Regions, availability zones, the shared responsibility model and IAM — Amazon Web Services (AWS) for .NET and Full Stack Developers

1. Regions, availability zones, the shared responsibility model and IAM

Basic★ Must knowLesson 1 of 9

Region — a geographic area (e.g. ap-south-1 Mumbai, ap-northeast-1 Tokyo, us-east-1 N. Virginia) with multiple Availability Zones (AZs) — separate data centres with independent power/network. Deploy across ≥2 AZs for high availability.
Edge locations — CloudFront/Route 53 points of presence close to users.
Shared responsibility: AWS secures the cloud (hardware, facilities, hypervisor, managed service internals); you secure what's in the cloud (IAM, data, OS patches on EC2, network rules, app code, encryption settings).

IAM (Identity and Access Management):

Concept	Meaning
User / group	People (prefer IAM Identity Center/SSO for humans)
Role	Identity assumed by services or people for temporary credentials — EC2 instance roles, ECS task roles, Lambda execution roles
Policy	JSON document allowing/denying actions on resources
Least privilege	Grant only needed actions/resources
Root user	Only for account-level tasks; MFA, no access keys

json

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::shop-uploads-prod/*"
  }]
}

Applications on AWS should use roles (temporary credentials provided automatically to the SDK) — never hard-coded access keys.