Choose with understanding.

Compute & containers

Amazon EC2

Virtual servers with a choice of operating system, instance type, networking and storage.

When to choose it

You need control over the host environment or must run software with specific system requirements.

Example in practice

Run a Linux web application on instances behind a load balancer.

Tradeoff or alternative

You manage operating-system maintenance and capacity. Compare Lambda for functions or Fargate for containers without host management.

Compute & containers

AWS Lambda

Runs application functions in response to events and requests without managing servers.

When to choose it

Processing starts with an event and fits a function-based execution model.

Example in practice

Validate an uploaded document or process a message from an order queue.

Tradeoff or alternative

Design for retries, concurrency and execution limits. Compare ECS or EC2 when you need a persistent process or host control.

Compute & containers

Amazon ECS

Orchestrates containerized applications using task definitions and services.

When to choose it

You want to deploy, replace and scale containers through an AWS-managed orchestration service.

Example in practice

Run separate registration API and background-worker containers for a campus application.

Tradeoff or alternative

Choose compute capacity separately: Fargate removes host management, while EC2 provides more host-level control.

Compute & containers

AWS Fargate

Provides serverless compute capacity for supported container workloads.

When to choose it

You want containers to run without provisioning and maintaining EC2 container hosts.

Example in practice

Run an ECS service for a small API with defined task CPU and memory.

Tradeoff or alternative

You still configure images, networking and IAM. Compare EC2 capacity for host customization or a different cost profile.

Compute & containers

Amazon ECR

Stores and distributes container images and supported OCI artifacts.

When to choose it

Your application needs an AWS-integrated registry with controlled access to deployment images.

Example in practice

Publish a tested API image before deploying it to an ECS service.

Tradeoff or alternative

A registry does not run your application. Configure image retention and scanning, and select a separate compute service.

Compute & containers

Amazon EC2 Auto Scaling

Maintains and adjusts an EC2 instance fleet within configured capacity limits.

When to choose it

An instance-based application needs replacement of unhealthy instances and capacity changes as demand varies.

Example in practice

Add web instances during a registration rush and reduce capacity afterward.

Tradeoff or alternative

Scaling needs suitable policies and startup behavior. A load balancer handles request distribution; Auto Scaling handles the fleet.

Storage & recovery

Amazon S3

Object storage for uploads, application assets, backups and data lakes.

When to choose it

Applications can read and write complete objects through storage APIs.

Example in practice

Keep versioned student submissions or raw sales exports for later analysis.

Tradeoff or alternative

Choose storage classes around access and retrieval needs. Use EBS for block storage or EFS for a shared file system.

Storage & recovery

Amazon EBS

Block-storage volumes that provide disks for EC2 workloads.

When to choose it

A server needs a filesystem or application disk with configurable capacity and performance.

Example in practice

Keep an EC2 application data directory on an encrypted volume and take recovery snapshots.

Tradeoff or alternative

Volumes are tied to an Availability Zone. Compare EFS for a shared file interface and S3 for independent objects.

Storage & recovery

Amazon EFS

Managed, elastic NFS file storage for supported compute clients.

When to choose it

Multiple Linux application instances need access to the same files.

Example in practice

Share uploaded media between web workers without maintaining a file server.

Tradeoff or alternative

Select Regional or One Zone storage deliberately. Compare S3 when the application can use object APIs instead of a filesystem.

Storage & recovery

AWS Backup

Centralizes backup schedules, retention policies and monitoring for supported resources.

When to choose it

Several AWS workloads need consistent backup policies and restore procedures.

Example in practice

Apply scheduled backup plans to application volumes and supported databases.

Tradeoff or alternative

Capabilities vary by resource type. A successful backup is only part of recovery; test restores and application dependencies.

Databases

Amazon RDS

Managed relational databases with familiar engines and SQL interfaces.

When to choose it

Your application depends on relational data, joins and transactional updates.

Example in practice

Store student registrations and course records in a private PostgreSQL database.

Tradeoff or alternative

You still design indexes, queries, access and deployment options. Compare DynamoDB for access-pattern-driven NoSQL workloads.

Databases

Amazon Aurora

MySQL- and PostgreSQL-compatible relational database engines within Amazon RDS.

When to choose it

You want compatible SQL engines with Aurora storage and cluster capabilities.

Example in practice

Use a writer and reader instances for a growing application with separate reporting reads.

Tradeoff or alternative

Check engine compatibility, availability and pricing for your deployment. Compare other RDS engines when their features better fit the workload.

Databases

Amazon DynamoDB

Serverless NoSQL storage for applications with key-value and document access patterns.

When to choose it

You can design keys and indexes around known application reads and writes.

Example in practice

Find event registrations by student or event without scanning every record.

Tradeoff or alternative

Key design matters. Compare RDS when ad hoc relational joins are central; DynamoDB also supports transactions for suitable operations.

Databases

Amazon ElastiCache

Managed in-memory data stores using supported Valkey, Redis OSS or Memcached engines.

When to choose it

Repeated reads or session access need an in-memory serving layer.

Example in practice

Cache a frequently requested course catalog to reduce database load.

Tradeoff or alternative

Plan expiry, invalidation and failure behavior. Engine and deployment options differ; define persistence requirements before choosing a cache design.

Networking & delivery

Amazon VPC

Defines virtual networking, subnets, routing and connectivity for AWS resources.

When to choose it

You need to separate application tiers and control how resources reach each other.

Example in practice

Place web servers across two Availability Zones and keep a database in private subnets.

Tradeoff or alternative

A subnet is not public merely because of its name. Routes, gateways and security controls determine connectivity.

Networking & delivery

Application Load Balancer

Routes HTTP and HTTPS requests to application targets using listener rules.

When to choose it

A web application needs health-checked targets and host- or path-based routing.

Example in practice

Send /api requests to one target group and page requests to another.

Tradeoff or alternative

Compare Network Load Balancer for network-layer traffic or API Gateway for API-specific management. Fleet scaling is configured separately.

Networking & delivery

Amazon Route 53

Provides DNS routing, domain registration and health-check capabilities.

When to choose it

Users need a domain name that resolves to the right application endpoint.

Example in practice

Point a course website hostname to its CloudFront distribution.

Tradeoff or alternative

DNS does not host the website or cache its content. Choose routing and health-check behavior to suit the endpoint design.

Networking & delivery

Amazon CloudFront

Delivers web content through edge locations in front of configured origins.

When to choose it

A website or application benefits from edge caching and controlled delivery of content.

Example in practice

Serve course images and downloadable materials from an S3 origin.

Tradeoff or alternative

Cache keys and expiry affect freshness and origin load. CloudFront complements an origin; it does not replace its storage or application.

Networking & delivery

Amazon API Gateway

Creates and manages REST, HTTP and WebSocket APIs for application backends.

When to choose it

Clients need a managed API entry point connected to functions or other backends.

Example in practice

Expose a registration endpoint that invokes Lambda and stores a DynamoDB item.

Tradeoff or alternative

HTTP and REST APIs have different capabilities. Compare the API types before assuming support for features such as usage plans.

Security & identity

AWS Identity and Access Management

Controls access to AWS resources through identities, roles and policies.

When to choose it

A person or workload needs only the AWS actions and resources required for its task.

Example in practice

Let a deployment workflow write to one S3 prefix using a temporary role session.

Tradeoff or alternative

Policy evaluation spans multiple controls. Use IAM Identity Center for workforce access and avoid embedding long-lived credentials in applications.

Security & identity

AWS IAM Identity Center

Centralizes workforce access to AWS accounts and supported applications.

When to choose it

A team needs centrally assigned access through a workforce identity source.

Example in practice

Give students a limited learning-account permission set and instructors a separate administration assignment.

Tradeoff or alternative

Workforce access differs from customer sign-in. Compare Cognito for application users; IAM still defines AWS resource permissions.

Security & identity

AWS Key Management Service

Creates and controls cryptographic keys used by AWS services and applications.

When to choose it

Encrypted data needs explicit key policies, access controls and key lifecycle management.

Example in practice

Control which application roles can use a key protecting stored documents.

Tradeoff or alternative

Key access is separate from access to the data itself. Use Secrets Manager to store credentials rather than treating KMS as a secret vault.

Security & identity

AWS Secrets Manager

Stores and retrieves secrets and supports configured secret rotation.

When to choose it

Applications need controlled access to credentials or other sensitive configuration.

Example in practice

Retrieve a database credential at runtime instead of committing it to source code.

Tradeoff or alternative

Rotation must fit the target system and application. Compare Systems Manager Parameter Store for configuration with different lifecycle needs.

Security & identity

AWS WAF

Filters web requests to supported resources using web access control rules.

When to choose it

An application needs request inspection, managed rule groups or rate-based filtering.

Example in practice

Apply rules to a public course website to filter suspicious HTTP requests.

Tradeoff or alternative

Tune rules to avoid blocking legitimate users. A web firewall complements secure application code and does not replace it.

Security & identity

Amazon Cognito

Provides application user authentication and identity federation capabilities.

When to choose it

An application needs user registration, sign-in and token-based integration with its backend.

Example in practice

Let learners sign in to a custom course portal with a user pool.

Tradeoff or alternative

User pools and identity pools solve different problems. Compare IAM Identity Center for employees accessing AWS accounts.

Operations & governance

Amazon CloudWatch

Collects operational telemetry and supports logs, metrics, dashboards and alarms.

When to choose it

You need to understand workload behavior and react to defined operational signals.

Example in practice

Investigate structured Lambda logs and alert on a failed processing metric.

Tradeoff or alternative

Choose useful signals and retention periods. Use CloudTrail for AWS account activity rather than relying on application logs alone.

Operations & governance

AWS CloudTrail

Records AWS account activity for auditing and investigation.

When to choose it

You need evidence of who performed an AWS action and when it occurred.

Example in practice

Investigate which identity changed a security group or deleted a resource.

Tradeoff or alternative

Event history, trails and data-event collection differ in scope. Configure the events you need; CloudTrail is not an application log service.

Operations & governance

AWS Config

Records supported resource configurations and evaluates them against configured rules.

When to choose it

You need configuration history and checks for resource settings across an environment.

Example in practice

Identify a security group whose configuration no longer matches an approved rule.

Tradeoff or alternative

Recording and evaluation are not the same as preventing a change. Remediation and preventive controls require separate configuration.

Operations & governance

AWS Organizations

Groups AWS accounts for centralized management, policies and consolidated billing.

When to choose it

A team needs separate accounts with common organizational controls.

Example in practice

Separate learning, development and production accounts under organizational units.

Tradeoff or alternative

Service control policies limit available permissions; they do not grant them. Account access still needs appropriate identity policies.

Operations & governance

AWS Budgets

Tracks selected cost or usage targets and sends configured budget notifications.

When to choose it

You want visibility when actual or forecast spending approaches a chosen threshold.

Example in practice

Send a notification when a personal AWS learning account approaches its monthly budget.

Tradeoff or alternative

A budget alert is not a hard spending cap. Keep resource cleanup and any configured budget actions as separate controls.

Operations & governance

AWS Systems Manager

Provides tools to manage nodes, automate operations and maintain operational configuration.

When to choose it

You need controlled administration of supported managed machines and repeatable operational tasks.

Example in practice

Open a Session Manager session to an EC2 instance without exposing an inbound SSH port.

Tradeoff or alternative

Managed nodes need the required agent, IAM permissions and connectivity. Select the Systems Manager capability that fits the task.

Operations & governance

AWS CloudFormation

Provisions and updates AWS resources from declarative infrastructure templates.

When to choose it

An environment needs a repeatable resource definition and reviewed infrastructure changes.

Example in practice

Create the same network and web tier for separate development and test environments.

Tradeoff or alternative

Review replacement behavior and deletion policies before changing a stack. A template does not remove the need for backups or recovery planning.

Operations & governance

AWS CloudShell

A browser-based shell with AWS CLI tools and your console identity available to the session.

When to choose it

You need to run administrative commands without installing a local command-line environment.

Example in practice

Check the current identity and inspect an S3 bucket during a guided lab.

Tradeoff or alternative

It is an interactive administration environment, not an application host. Created AWS resources still incur their own charges.

Operations & governance

Amazon Q Developer in chat applications

Brings supported AWS notifications and permitted operational actions into chat channels.

When to choose it

A team wants AWS alarms and operational context in its approved chat workspace.

Example in practice

Deliver a CloudWatch alarm through SNS to a Slack channel.

Tradeoff or alternative

Workspace approval and IAM controls are required. Use supported notification formats and grant command permissions only when needed.

Application integration

Amazon SNS

Publishes messages to topic subscribers for notifications and fan-out.

When to choose it

One event needs delivery to multiple supported subscribers.

Example in practice

Send an operational notification to an email subscriber and a processing queue.

Tradeoff or alternative

Endpoint and delivery features vary by topic type. Compare SQS when a worker needs to pull and retry queued work.

Application integration

Amazon SQS

Buffers messages between producers and consumers using managed queues.

When to choose it

Background work needs to absorb bursts and be retried independently of its producer.

Example in practice

Queue order-processing tasks and send repeatedly failing messages to a dead-letter queue.

Tradeoff or alternative

Design consumers for delivery semantics and retries. Compare SNS for fan-out and Kinesis Data Streams for retained, replayable streams.

Application integration

Amazon EventBridge

Routes events between supported applications and AWS services using event buses and rules.

When to choose it

Different consumers should receive events based on their content without tight producer coupling.

Example in practice

Route a registration-created event to separate notification and analytics workflows.

Tradeoff or alternative

Event routing differs from a worker queue or a workflow state machine. Compare SQS for buffering and Step Functions for orchestration.

Application integration

Amazon EventBridge Scheduler

Invokes supported targets on recurring or one-time schedules.

When to choose it

A task should run at a scheduled time without maintaining a cron server.

Example in practice

Invoke a Lambda function each morning to prepare a reminder.

Tradeoff or alternative

Configure time zones, retry behavior and delivery windows. Targets should tolerate retries; use event-bus rules for content-based event routing.

Application integration

AWS Step Functions

Coordinates tasks and AWS service calls through defined workflow state machines.

When to choose it

A process needs multiple steps, branching, retries or explicit error handling.

Example in practice

Validate a document, run processing, and route the result to an approval step.

Tradeoff or alternative

Standard and Express workflows have different execution models and limits. Compare a single function for a simple independent operation.

Analytics & AI

Amazon Athena

Queries data with SQL without operating a query cluster.

When to choose it

You want to explore datasets in S3 and supported data sources with SQL.

Example in practice

Analyze sales files and query an Apache Iceberg table in a data lake.

Tradeoff or alternative

Data layout and query design affect scan costs and speed. Compare Redshift for warehouse workloads and RDS for application transactions.

Analytics & AI

AWS Glue

Provides data integration capabilities and a shared Data Catalog for dataset metadata.

When to choose it

Analytics tools need shared table definitions or managed data preparation workflows.

Example in practice

Catalog sales files in S3 so Athena can query them as tables.

Tradeoff or alternative

Catalog metadata and transformation jobs are different capabilities. A catalog entry does not move or store the underlying dataset.

Analytics & AI

Amazon Redshift

A managed SQL data warehouse for analytical queries and business reporting.

When to choose it

Teams need a warehouse-oriented approach to combining and analyzing business data.

Example in practice

Build recurring dashboards that compare registration and sales trends across terms.

Tradeoff or alternative

Choose provisioned or Serverless deployment around the workload. Compare Athena for direct data-lake exploration and RDS for operational transactions.

Analytics & AI

Amazon Kinesis Data Streams

Collects streaming records for consumers that process and can replay retained data.

When to choose it

Multiple consumers need to process an ongoing stream of ordered-per-shard records.

Example in practice

Collect application activity events for real-time operational analysis.

Tradeoff or alternative

Plan partition keys, capacity and retention. Compare SQS for discrete work items and EventBridge for event routing.

Analytics & AI

Amazon Bedrock

Provides managed access to foundation models and capabilities for generative AI applications.

When to choose it

An application needs model inference or a grounded AI workflow integrated with AWS services.

Example in practice

Prototype an assistant that answers questions using approved course material.

Tradeoff or alternative

Evaluate model suitability, availability, permissions, cost and output quality. Generated answers need validation against the application’s source material.