Explainer cheatsheetThe AWS services developers use mostSimple, analogy, technical
EC2, S3, Lambda, EKS, RDS, Redshift, SNS, CloudFront, CloudWatch. AWS has hundreds of services, but a few dozen do most of the work behind the apps you use every day. This map explains each one in plain words, an everyday picture and the technical details you need to build and host on it, then lists 85 services in a searchable directory.
A web request through AWSTap a box to jump to its module
Amazon Web Services rents you computers, storage, databases and hundreds of ready-made building blocks by the second, in data centres around the world.
In simple words
Instead of buying servers, you rent exactly what you need from AWS, and pay only for what you use. Everything lives in a Region, a city-sized area such as Mumbai or Frankfurt. Each Region has several Availability Zones, separate groups of data centres, so one fire or power cut does not take you down. Smaller edge locations in many more cities deliver content close to users.
Think of it like
AWS is a giant utility company. You do not build a power plant to switch on a light; you plug in and pay the meter. A Region is a city the utility serves, Availability Zones are separate power stations in that city, and edge locations are the neighbourhood substations right next to your street.
Swipe sideways to see the whole diagram
| Idea | What it means for you |
|---|---|
| Shared responsibility | AWS secures the buildings, hardware and hypervisor. You secure your data, access, code and configuration. |
| Managed vs unmanaged | EC2 gives you a server to look after; RDS, Lambda and S3 handle patching and scaling for you. |
| Pay as you go | Per second, per request or per GB. Savings Plans and Reserved Instances trade commitment for discounts. |
| Free plan | New accounts since July 2025 pick a Free plan (credits, up to 6 months) or a Paid plan at sign-up. |
| Data transfer | Data coming in is free; data going out to the internet or across Regions is billed. Plan for it. |
ap-south-1; AZs like ap-south-1a. AZ letters are shuffled per account, so use AZ IDs (aps1-az1) when coordinating across accounts.aws CLI, SDKs for every language, and infrastructure as code (CloudFormation, CDK, Terraform).Amazon EC2 rents you virtual machines in minutes: you pick the size, the operating system and how many, and pay by the second.
In simple words
An EC2 instance is a computer in an AWS data centre that you control fully: install anything, SSH in, run any software. An Auto Scaling group adds instances when traffic rises and removes them when it falls. A load balancer spreads visitors across them, and EBS gives each one a disk.
Think of it like
Renting cars instead of owning a fleet. You choose a hatchback or a lorry (instance type), drive it as long as you need, and return it. Auto Scaling is a rental desk that hands out more cars when a crowd arrives; the load balancer is the attendant waving each customer to a free car.
Swipe sideways to see the whole diagram
Elastic Compute Cloud
SimplyVirtual servers you fully control.
Think of it asA rented car you drive yourself.
ALB, NLB, GWLB
SimplySpreads traffic over healthy servers.
Think of it asAn attendant pointing each customer to a free counter.
Elastic Block Store
SimplyA network disk attached to one instance.
Think of it asA detachable hard drive in the car boot.
Auto Scaling groups
SimplyKeeps the right number of instances running.
Think of it asA rental desk that matches cars to the queue.
| Pricing model | Discount vs On-Demand | Good for |
|---|---|---|
| On-Demand | None | Unpredictable or short workloads |
| Savings Plans, Reserved | Up to about 70% | Steady baseline you commit to for 1 or 3 years |
| Spot | Up to about 90% | Interruptible work: batch, CI, stateless workers |
| Graviton (Arm) | Often 20% or more better price-performance | Most Linux workloads |
t burstable, m general, c compute, r memory, g and p GPU, i storage. A g suffix (m7g) means Graviton Arm; a size like .large doubles at each step.169.254.169.254. Require IMDSv2 to block SSRF credential theft.aws ec2 describe-instances --filters Name=instance-state-name,Values=running \
--query "Reservations[].Instances[].[InstanceId,InstanceType,Placement.AvailabilityZone]" --output tableUpload a function, choose what triggers it, and AWS runs it on demand, as many copies at once as needed, billed by the millisecond.
In simple words
With AWS Lambda you write just a function, say "resize this image" or "handle this API call". Something happens, an event, and Lambda runs your code, then stops. A thousand events at once means a thousand copies. No events means no cost. You never see or patch a server; that is what serverless means.
Think of it like
A taxi instead of a car. You do not own, park, insure or service anything. You call one when you need a ride (an event), pay for that trip only, and if a hundred people need rides at once, a hundred taxis show up.
Swipe sideways to see the whole diagram
Serverless functions
SimplyRuns your function when an event arrives.
Think of it asA taxi you only pay per ride.
REST, HTTP and WebSocket APIs
SimplyThe front door that turns HTTP calls into function calls.
Think of it asA hotel reception routing guests to the right room.
Workflows
SimplyChains steps into a visual workflow with retries.
Think of it asA recipe card that says what to do next and what to do if a step burns.
/tmp, 6 MB synchronous request and response payloads.arm64 for lower cost on most runtimes.Package your app once as a container image, then let AWS schedule, scale and restart it across a fleet. ECS is AWS's own orchestrator; EKS is managed Kubernetes.
In simple words
A container bundles your app with everything it needs, so it runs the same everywhere. An orchestrator decides which machine runs each container, restarts crashed ones and scales them. ECS is the simpler AWS-native option; EKS runs standard Kubernetes for teams that want its ecosystem. Fargate removes the machines entirely: you only describe the containers.
Think of it like
Shipping containers at a port. Every box has a standard size, so cranes, ships and trucks handle them without caring what is inside. The orchestrator is the port's control tower deciding which ship takes which box. Fargate is paying a shipping line to carry your boxes without ever owning a ship.
Swipe sideways to see the whole diagram
Elastic Kubernetes Service
SimplyManaged Kubernetes clusters.
Think of it asA port with a professional control tower you hire.
Elastic Container Service
SimplyAWS's own, simpler container orchestrator.
Think of it asThe port's in-house tower: fewer knobs, works out of the box.
Serverless containers
SimplyRun containers without managing servers.
Think of it asA shipping line carrying your boxes on its ships.
Also in this family
aws eks update-kubeconfig --name prod --region ap-south-1
kubectl get nodes -o wide
kubectl get pods -AAmazon S3 stores any number of files of any size, reachable by URL, with extreme durability. EBS and EFS give servers disks and shared folders.
In simple words
Amazon S3 keeps files, called objects, in containers called buckets. There are no folders really, just names like images/cat.jpg. You can store a single photo or petabytes, and serve it straight to browsers. Rarely used data can sit in cheaper storage classes, down to Glacier Deep Archive for files you may never touch.
Think of it like
A huge valet storage warehouse. Hand over a box with a label (the key), get a ticket back, and retrieve it any time. Boxes you use daily stay at the front counter (Standard); old tax files go to a cheaper basement (Glacier) where fetching them takes a while.
Swipe sideways to see the whole diagram
Simple Storage Service
SimplyUnlimited file storage behind an API and URLs.
Think of it asValet storage: hand over a labelled box, get it back any time.
Elastic File System
SimplyA shared network folder many servers mount at once.
Think of it asA shared office cabinet everyone can open.
Also in this family
aws s3 cp ./dist s3://letterpad-media/site --recursive
aws s3 presign s3://letterpad-media/backups/2026-10-19.tar.gz --expires-in 600AWS runs the database software for you: installs, patches, backs up and fails over. You choose the engine that fits your data.
In simple words
Amazon RDS gives you a ready PostgreSQL, MySQL, MariaDB, Oracle, SQL Server or Db2 database without managing the server. Aurora is AWS's own faster, more resilient engine compatible with PostgreSQL and MySQL. DynamoDB is a different kind of database, key-value and serverless, that stays fast at any scale. ElastiCache keeps hot data in memory.
Think of it like
Hiring a building manager for your records room. RDS is a manager who keeps your filing cabinets tidy, makes nightly copies and keeps a spare room ready. DynamoDB is a self-service locker wall: one key opens one locker instantly, no matter how many lockers there are.
Swipe sideways to see the whole diagram
Relational Database Service
SimplyManaged classic SQL databases.
Think of it asA building manager for your filing cabinets.
PostgreSQL and MySQL compatible
SimplyAWS's cloud-native relational engine.
Think of it asThe same filing system, rebuilt with fireproof walls.
Serverless NoSQL
SimplyKey-value tables with single-digit millisecond reads at any scale.
Think of it asA wall of lockers: one key, one locker, instant.
Valkey, Redis OSS, Memcached
SimplyIn-memory cache in front of your database.
Think of it asA sticky note of answers you just looked up.
Also in this family
max_connections.Redshift is a data warehouse for fast SQL over billions of rows. Around it, S3, Glue, Athena, Kinesis and QuickSight move and query data.
In simple words
Your app database is built for many small reads and writes. Questions like "revenue by city for the last three years" need a different tool: an analytics warehouse such as Amazon Redshift, which stores data by column and splits big queries across many machines. Many teams first collect raw files in S3, a data lake, then query them with Athena or load them into Redshift.
Think of it like
Your shop till records each sale quickly (the app database). At the end of the year an accountant copies everything into ledgers organised for big-picture questions (the warehouse). The data lake is the storeroom where every receipt is kept, sorted later as needed.
Swipe sideways to see the whole diagram
Cloud data warehouse
SimplyFast SQL over huge historical datasets.
Think of it asAn accountant's ledgers organised for big questions.
Serverless SQL on S3
SimplyQuery files in S3 with SQL, no servers.
Think of it asReading the storeroom receipts without moving them.
Data Streams and Firehose
SimplyMoves real-time streams of events.
Think of it asA conveyor belt carrying events as they happen.
Also in this family
Let services talk without waiting on each other. SNS broadcasts a message to many subscribers; SQS holds messages in a queue until a worker is ready.
In simple words
When an order is placed, billing, email and analytics all need to know. Instead of the order service calling each one, it publishes one message to an SNS topic, which pushes copies to every subscriber. An SQS queue sits in front of a worker and holds messages safely until it can process them, even if it is slow or briefly down. EventBridge routes events by rules, like a smart mail sorter.
Think of it like
SNS is a WhatsApp group announcement: post once and every member gets it. SQS is a ticket queue at a deli counter: orders wait in line, and staff take the next ticket when free, so nothing is lost when the shop gets busy.
Swipe sideways to see the whole diagram
Simple Notification Service
SimplyPush one message to many subscribers.
Think of it asA group announcement everyone receives.
Simple Queue Service
SimplyA durable queue between producers and workers.
Think of it asDeli counter tickets waiting for staff.
Event bus, Pipes, Scheduler
SimplyRoutes events to targets by matching rules.
Think of it asA mail sorter that reads each envelope and sends it to the right desk.
Also in this family
MaximumMessageSize attribute, for SQS, Firehose and Lambda subscriptions.maxReceiveCount failed attempts, messages move to a DLQ for inspection instead of blocking the queue forever.CloudFront caches your site in edge locations near users and protects your origin. Route 53 answers DNS and steers users to healthy endpoints.
In simple words
CloudFront is AWS's CDN: copies of your images, scripts and pages sit in edge locations around the world, so a visitor in Chennai is served from a nearby city instead of a server in Virginia. Only cache misses travel back to your origin. Route 53 is AWS's DNS service, with health checks that can route around failures. You can even run small bits of code at the edge.
Think of it like
A newspaper printed at regional presses instead of shipped from one city. Readers get today's copy from the press nearest them (edge), and only special editions are fetched from head office (origin). Route 53 is the directory telling each reader which press is closest and open.
Swipe sideways to see the whole diagram
Content delivery network
SimplyCaches and serves content from cities near users.
Think of it asRegional printing presses for your newspaper.
DNS and health checks
SimplyHosts your DNS and routes users by health, latency or location.
Think of it asThe directory telling readers which press is open.
Edge compute
SimplyRun code where the request arrives.
Think of it asA press operator who can stamp each copy on the way out.
Also in this family
app.3f9c.js) so you rarely need them.A VPC is your own private network inside AWS. Public subnets face the internet; private subnets keep servers and databases out of reach.
In simple words
Every AWS account gets a VPC, a private network with its own address range. You split it into subnets per Availability Zone. Public subnets have a route to the internet gateway, so a load balancer can receive visitors. Private subnets hold app servers and databases that nobody can reach directly. Security groups act as a firewall on each resource.
Think of it like
A gated housing society. The VPC is the boundary wall. The public subnet is the visitor lobby by the front gate; the private subnet is the residential towers inside. Security guards (security groups) at each tower door check who may enter. The NAT gateway is a one-way exit for residents to go shopping without letting strangers in.
Swipe sideways to see the whole diagram
| Piece | Job | Picture |
|---|---|---|
| VPC | Your private network and IP range | The society wall |
| Subnet | A slice of the VPC in one AZ | One tower or the lobby |
| Route table | Where traffic from a subnet goes | Signposts inside the gate |
| Internet gateway | Two-way door to the internet | The main gate |
| NAT gateway | Outbound-only internet for private subnets | A one-way exit |
| Security group | Stateful firewall per resource | A guard at each door |
| Network ACL | Stateless firewall per subnet | A checkpoint on the internal road |
| VPC endpoint | Private path to AWS services | A private tunnel to the post office |
10.0.0.0/16, /20 subnets) so VPCs can later be peered or joined by Transit Gateway.CloudWatch collects metrics and logs from every service, raises alarms and draws dashboards. CloudTrail records who did what in your account.
In simple words
Amazon CloudWatch is the dashboard of your car. Every service reports metrics, numbers over time like CPU or error count, and your apps send logs. You set alarms: "if errors pass 5% for five minutes, alert the team and add a server." X-Ray traces one request across services, and CloudTrail keeps an audit log of every API call made in your account.
Think of it like
A hospital monitor beside a patient. It tracks pulse and blood pressure continuously (metrics), keeps a chart of notes (logs), and beeps when a number crosses a line (alarm). CloudTrail is the visitor register at the ward door: who came in, when, and what they touched.
Swipe sideways to see the whole diagram
Metrics, logs, alarms, dashboards
SimplyWatches everything and alerts you.
Think of it asA hospital monitor that beeps on danger.
API audit log
SimplyRecords every action taken in your account.
Think of it asThe visitor register at the door.
Distributed tracing
SimplyFollows one request through many services.
Think of it asA tracking number on a parcel.
Also in this family
fields @timestamp, @message | filter level = "error" | stats count() by bin(5m).aws logs tail /aws/lambda/resize-image --follow --since 10m
aws cloudwatch describe-alarms --state-value ALARMIAM decides who can do what to which resource. KMS, Secrets Manager, WAF and GuardDuty protect data, secrets and traffic.
In simple words
IAM (Identity and Access Management) is the rulebook of your account. People and programs get roles, and policies list exactly which actions they may take on which resources. Everything is denied unless allowed. KMS manages encryption keys, Secrets Manager stores passwords and API keys, WAF blocks bad web traffic, and GuardDuty watches for suspicious activity.
Think of it like
An office building's access cards. Each card (role) opens only certain doors (policies). By default no door opens. A "never this door" note from security (explicit deny) beats any permission. KMS is the master key cabinet, Secrets Manager the safe, WAF the security guard at reception.
Swipe sideways to see the whole diagram
Identity and Access Management
SimplyWho can do what, on which resource.
Think of it asAccess cards for an office building.
Key Management Service
SimplyCreates and guards encryption keys.
Think of it asThe master key cabinet that never lets keys leave.
Web firewall and DDoS protection
SimplyBlocks attacks before they reach your app.
Think of it asThe guard checking bags at reception.
Also in this family
Effect, Action (s3:GetObject), Resource (an ARN) and optional Condition (source IP, tags, MFA).Pick the simplest hosting that fits, define it as code, and wire the services into one reliable architecture.
In simple words
You rarely use one service alone. A typical web app sends users through Route 53 and CloudFront, serves the frontend from S3, runs the API on containers or EC2 behind a load balancer, stores data in RDS with a cache, hands slow work to SQS and Lambda, and watches everything in CloudWatch. Describe it all as infrastructure as code so you can rebuild it in minutes.
Think of it like
Building a restaurant from rented parts. A signboard on the highway (Route 53), a quick takeaway window for ready snacks (CloudFront and S3), a host at the door seating guests (load balancer), cooks in the kitchen (containers), the pantry (database), a ticket rail for slow orders (SQS), and a manager watching the floor (CloudWatch). The blueprint (code) lets you open a second branch overnight.
Swipe sideways to see the whole diagram
| You want | Simplest fit | Why |
|---|---|---|
| A static site or SPA | S3 + CloudFront, or AWS Amplify Hosting | No servers, global, cheap; Amplify adds Git deploys and previews |
| A small VPS, fixed price | Amazon Lightsail | Bundled server, disk, IP and transfer at a flat monthly price |
| Deploy a web app without infrastructure work | AWS App Runner or Elastic Beanstalk | Give it code or an image; it handles load balancing and scaling |
| Event-driven APIs | API Gateway + Lambda + DynamoDB | Scales to zero, pay per request |
| Containers with control | ECS on Fargate, or EKS | Standard images, rolling deploys, autoscaling |
| Full OS control | EC2 with Auto Scaling | Anything goes; you own patching |
Infrastructure as code
SimplyDescribe your whole setup as code and deploy it repeatably.
Think of it asAn architect's blueprint any builder can follow.
CI/CD
SimplyBuilds, tests and deploys on every commit.
Think of it asA conveyor belt from kitchen to table.
Full-stack web and mobile hosting
SimplyGit-connected hosting for frontends and serverless backends.
Think of it asA franchise kit: storefront ready, just add your menu.
env, team and service so Cost Explorer can split the bill.85 of the most used AWS services in one searchable list, each in plain words and in technical words.
No services match. Try a shorter word.
Which one do I need?
| I need to… | Reach for |
|---|---|
| Run a server I control | EC2 |
| Run code only when something happens | Lambda |
| Run containers | ECS on Fargate, or EKS |
| Store files and images | S3 |
| A SQL database | RDS or Aurora |
| Massive key-value lookups | DynamoDB |
| A cache | ElastiCache |
| Analyse years of data with SQL | Redshift or Athena |
| Broadcast an event to many services | SNS |
| Queue background jobs | SQS |
| Route events by rules or schedules | EventBridge |
| Speed up my site worldwide | CloudFront |
| DNS for my domain | Route 53 |
| Monitor and alert | CloudWatch |
| Control who can do what | IAM |
| Host a static site | S3 + CloudFront or Amplify |
| Describe infrastructure as code | CDK or CloudFormation |
What people ask most when they start on AWS. Tap one to open it.
New accounts created since July 15, 2025 choose a Free plan or a Paid plan. The Free plan gives credits and lasts up to six months or until credits run out; over 30 services also have always-free allowances. Set a budget alert either way.
IAM, EC2, S3, VPC, RDS, Lambda, CloudWatch and CloudFront. Almost every architecture uses them, and the rest build on the same ideas.
Lambda for short, event-driven work and spiky traffic. ECS on Fargate for most containerised web apps. EKS if your team already runs Kubernetes. EC2 when you need full control of the OS or special hardware.
SNS pushes one message to many subscribers right away. SQS holds messages until a worker pulls them. Together they give fan-out with safe buffering.
RDS or Aurora when your data is relational and you want SQL joins. DynamoDB when you know your access patterns and need consistent speed at very large scale.
Common causes: NAT gateway data processing, data transfer out, idle EC2 or RDS instances, unattached EBS volumes and snapshots, CloudWatch Logs with no retention, and public IPv4 addresses. Cost Explorer grouped by service shows which.
Yes for anything public: HTTPS on your domain, caching near users, private bucket via Origin Access Control, and WAF protection. It is often cheaper too, because S3 to CloudFront transfer is free.
A geographic area with its own data centres. Pick the one closest to most users that offers the services you need and meets data residency rules, for example ap-south-1 (Mumbai) or ap-south-2 (Hyderabad) for India.
AWS secures the infrastructure; you secure your configuration. Turn on MFA for the root user, use roles not keys, keep S3 Block Public Access on, encrypt by default and enable CloudTrail and GuardDuty.
Use infrastructure as code: AWS CDK, CloudFormation or Terraform. Your whole setup becomes reviewable, repeatable code.
Where to go deeper, and the open resources this page is built with.