resources live and how traffic reaches them.

Module 03. The module people skip and regret skipping.

Compute

Where your code runs. The catalog is a spectrum from "you manage everything" to "you manage nothing."

Module 04. The choice between these is one of the most consequential architectural decisions you will make, and Course 2 has a topic devoted to it.

Data

Where state lives. The largest and most confusing part of the catalog, because the right answer depends entirely on access pattern.

Modules 05 and 06.

Application Services

Everything that connects components or does something specialised.

• Integration and messaging - SQS, SNS, EventBridge, Step Functions, Kinesis, MSK, API Gateway. Module 07.
• Data and analytics - Glue, Athena, EMR, Lake Formation, Managed Flink. Module 11.
• AI/ML - Bedrock, SageMaker, and the pre-trained AI services. Module 12.

The Cross-Cutting Three

Security and Identity - IAM, Organizations, KMS, Secrets Manager, GuardDuty, Security Hub, WAF, Shield. Modules 02 and 10. IAM is not optional knowledge; every single service interaction goes through it.

Observability - CloudWatch, X-Ray, CloudTrail, Config, Systems Manager. Module 08.

Governance and Cost - Organizations, Control Tower, Budgets, Cost Explorer, Compute Optimizer. Modules 01, 10, and 13.

Decoding Service Names

AWS naming follows loose conventions that help once you notice them.

Tip: When you meet an unfamiliar service, ask two questions before reading anything else: what primitive is this? and what does it replace? Amazon MSK is Kafka you do not have to operate. Amazon MQ is ActiveMQ or RabbitMQ you do not have to operate. Aurora is a MySQL- and PostgreSQL-compatible database with a rearchitected storage layer. Answering those two questions gets you 80% of the way to knowing whether the service is relevant to you.

The Twenty That Matter Most

If you only ever learn twenty services, these are the twenty that appear in the most job postings, the most certification questions, and the most real architectures:

Foundation: IAM · VPC · EC2 · S3 Serving traffic: ELB · Route 53 · CloudFront · API Gateway Compute: Lambda · ECS/Fargate · EKS · Auto Scaling Data: RDS/Aurora · DynamoDB · ElastiCache Connecting things: SQS · SNS · EventBridge Operating: CloudWatch · CloudFormation

Every path in this course covers all twenty. Everything else is depth on top of them.

Warning: Do not attempt to learn the catalog by breadth. Knowing the names of a hundred services and the behaviour of none is a common and unproductive state - it feels like progress, produces confident wrong answers in interviews, and does not help you build anything. Depth on the twenty above beats recognition of two hundred, every time.

Practice

Exercise: Starter. Cover the layer diagram and place these services from memory: DynamoDB, Route 53, Lambda, GuardDuty, Step Functions, EBS.

Intermediate. Pick five services you have heard of but never used. For each, answer the two questions: what primitive is it, and what does it replace? Verify against the service's overview page.

Advanced. Take a system you know well - one that runs anywhere, including on-premises - and map every component to the AWS service that would replace it. Identify the two components where the mapping is not obvious and write down why.

Related Topics

• Module 01 - Foundations & Global Infrastructure
• Module 00 Topic 2 - Choosing your path
• Course 6 - AWS for System Design Interviews, which inverts this topic: mapping AWS services back to the primitives underneath them

Back to AWS Fundamentals