Getting started with AWS: the big picture and a safe start

What AWS is

AWS (Amazon Web Services) is a cloud service that lets you rent servers, storage, databases, networking and more over the internet, in just the amount you need. Instead of buying and housing servers yourself, you pay for what you use. You can start a server in minutes and stop it when you are done.

There is a huge range to rent, and the number of services keeps growing. You do not need to learn them all at the start. This article sticks to the overall structure, the main services to learn first, and how to start safely.

Service names, screens, prices and free tiers change. I checked the free-tier rules against the official announcement in October 2026. The rest is general explanation, so check the latest official documentation and pricing pages when you actually use it.

The structure: Regions and Availability Zones

AWS is made of separate sites around the world.

• Region: a geographic area (Tokyo, Osaka, N. Virginia and so on). Services and data are independent in each Region
• Availability Zone (AZ): a group of physically separate data centers within one Region. Power and networking are separate too, so if one AZ fails, the others keep running
• Edge location: a site that serves content close to users (used by CloudFront and others)

How to choose:

• Choose the Region by closeness to your users and by legal and data-location requirements. Services and prices can differ by Region
• To make something harder to take down, spread it across several AZs in one Region
• Data does not leave a Region unless you explicitly copy it to another

The main services to learn first

There are many more services. The table is only an entrance.

A typical web app architecture

A typical small web app shows how the services connect.

• A user's request arrives at CloudFront, which returns static files from a nearby location
• For dynamic work, a load balancer (ALB) distributes requests to servers (EC2) in several AZs
• The database (RDS) sits in a private subnet that cannot be reached directly from outside
• Images and backups go in S3. Logs and metrics are collected in CloudWatch

The shared responsibility model

In the cloud, AWS and you split what each protects.

“We use AWS, so we are safe” is not true. Making an S3 bucket public by mistake, or leaking an access key with strong permissions, is a problem with your side's settings. Your share varies by service (with EC2 you handle OS updates; with Lambda it is mostly your code and permissions).

Safety settings to make first

After creating an account, decide these three things before using any services.

1. Protect the root user: the account you first created with an email address is the root user, which holds every permission and the billing information. Give it a strong password and always set up multi-factor authentication (MFA). Do not use it for everyday work.
2. Create separate everyday access: the official guidance is for people to use temporary credentials rather than long-lived access keys. For several accounts or people, managing access with IAM Identity Center is recommended. Limit permissions to what is needed.
3. Set a cost alert: with a budget (AWS Budgets), set a spending limit and who gets notified, so you notice overspending quickly.

Once IAM Identity Center is set up, the AWS CLI can also work through browser sign-in.

# Set up a connection through IAM Identity Center (follow the prompts)
aws configure sso

# Sign in with that connection (<profile-name> is the name you chose)
aws sso login --profile <profile-name>

# Check which account and identity you are acting as
aws sts get-caller-identity --profile <profile-name>

Never put an access key and secret in source code or Git. If leaked, others can use them and run up a large bill. When you must create a key, limit its permissions and delete it when you stop using it.

How costs work

AWS charges for what you use. New accounts have a way to try it for free. According to the official announcement, new customers can use up to $200 in credits on sign-up ($100 granted, the rest earned by using eligible services). The free account plan ends 6 months after sign-up or when the credits run out, whichever comes first, and you are not charged unless you move to the paid plan. Details can change, so check the official page.

Common causes of surprise charges:

• Servers left running: EC2 is charged by the time it runs. Stop or delete it when you are done
• Data transfer: data leaving AWS can incur transfer charges
• Network components: some, like a NAT gateway, are charged by the hour just for existing and also by the amount of data passed
• Forgotten resources: storage, load balancers and fixed IP addresses keep charging while they remain, even when unused

Delete what you made for practice in one go when you finish. Tagging resources makes it clear what to delete.

How to learn

1. On the free plan, create an account and make the three safety settings above
2. Put a file in S3 and confirm that, with no public setting, only you can read it
3. Start one EC2 server, connect to it, then delete it
4. Build a small web app in the shape of the diagram above
5. Try serverless approaches such as Lambda

Checklist

• Did you set a strong password and MFA on the root user?
• Are you avoiding the root user for everyday work?
• Do people use temporary credentials? If you use access keys, did you limit their permissions?
• Are access keys kept out of code and Git?
• Did you set a budget and a notification?
• Did you choose the Region you will use? Are you not creating things in an unintended Region?
• Did you delete the resources you made for practice?