Day 4Concepts · Lab⏱ 1.5h
Global Infrastructure and the AWS CLI
By the end of today you can
Explain Regions, Availability Zones and edge locations, choose a Region sensibly, and talk to AWS from your terminal with the CLI.
1. First principles: where does your app physically live?
Computers are in buildings. Buildings can lose power, flood or burn. Users far away experience delay (latency, because light takes time to travel). AWS solves both with geography:
- Region: a geographic area (e.g.
eu-west-1Ireland,af-south-1Cape Town,us-east-1N. Virginia). Regions are isolated from each other. - Availability Zone (AZ): one or more separate data centers inside a Region with independent power and networking, connected by fast links. Regions typically have 3 or more.
- Edge location: small sites worldwide that cache content close to users (CloudFront CDN).
Analogy: a pizza chainA Region is a city. An AZ is a separate kitchen in that city: if one has a power cut, the others still deliver. An edge location is a delivery scooter parked on your street holding popular pizzas ready to hand over.
How to choose a Region (4 factors, an exam favourite)
- Compliance/data residency (laws on where data may live)
- Latency to your users
- Service availability (new services launch in some Regions first)
- Price (varies by Region)
2. Three ways to use AWS
| Way | Good for |
|---|---|
| Management Console (website) | Learning, exploring |
| CLI (command line) | Fast, scriptable, repeatable (and your Linux skills shine) |
| SDKs (Python, JS…) | Code that talks to AWS |
Behind all three is the same thing: an HTTPS API. Click or type, the same request goes to AWS.
3. Lab
- CloudShell first (zero setup): in the console click the
>_icon (CloudShell). It's a ready terminal already logged in as you. Run:aws sts get-caller-identity aws ec2 describe-regions --output table aws ec2 describe-availability-zones --region eu-west-1 --query 'AvailabilityZones[].ZoneName' - Find out which Regions are closest to you and write down which of the 4 factors matter most for your future projects.
- Install the CLI v2 on your own Linux (your WSL/Ubuntu):
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip unzip awscliv2.zip && sudo ./aws/install aws --version - Create an access key for your admin IAM user (IAM → Users → you → Security credentials → Create access key → "CLI"). Then:
aws configure --profile lab # paste key id, secret, region (e.g. eu-west-1), output json aws sts get-caller-identity --profile lab - Try:
aws s3 ls --profile lab(empty is fine) andaws iam list-users --profile lab --output table.
Key hygieneKeys live in
~/.aws/credentials, never in a Git repo. Add .aws/, *.pem and .env to your .gitignore. Before every push run git diff --staged and look for strings starting with AKIA. (A newer, safer option is IAM Identity Center with aws configure sso, which we'll adopt later.)📸 Evidence:
evidence/day04-sts-identity.png (hide the account ID digits)4. Exam notes
Remember
- Most services are regional; IAM, Route 53 and CloudFront are global.
- High availability = use multiple AZs. Disaster recovery = use multiple Regions.
- Data doesn't leave a Region unless you move it.
- CLI / SDK access uses access keys; console uses password.