# AWS

> AWS Cloud Services

- Skill: `muhammederem/aws` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add muhammederem/aws`
- Raw SKILL.md: https://api.skillmd.com/api/skills/muhammederem/aws/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: muhammederem (https://skillmd.com/u/muhammederem)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/muhammederem/aws

---

# AWS Cloud Services

## Overview
Amazon Web Services (AWS) provides a comprehensive cloud platform including compute, storage, database, analytics, networking, deployment, and machine learning services.

## Core Services

### EC2 (Elastic Compute Cloud)

### Launch Instance
```python
import boto3

ec2 = boto3.client('ec2', region_name='us-west-2')

# Launch instance
response = ec2.run_instances(
    ImageId='ami-0c55b159cbfafe1f0',  # Amazon Linux 2
    InstanceType='t2.micro',
    MinCount=1,
    MaxCount=1,
    KeyName='my-key-pair',
    SecurityGroupIds=['sg-1234567890abcdef0'],
    SubnetId='subnet-12345678',
    UserData='''
        #!/bin/bash
        yum update -y
        yum install -y docker
        service docker start
    ''',
    TagSpecifications=[
        {
            'ResourceType': 'instance',
            'Tags': [
                {'Key': 'Name', 'Value': 'MyInstance'},
                {'Key': 'Environment', 'Value': 'Dev'}
            ]
        }
    ]
)

instance_id = response['Instances'][0]['InstanceId']
print(f"Launched instance: {instance_id}")
```

### Manage Instances
```python
# Describe instances
response = ec2.describe_instances(InstanceIds=[instance_id])

# Stop instance
ec2.stop_instances(InstanceIds=[instance_id])

# Terminate instance
ec2.terminate_instances(InstanceIds=[instance_id])

# Create AMI from instance
ec2.create_image(
    InstanceId=instance_id,
    Name='my-custom-ami',
    Description='My custom AMI'
)
```

### S3 (Simple Storage Service)

### Upload/Download
```python
s3 = boto3.client('s3')

# Upload file
s3.upload_file(
    'local_file.txt',
    'my-bucket',
    'remote_file.txt',
    ExtraArgs={'ContentType': 'text/plain'}
)

# Download file
s3.download_file('my-bucket', 'remote_file.txt', 'local_file.txt')

# List objects
response = s3.list_objects_v2(Bucket='my-bucket')
for obj in response.get('Contents', []):
    print(obj['Key'])
```

### Presigned URLs
```python
# Generate presigned URL (valid for 1 hour)
url = s3.generate_presigned_url(
    'get_object',
    Params={'Bucket': 'my-bucket', 'Key': 'file.txt'},
    ExpiresIn=3600
)
```

### Lambda (Serverless Functions)

### Create Function
```python
lambda_client = boto3.client('lambda')

# Create function
response = lambda_client.create_function(
    FunctionName='my-function',
    Runtime='python3.11',
    Role='arn:aws:iam::123456789012:role/lambda-role',
    Handler='lambda_function.lambda_handler',
    Code={
        'ZipFile': b'''
def lambda_handler(event, context):
    return {
        'statusCode': 200,
        'body': 'Hello from Lambda!'
    }
        '''
    },
    Timeout=30,
    MemorySize=256,
)

# Invoke function
response = lambda_client.invoke(
    FunctionName='my-function',
    InvocationType='RequestResponse',
    Payload=json.dumps({'key': 'value'})
)

result = json.load(response['Payload'])
print(result)
```

### Deploy from S3
```python
lambda_client.update_function_code(
    FunctionName='my-function',
    S3Bucket='my-bucket',
    S3Key='lambda-deployment.zip'
)
```

### IAM (Identity and Access Management)

### Create Role
```python
iam = boto3.client('iam')

# Create role
iam.create_role(
    RoleName='lambda-role',
    AssumeRolePolicyDocument=json.dumps({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": {"Service": "lambda.amazonaws.com"},
                "Action": "sts:AssumeRole"
            }
        ]
    })
)

# Attach policy
iam.attach_role_policy(
    RoleName='lambda-role',
    PolicyArn='arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'
)
```

### SageMaker (ML Model Training & Deployment)

### Training Job
```python
sagemaker = boto3.client('sagemaker')

# Create training job
sagemaker.create_training_job(
    TrainingJobName='my-training-job',
    AlgorithmSpecification={
        'TrainingImage': '763104351884.dkr.ecr.us-west-2.amazonaws.com/pytorch-training:2.1.0-cpu-py310',
        'TrainingInputMode': 'File'
    },
    InputDataConfig=[
        {
            'ChannelName': 'training',
            'DataSource': {
                'S3DataSource': {
                    'S3DataType': 'S3Prefix',
                    'S3Uri': 's3://my-bucket/training-data/',
                    'S3DataDistributionType': 'FullyReplicated'
                }
            }
        }
    ],
    OutputDataConfig={
        'S3OutputPath': 's3://my-bucket/output/'
    },
    ResourceConfig={
        'InstanceType': 'ml.m5.xlarge',
        'InstanceCount': 1,
        'VolumeSizeInGB': 10
    },
    StoppingCondition={
        'MaxRuntimeInSeconds': 86400,
        'MaxWaitTimeInSeconds': 86400
    },
    RoleArn='arn:aws:iam::123456789012:role/SageMakerRole'
)
```

### Deploy Model
```python
# Create model
sagemaker.create_model(
    ModelName='my-model',
    PrimaryContainer={
        'Image': '763104351884.dkr.ecr.us-west-2.amazonaws.com/pytorch-inference:2.1.0-cpu',
        'ModelDataUrl': 's3://my-bucket/output/model.tar.gz'
    },
    ExecutionRoleArn='arn:aws:iam::123456789012:role/SageMakerRole'
)

# Create endpoint config
sagemaker.create_endpoint_config(
    EndpointConfigName='my-endpoint-config',
    ProductionVariants=[{
        'VariantName': 'AllTraffic',
        'ModelName': 'my-model',
        'InitialInstanceCount': 1,
        'InstanceType': 'ml.t2.medium'
    }]
)

# Create endpoint
sagemaker.create_endpoint(
    EndpointName='my-endpoint',
    EndpointConfigName='my-endpoint-config'
)
```

### RDS (Relational Database Service)

### Create Database
```python
rds = boto3.client('rds')

# Create DB instance
rds.create_db_instance(
    DBInstanceIdentifier='my-database',
    DBInstanceClass='db.t3.micro',
    Engine='postgres',
    MasterUsername='admin',
    MasterUserPassword='password123',
    AllocatedStorage=20,
    VpcSecurityGroupIds=['sg-1234567890abcdef0'],
    DBSubnetGroupName='my-db-subnet-group'
)
```

### ECS (Elastic Container Service)

### Task Definition
```python
ecs = boto3.client('ecs')

# Register task definition
ecs.register_task_definition(
    family='my-task',
    containerDefinitions=[
        {
            'name': 'my-app',
            'image': 'my-app:latest',
            'memory': 512,
            'cpu': 256,
            'essential': True,
            'portMappings': [
                {'containerPort': 8000, 'protocol': 'tcp'}
            ],
            'logConfiguration': {
                'logDriver': 'awslogs',
                'options': {
                    'awslogs-group': '/ecs/my-task',
                    'awslogs-region': 'us-west-2',
                    'awslogs-stream-prefix': 'ecs'
                }
            }
        }
    ]
)
```

### Run Task
```python
ecs.run_task(
    cluster='my-cluster',
    taskDefinition='my-task',
    launchType='FARGATE',
    networkConfiguration={
        'awsvpcConfiguration': {
            'subnets': ['subnet-12345678'],
            'securityGroups': ['sg-1234567890abcdef0'],
            'assignPublicIp': 'ENABLED'
        }
    }
)
```

## Infrastructure as Code

### CloudFormation Template
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sample CloudFormation template'

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - prod

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${Environment}-my-bucket'

  MyFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${Environment}-my-function'
      Runtime: python3.11
      Handler: index.handler
      Code:
        ZipFile: |
          def handler(event, context):
            return {'statusCode': 200}
      Role: !GetAtt MyFunctionRole.Arn

  MyFunctionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
```

### Terraform Configuration
```hcl
# S3 Bucket
resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-unique-bucket-name"

  tags = {
    Environment = "dev"
  }
}

# Lambda Function
resource "aws_lambda_function" "my_function" {
  function_name = "my-function"
  runtime       = "python3.11"
  handler       = "index.handler"
  role          = aws_iam_role.lambda_role.arn

  filename      = "lambda_function.zip"

  source_code_hash = filebase64sha256("lambda_function.zip")
}

# IAM Role
resource "aws_iam_role" "lambda_role" {
  name = "lambda-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

# Attach policy
resource "aws_iam_role_policy_attachment" "lambda_basic" {
  role       = aws_iam_role.lambda_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}
```

## Monitoring & Logging

### CloudWatch Logs
```python
logs = boto3.client('logs')

# Create log group
logs.create_log_group(logGroupName='/aws/lambda/my-function')

# Put log event
logs.put_log_events(
    logGroupName='/aws/lambda/my-function',
    logStreamName='stream-name',
    logEvents=[
        {'timestamp': int(time.time() * 1000), 'message': 'Log message'}
    ]
)
```

### CloudWatch Metrics
```python
cloudwatch = boto3.client('cloudwatch')

# Put metric data
cloudwatch.put_metric_data(
    Namespace='MyApp',
    MetricData=[
        {
            'MetricName': 'RequestCount',
            'Value': 1,
            'Unit': 'Count',
            'Dimensions': [
                {'Name': 'Environment', 'Value': 'dev'}
            ]
        }
    ]
)
```

## Security Best Practices

### 1. IAM Security
- Follow principle of least privilege
- Use IAM roles instead of access keys
- Rotate credentials regularly
- Enable MFA for root account

### 2. Network Security
- Use security groups and NACLs
- Enable VPC Flow Logs
- Use private subnets for databases
- Implement bastion hosts

### 3. Data Security
- Enable S3 bucket encryption
- Use KMS for encryption
- Enable S3 bucket policies
- Enable CloudTrail for audit

### 4. Cost Optimization
- Use reserved instances for steady workloads
- Use spot instances for fault-tolerant workloads
- Enable S3 lifecycle policies
- Monitor costs with Cost Explorer

## Common Patterns

### Serverless API
- API Gateway → Lambda → DynamoDB

### ML Pipeline
- SageMaker for training
- S3 for model storage
- Lambda for inference
- API Gateway for endpoints

### Web Application
- EC2/ECS for compute
- RDS for database
- S3 + CloudFront for static assets
- Route 53 for DNS

## Integration

- **Docker**: Containerize applications
- **Kubernetes**: EKS for orchestration
- **CI/CD**: CodePipeline, CodeBuild
- **Monitoring**: CloudWatch, X-Ray