Amazon Web Services (AWS) for .NET and Full Stack Developers

In short: A region is a geographic area (Mumbai, Singapore, Tokyo…) containing multiple isolated availability zones — separate data centres with independent power, cooling and networking connected by low-latency links.

• Deploying across at least two AZs protects against a data-centre failure; multiple regions protect against regional outages and serve global users.

In short: AWS is responsible for security of the cloud — physical data centres, hardware, networking, virtualisation and the internals of managed services.

• The customer is responsible for security in the cloud — IAM users and policies, data and its encryption, network configuration (security groups), OS patching on EC2, application code and secrets.
• The split shifts with the service: more customer responsibility on EC2, less on Lambda/S3.

In short: IAM controls who can do what on which AWS resources using JSON policies.

• A user is a long-term identity (person or legacy app) with credentials;
• a role is an identity without permanent credentials that is assumed to obtain temporary credentials — used by EC2 instances, ECS tasks, Lambda functions, other accounts and federated users.
• Applications should use roles, not access keys.

In short: EC2: full VMs you manage (good for legacy IIS apps).

• Elastic Beanstalk: PaaS that provisions EC2, load balancing and scaling for you — quick hosting.
• ECS on Fargate: run containers without managing servers — the common choice for containerised ASP.NET Core microservices.
• Lambda: functions billed per request that scale to zero — great for event-driven or spiky APIs, with cold starts and time limits (15 min).

In short: Simple Storage Service: object storage for files of any size in buckets, highly durable (11 nines), accessed over HTTPS/SDK.

• Storage classes trade price vs access speed: Standard (frequent), Intelligent-Tiering (automatic), Standard-IA/One Zone-IA (infrequent), Glacier Instant/Flexible/Deep Archive (archives).
• Lifecycle rules move objects between classes automatically.

In short: Amazon RDS for SQL Server (managed: backups, patching, Multi-AZ failover, read replicas on Enterprise;

• licence included), RDS Custom for SQL Server (OS access, BYOL), or SQL Server on EC2 (full control, Always On, SSIS/SSRS on the box).
• Place databases in private subnets, restrict security groups to the app tier, encrypt with KMS and store credentials in Secrets Manager.

In short: Security groups are stateful firewalls attached to instances/network interfaces with allow rules only — return traffic is automatically allowed.

• Network ACLs are stateless rules on subnets with both allow and deny, evaluated in order, requiring explicit rules for return traffic.
• Security groups are the primary control; NACLs add coarse subnet-level protection.

In short: SQS is a message queue — consumers pull messages, each processed by one consumer, with retries and DLQs (decoupling and buffering).

• SNS is pub/sub — a message published to a topic is pushed to all subscribers (fan-out, notifications).
• EventBridge is an event bus with content-based routing rules from AWS services, SaaS and apps, plus a scheduler — for event-driven architectures.
• Common combination: SNS/EventBridge fan-out to several SQS queues.

In short: A fully managed NoSQL key-value/document database with consistent single-digit-ms latency at any scale.

• Items are stored by partition key (and optional sort key);
• design starts from access patterns — choose a high-cardinality partition key to spread load, a sort key for ranges/ordering, and GSIs for other access patterns (often single-table design).
• Use on-demand or provisioned capacity with auto scaling.

In short: Give the ECS task a task IAM role with a least-privilege policy for the specific S3 bucket/prefix; the AWS SDK picks up temporary credentials automatically.

• Put RDS in private subnets with a security group allowing port 1433 only from the ECS service's security group;
• store the DB credentials in Secrets Manager (readable by the task role) and load them at startup;
• enforce TLS (Encrypt=True) and KMS encryption at rest.