AWS Cloud Practitioner: IAM, S3, EC2, DynamoDB, Lambda hands-on

The steps

1. Step 1
   Beginner

   AWS IAM: users, groups and policies

   Baobab Market sells the work of forty Senegalese craftspeople online. The company has just moved to AWS, and the whole team signs in with the same account, the founder's, whose password circulates in the WhatsApp group. That account can do anything, including shutting the company down on AWS with one click. She asks you to put things in order: one identity per person, each with only what they need. This lab opens the preparation path for the AWS Certified Cloud Practitioner certification. It covers cloud concepts and above all security, the heaviest domain of the exam. You start with the map of AWS: Regions, Availability Zones, and why IAM is a global service. Then you find out who you are in the account, and what AWS protects versus what remains yours in the shared responsibility model. You learn to read an IAM policy and predict AWS's decision: explicit deny, allow, implicit deny. You organize the team into groups by job, create users capped by a permissions boundary, and trigger denials on purpose to learn to read an AccessDenied message. You then write your own policy, following the principle of least privilege, and prove in the policy simulator that everyone has what they need and nothing more. Everything happens in the real AWS console, opened in your browser, with no credit card and no account to create. The guide is illustrated with screenshots of the console, and the lab ends with a ten-question practice exam in the style of the certification.

   • No reviews yet
   • Beginner
   • 2 h 30 min
   • 1,000 credits
   • First lab free
2. Step 2
   Beginner

   Amazon S3: versioning, archiving and static website hosting

   At Baobab Market, the suppliers' invoices sit in a mailbox and on a USB stick. The accountant deleted one by mistake last month, and the tax authorities can ask for any of them for ten years. The showcase website costs 15,000 CFA francs a month with a provider, for three pages that never change. Both find their answer in Amazon S3, AWS's object storage. This second lab of the preparation path for the AWS Certified Cloud Practitioner certification first has you tell apart object storage, disk and file share, then create a private, encrypted, versioned bucket for the invoices. You trigger a deletion, watch S3 place a marker instead of erasing, and get the invoice back. You then choose storage classes, from Standard to Glacier Deep Archive, and write the lifecycle rule that archives the invoices on its own. You share an invoice with the statutory auditor through a presigned URL, valid for ten minutes, without opening anything. Then you publish Baobab Market's website straight from S3: static website hosting, an error page, and the two steps that make a bucket public, lifting Block Public Access and writing a bucket policy. Along the way you understand why a website returns 403 Forbidden, and why a poorly watched public bucket is the leading cause of data leaks on AWS. Everything happens in the real AWS console, opened in your browser. The guide is illustrated with screenshots of the console, names every button, explains what the exam expects from each chapter, and ends with a ten-question practice exam.

   • No reviews yet
   • Beginner
   • 2 h 30 min
   • 1,000 credits
   • First lab free
3. Step 3
   Beginner

   Amazon EC2: launch an instance, networking and pricing models

   Baobab Market's showcase website runs on S3, but the real shop needs a server: a machine that runs a program on every visit. Two years ago, it would have cost 2 million CFA francs and six weeks of waiting. Today, Awa asks you to launch it this morning, make it reachable, be able to log into it without leaving a password lying around, and know what it costs. This third lab of the preparation path for the AWS Certified Cloud Practitioner certification starts with what the exam asks about EC2 most often: reading an instance type, choosing a family, and what remains your responsibility in the shared responsibility model. Then you read the instance's network architecture on a diagram: Region, VPC, Availability Zones, public and private subnets, Internet gateway, security group and network ACL. You then launch the instance, after a first denial triggered on purpose, with an IAM role and a startup script that installs a web server. The website does not respond: you open exactly the port needed in the security group, and the shop appears. You open a shell on the instance through Session Manager, with no SSH key and no administration port, find its EBS disk there, then stop and restart it to watch its public address change. The lab ends on pricing models: On-Demand, Savings Plans, Reserved Instances, Spot and Dedicated Hosts. Everything happens in the real AWS console, on a real instance. The guide is illustrated with screenshots of the console and an architecture diagram, explains what the exam expects from each chapter, and ends with a ten-question practice exam.

   • No reviews yet
   • Beginner
   • 2 h 30 min
   • 1,500 credits
4. Step 4
   General

   AWS ELB and Auto Scaling: high availability and elasticity

   The Tabaski sales are coming, and Baobab Market's shop runs on a single server: a single point of failure. Awa asks you to make sure the shop stays open if a server goes down, adds servers when the crowd arrives, and removes them when the crowd leaves. This fourth lab of the preparation path for the AWS Certified Cloud Practitioner certification starts with the words the exam uses most to talk about the benefits of the cloud: high availability, fault tolerance, horizontal and vertical scaling, elasticity. An architecture diagram shows what you are going to build: a load balancer present in two Availability Zones, in front of an Auto Scaling group driven by CloudWatch. You read the provided launch template, then create a target group and its health check, an Application Load Balancer and its listener, and an Auto Scaling group with a target tracking policy, after a first denial triggered on purpose. The shop responds at a single address, served in turn by two instances. You kill one: customers see nothing, and Auto Scaling replaces it on its own. You then go up to three instances, and watch the policy scale back to two, triggered by a CloudWatch alarm it created itself. Everything happens in the real AWS console, with no Elastic IP address. The guide is illustrated with screenshots of the console and an architecture diagram, compares ALB, NLB and Gateway Load Balancer, explains the ways to scale and what a load balancer and public IPv4 addresses cost, and ends with a ten-question practice exam.

   • No reviews yet
   • Intermediate
   • 3 h
   • 2,000 credits
5. Step 5
   General

   Amazon DynamoDB: keys, queries, capacity and backups

   Since Baobab Market's shop has been running on several instances, carts disappear when a customer switches instance. Moussa would like to install a database on a server; Awa wants a serverless database that handles the sales and costs almost nothing while the shop sleeps. This fifth lab of the preparation path for the AWS Certified Cloud Practitioner certification starts with what the exam asks most often about databases: choosing between relational and NoSQL, between RDS, Aurora, DynamoDB, ElastiCache, Redshift, DocumentDB and Neptune, and knowing what remains your responsibility depending on the service. Then you design a DynamoDB table from its questions, on a diagram: partition key, sort key, partitions copied across three zones. You create the table after a first denial triggered on purpose, write orders with different attributes into it, then compare a query and a scan: the console shows the items read, returned, and the read units consumed. You query and update the table in PartiQL, choose between on-demand and provisioned capacity, then protect the data: automatic expiry of carts, restore to the second, a backup before the sales, encryption always on. Everything happens in the real AWS console. The guide is illustrated with screenshots of the console and a diagram, explains global tables and DAX, and ends with a ten-question practice exam.

   • No reviews yet
   • Intermediate
   • 2 h 30 min
   • 2,000 credits
6. Step 6
   General

   Amazon SNS and SQS: notifications and message queues

   When an order is paid, Baobab Market's shop notifies preparation, sends the customer a confirmation, then calls accounting, one after the other. The day accounting crashed for ten minutes, not a single payment went through. Awa asks you to decouple all of this: the shop announces only once that an order is paid, and each team receives it at its own pace. This sixth lab of the preparation path for the AWS Certified Cloud Practitioner certification starts with what the exam asks about decoupling: synchronous or asynchronous, SNS that pushes or SQS that keeps, EventBridge, and the fan-out pattern to several queues, on an architecture diagram. You create an SNS topic, after a first denial triggered on purpose, then subscribe your email address to it, and not someone else's, as a second denial shows. You create two SQS queues, connect them to the topic, and publish an order only once: it lands in your inbox and in both queues. You read the received message and its SNS envelope, discover the visibility timeout, filter what accounting receives, and set aside failing messages in a dead-letter queue. Everything happens in the real AWS console. The guide is illustrated with screenshots of the console and a diagram, explains standard and FIFO queues, and ends with a ten-question practice exam.

   • No reviews yet
   • Intermediate
   • 2 h 10 min
   • 2,000 credits
7. Step 7
   General

   AWS Lambda: process events without servers

   Baobab Market's paid orders arrive in an SQS queue, but nobody processes them automatically. Rent a server that runs day and night for a few minutes of work a day? Awa does not want that. She asks you to write the program, and only that: for each order, it runs, records it in DynamoDB with the status "being prepared", then stops. This seventh lab of the preparation path for the AWS Certified Cloud Practitioner certification starts with what the exam asks about serverless computing: EC2, containers or Lambda, the 15-minute limit, billing per request and per millisecond, and the shared responsibility, on an architecture diagram. You create a Lambda function, after a denial triggered on purpose, with the provided execution role. You write and test its code in the console, read its logs in CloudWatch, then make it write to a DynamoDB table: a second denial makes you add the only permission it lacks, with least privilege. You connect the SQS queue to the function, after a third denial, and your orders get prepared on their own. You see what becomes of a message that makes the function fail, set the memory and the timeout, and work out what the function costs. Everything happens in the real AWS console. The code is provided and explained line by line: no programming knowledge is needed. The guide is illustrated with screenshots of the console and a diagram, and ends with a ten-question practice exam.

   • No reviews yet
   • Intermediate
   • 2 h 30 min
   • 2,500 credits
8. Step 8
   General

   Amazon SES: send transactional emails

   In lab 6, the customer received an email from Amazon SNS: sender "AWS Notifications", raw JSON, and a subscription to confirm before receiving anything. Awa wants a real order confirmation, sent from Baobab Market's address, automatically, as soon as an order is paid. This eighth lab of the preparation path for the AWS Certified Cloud Practitioner certification starts with what the exam asks about sending email: SNS or SES, transactional and marketing emails, and AWS's other business applications, on an architecture diagram. You verify your address as an SES identity, after a denial triggered on purpose for someone else's address. You discover sandbox mode, trigger a second denial by writing to someone else, then send yourself a first email. You then write a Lambda function that sends the confirmation through SES, give it the only permission it lacks, and connect it to the SNS topic of paid orders: a published order becomes an email in your inbox within seconds. You finish with deliverability (bounces, complaints, SPF, DKIM, DMARC) and pricing. Everything happens in the real AWS console. The code is provided and explained. The guide is illustrated with screenshots of the console and a diagram, and ends with a ten-question practice exam.

   • No reviews yet
   • Intermediate
   • 2 h 15 min
   • 2,500 credits
9. Step 9
   Advanced

   AWS challenge: deploy a complete serverless application

   Baobab Market opens a shop in Abidjan tomorrow morning, and Moussa is on leave. Awa hands you the platform: this time, no step-by-step instructions. Each mission comes with a specification and success criteria to check in the console, a hint if you are stuck, and the solution as a last resort. This challenge closes the preparation path for the AWS Certified Cloud Practitioner certification. On your own, you set up a least-privilege IAM team, proven with the policy simulator, a private, versioned S3 invoices bucket archived by lifecycle, the DynamoDB orders table, an SNS topic and the SQS preparation queue, then a Lambda function that records each order automatically. A trap awaits you between SNS and SQS: the message envelope. As a bonus, the confirmation sent to the customer by Amazon SES. An acceptance test checks that everything works end to end, and a grid tells you which labs to review. The challenge ends with a full 30-question practice exam, weighted like the four domains of the CLF-C02 exam, which also covers the services the exam mentions that you did not use in the labs, then with everything you need to know for exam day.

   • No reviews yet
   • Advanced
   • 3 h
   • 3,000 credits

AWS, AWS Certified and the associated badge are trademarks of Amazon.com, Inc. or its affiliates. MonPremierLab is not affiliated with AWS.