What cloud computing actually is

Cloud computing is the on-demand delivery of IT resources (compute, storage, databases, networking) over the internet with pay-as-you-go pricing. AWS defines three deployment models: cloud-based (everything in the cloud), on-premises (traditional data centre, sometimes called 'private cloud'), and hybrid (a mix, often used during migration).

The six benefits of cloud computing

AWS exams love this list word for word:

• Trade capital expense (CapEx) for variable expense (OpEx) - stop buying data centres upfront, pay only for what you use
• Benefit from massive economies of scale - AWS aggregates usage across huge numbers of customers, so unit costs fall
• Stop guessing capacity - scale up or down as demand changes instead of over- or under-provisioning
• Increase speed and agility - new IT resources are a click away, cutting time-to-market
• Stop spending money running and maintaining data centres - focus on projects that differentiate the business, not racking servers
• Go global in minutes - deploy applications in multiple AWS Regions worldwide with a few clicks

The six advantages sometimes tested as 'value proposition'

These overlap with the benefits above but the exam sometimes frames value as: agility, elasticity, cost savings, reliability, global reach, and security - all without the heavy lifting of physical infrastructure.

Elasticity vs scalability - a common mix-up

• Scalability means a system can grow to handle increased load, usually by adding resources
• Elasticity means resources automatically grow AND shrink to match demand in near real time - this is the specific AWS differentiator, not just scalability alone

CapEx vs OpEx

CapEx is large upfront spending on physical infrastructure that depreciates over years. OpEx is ongoing, predictable, pay-as-you-go spending. Cloud shifts businesses from CapEx to OpEx - a favourite exam phrase, learn it exactly.

Common exam traps

• 'Cloud is always cheaper' is false - the real promise is variable cost matched to actual usage, not a guaranteed discount
• Economies of scale come from AWS's aggregate purchasing power across millions of customers, not from any single customer's usage
• 'Going global in minutes' refers to Regions and infrastructure deployment speed, not literal data transfer speed
• Do not confuse high availability (uptime, fault tolerance) with elasticity (dynamic resource scaling) - they are different exam concepts entirely

AWS Global Infrastructure

AWS's physical footprint is built from Regions, Availability Zones (AZs) and Edge Locations. A Region is a separate geographic area (e.g. eu-west-2 London) containing multiple, isolated AZs. Each AZ is one or more discrete data centres with independent power, cooling and networking, but connected to other AZs in the same Region by low-latency, high-throughput private fibre. As at 2026 AWS has 30+ launched Regions and 100+ AZs worldwide, each Region has a minimum of 3 AZs, and there are 600+ Edge Locations for content delivery.

Choosing a Region

When picking a Region, weigh up four factors: compliance (data residency/legal requirements), proximity (latency to users), feature availability (not every service launches everywhere at once), and pricing (costs vary by Region). This is a classic exam scenario question.

Availability Zones and resilience

• Deploying across multiple AZs protects against a single data-centre failure — this is the basis of high availability.
• AZs within a Region are far enough apart to be independent for disaster purposes, but close enough for single-digit millisecond latency.
• A common mistake is thinking one AZ equals one server room — it can be several buildings.

Edge locations and content delivery

Edge Locations are smaller sites used by Amazon CloudFront (CDN) and AWS Global Accelerator to cache content and route traffic closer to end users, reducing latency. Regional Edge Caches sit between Edge Locations and origin Regions for less-popular content. Edge Locations are far more numerous than Regions/AZs.

Core services to know

• Compute: EC2 (virtual servers), Lambda (serverless functions), ECS/EKS (containers).
• Storage: S3 (object storage, 11 nines durability), EBS (block storage for EC2), EFS (managed file storage), Glacier (archival).
• Database: RDS (managed relational), DynamoDB (managed NoSQL, single-digit ms latency).
• Networking: VPC (isolated virtual network), Route 53 (DNS), CloudFront (CDN).

Common mistakes to avoid

• Confusing a Region (geographic area) with an AZ (data centre cluster within it) — a Region contains AZs, not the other way round.
• Assuming every service is global — most are Regional, some (IAM, Route 53, S3 billing/naming) are global.
• Forgetting that Local Zones and Wavelength Zones are extensions of a Region for ultra-low-latency use cases, distinct from standard AZs.
• Thinking more AZs always means better — 3 is the practical minimum AWS guarantees for HA design.

The shared responsibility model

This is the single most tested idea on CLF-C02. AWS is responsible for security OF the cloud - the physical facilities, hardware, network infrastructure, and the virtualisation layer. You (the customer) are responsible for security IN the cloud - your data, IAM configuration, operating system patches (on EC2), firewall rules (security groups), and encryption choices.

The split shifts depending on the service type. With EC2 (infrastructure as a service) you manage the guest OS, patching and network configuration. With managed services like RDS, AWS handles OS patching and infrastructure, but you still manage access control and data. With serverless or fully managed services like S3 or Lambda, AWS takes on even more, but you are always responsible for data classification, IAM permissions and client-side encryption if used.

IAM basics

• IAM (Identity and Access Management) is a global service, free to use, and controls who can do what in your AWS account.
• The root user is created automatically and has full access - AWS best practice is to lock it away, enable MFA, and never use it for daily tasks.
• Use IAM users, groups and roles for everyday access instead of root.
• IAM roles provide temporary credentials and are the recommended way to grant permissions to AWS services (like an EC2 instance) or federated users - never hard-code long-term access keys into an application.
• Policies are JSON documents attached to users, groups or roles that define permissions (Allow/Deny on specific actions and resources).
• By default, all IAM permissions are implicitly denied until explicitly allowed - and an explicit Deny always overrides an explicit Allow.
• Follow the principle of least privilege - grant only the permissions needed to do the job, nothing more.

MFA and credentials

• Multi-Factor Authentication (MFA) adds a second layer of login security (a code from a virtual/hardware device) and should be enabled on the root user and privileged IAM users.
• Access keys (access key ID + secret access key) are used for programmatic access via CLI/SDK and should be rotated regularly.

Common exam traps

• AWS is never responsible for customer data security in the cloud, even on fully managed services.
• IAM roles are preferred over embedding access keys in code or on EC2 instances.
• IAM is not used to manage OS-level user accounts - that is a customer responsibility.
• Compliance in the cloud (e.g. meeting PCI DSS) is a shared effort - AWS gives you a compliant infrastructure, but you must configure your environment correctly.
• AWS Organizations and Service Control Policies (SCPs) set permission guardrails across multiple accounts, but do not grant permissions themselves.

AWS Pricing Models

AWS has three core pricing models you must know.

• Pay-as-you-go: no upfront cost, pay only for what you use, stop anytime.
• Save when you commit (Reserved Instances / Savings Plans): commit to 1 or 3 years for a big discount, up to around 72 percent versus On-Demand.
• Pay less by using more: volume discounts, for example S3 storage tiers get cheaper per GB as usage grows.

Also know Spot Instances, which use spare EC2 capacity at up to 90 percent off On-Demand, but AWS can reclaim them with a two-minute warning. Great for fault-tolerant, flexible workloads like batch jobs, never for critical always-on apps.

Free Tier

Three free tier types exist: Always Free (some services forever, e.g. Lambda 1 million requests a month), 12 Months Free (starts from account creation, e.g. 750 hours of EC2 t2.micro or t3.micro), and Trials (short-term, from service activation, e.g. Amazon Inspector).

Billing Tools

• AWS Pricing Calculator: estimate costs before you deploy, no AWS account needed.
• AWS Cost Explorer: visualise, understand, and forecast historical and future spend, with custom reports.
• AWS Budgets: set custom cost, usage, or reservation thresholds and get alerts when exceeded or forecast to be exceeded.
• AWS Cost and Usage Report (CUR): the most comprehensive, granular breakdown of costs and usage, deliverable to an S3 bucket.
• AWS Billing Console: consolidated billing lets an AWS Organization combine usage across accounts into one bill, unlocking volume discounts and a single payment method.

Support Plans (know all four)

• Basic: free for all customers, includes Trusted Advisor core checks and Personal Health Dashboard, but only customer service and community support, no technical support.
• Developer: paid, business hours email access to Cloud Support Associates, general guidance, one primary contact.
• Business: paid, 24/7 phone, email and chat, faster response times (under 1 hour for production system down), full Trusted Advisor checks, unlimited contacts.
• Enterprise: paid, includes everything in Business plus a dedicated Technical Account Manager (TAM), under 15 minute response for business-critical system down, Concierge support team.

Common Mistakes

• Confusing Reserved Instances (capacity commitment) with Savings Plans (spend commitment, more flexible across instance families).
• Forgetting Spot Instances can be terminated with only two minutes notice.
• Thinking Basic support includes technical support, it does not.
• Mixing up response time SLAs between Business and Enterprise plans.
• Forgetting consolidated billing needs AWS Organizations to combine accounts for volume discounts.

Compute basics

Amazon EC2 gives you resizable virtual servers (instances) in the cloud, billed by the second for most Linux instances (minimum 60 seconds). You choose an instance type (family + size, eg t3.micro) which sets vCPU, RAM and network performance.

Pricing models matter for the exam:

• On-Demand: pay per second/hour, no commitment, most expensive per unit, best for short-term or unpredictable workloads.
• Reserved Instances: 1 or 3 year commitment, up to 72% cheaper than On-Demand, best for steady, predictable workloads.
• Savings Plans: commit to a $/hour spend for 1 or 3 years, more flexible than Reserved (works across instance families).
• Spot Instances: bid on spare capacity, up to 90% cheaper, but AWS can reclaim with a 2-minute warning. Good for fault-tolerant, flexible workloads like batch jobs, never for critical always-on apps.
• Dedicated Hosts: physical server dedicated to you, for licensing or compliance needs.

Auto Scaling adjusts EC2 capacity automatically to match demand; Elastic Load Balancing (ELB) distributes traffic across multiple instances/AZs for high availability.

Storage basics

Three main categories, and the exam loves testing which one fits which use case:

• Amazon S3 (object storage): stores objects (files) in buckets, virtually unlimited capacity, 11 nines (99.999999999%) durability. Storage classes trade cost for retrieval speed: S3 Standard (frequent access), S3 Standard-IA and One Zone-IA (infrequent access, cheaper), S3 Glacier Instant/Flexible/Deep Archive (archival, cheapest, slower retrieval - Deep Archive can take up to 12 hours).
• Amazon EBS (block storage): persistent virtual hard drives attached to a single EC2 instance, used for OS/databases needing low-latency access. Data persists independently of the instance lifecycle.
• Amazon EFS (file storage): fully managed NFS file system that can be mounted by many EC2 instances at once (shared access), scales automatically.
• Instance store: temporary block storage physically attached to the host - fastest but data is LOST if the instance stops or terminates. A classic exam trap.

Networking basics

Amazon VPC (Virtual Private Cloud) is your own logically isolated network within AWS, split into subnets across Availability Zones. Public subnets route to the internet via an Internet Gateway; private subnets don't (they can reach out via a NAT Gateway but can't be reached from outside directly).

• Security Groups: stateful, act at the instance level, allow rules only (no explicit deny needed - return traffic is automatically allowed).
• Network ACLs (NACLs): stateless, act at the subnet level, support both allow and deny rules, evaluated in rule-number order.
• Amazon Route 53: AWS's DNS service, also does domain registration and health checks.
• AWS Direct Connect: a dedicated private network connection from your premises to AWS, bypassing the public internet for consistent performance.

Common mistakes

• Confusing Security Groups (stateful, instance-level) with NACLs (stateless, subnet-level).
• Forgetting instance store is ephemeral - never use it for anything you can't lose.
• Picking Spot Instances for critical production workloads - wrong, they can be interrupted.
• Thinking S3 Glacier Deep Archive is for real-time access - it's the slowest and cheapest, for long-term compliance archives.

Relational databases: RDS and Aurora

Amazon RDS is a managed relational database service supporting MySQL, PostgreSQL, MariaDB, Oracle, SQL Server and Db2.

AWS handles patching, backups, and failover - you do not manage the OS.

Multi-AZ gives a synchronous standby replica in another Availability Zone for high availability and automatic failover - it is not for scaling reads.

Read Replicas (up to 15 for Aurora, fewer for other engines) scale read traffic and can be promoted to standalone databases.

Amazon Aurora is AWS's own MySQL/PostgreSQL-compatible engine, claimed up to 5x MySQL throughput, with storage that auto-scales up to 128TB.

NoSQL and other database types

DynamoDB is a fully managed, serverless key-value and document NoSQL database with single-digit millisecond latency at any scale.

DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB giving microsecond read latency.

ElastiCache provides managed in-memory caching (Redis or Memcached) to speed up applications.

Other purpose-built databases: DocumentDB (MongoDB-compatible), Neptune (graph), Timestream (time series), Keyspaces (Cassandra-compatible), QLDB (ledger/immutable).

Analytics services

Amazon Redshift is a managed data warehouse for large-scale SQL analytics using columnar storage.

Amazon Athena runs serverless SQL queries directly against data in S3 - no infrastructure to manage, pay per query scanned.

Amazon EMR runs big data frameworks like Hadoop and Spark on managed clusters.

Amazon Kinesis ingests and processes streaming data in real time (video, data streams, firehose, analytics).

AWS Glue is a serverless ETL (extract, transform, load) service that also catalogues data for Athena and Redshift.

QuickSight is AWS's serverless business intelligence tool for building dashboards and visualisations.

The AWS Well-Architected Framework

Six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability (added 2021).

Each pillar has design principles and trade-offs; the framework is applied via the free AWS Well-Architected Tool, which reviews workloads against best practices and produces improvement plans.

Common exam trap: know which pillar a scenario belongs to - e.g. removing unused resources is Cost Optimization, automating recovery is Reliability, least privilege is Security.

The framework is not a checklist you 'pass' - it is a continuous improvement process.

Common mistakes to avoid

Do not confuse Multi-AZ (availability/failover) with Read Replicas (read scaling) - they solve different problems and can be combined.

Do not assume RDS is serverless by default - Aurora Serverless and DynamoDB are the serverless database options.

Remember Athena queries S3 data directly with no cluster to provision, unlike Redshift which needs a provisioned cluster (or Redshift Serverless).

Sustainability was formally added as the sixth Well-Architected pillar - older material may only list five.