Compute

The cheat table: Azure compute → AWS compute

Instance family decoder (the one you'll keep coming back to)

Azure's VM SKU letters and AWS's instance family letters tell similar stories - they encode the workload shape. Here's the mapping that lets you walk into a sizing conversation without looking lost.

EC2 fundamentals

An EC2 instance isn't one resource - it's a constellation. When you call ec2:RunInstances, AWS wires together half a dozen things, each of which has its own ARN and its own bill.

Launch an instance: Azure vs AWS, side by side

# Standard_B2s ~= burstable 2 vCPU 4 GiB
az vm create \
  --resource-group rg-app \
  --name web-01 \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --vnet-name vnet-app \
  --subnet snet-app \
  --admin-username azureuser \
  --generate-ssh-keys \
  --custom-data cloud-init.txt

# t3.small ~= burstable 2 vCPU 2 GiB (closest peer)
aws ec2 run-instances \
  --image-id ami-0abcd1234 \
  --instance-type t3.small \
  --subnet-id subnet-0aaa \
  --security-group-ids sg-0bbb \
  --key-name my-keypair \
  --iam-instance-profile Name=web-app-profile \
  --user-data file://cloud-init.txt \
  --tag-specifications \
    'ResourceType=instance,Tags=[{Key=Name,Value=web-01}]'

Two things to notice on the AWS side: (1) the AMI ID is mandatory and region-specific - there is no equivalent of --image Ubuntu2204 that magically resolves. You either look up the latest AMI ID via SSM Parameter Store (recommended) or pin it explicitly. (2) the IAM instance profile shows up as an explicit launch parameter, where in Azure it's a flag on the VM resource after creation.

The Terraform shape

# Look up the latest Amazon Linux 2023 AMI without hardcoding the ID
data "aws_ssm_parameter" "al2023" {
  name = "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64"
}

resource "aws_instance" "web" {
  ami                  = data.aws_ssm_parameter.al2023.value
  instance_type        = "t3.small"
  subnet_id            = aws_subnet.private_a.id
  vpc_security_group_ids = [aws_security_group.web.id]
  iam_instance_profile = aws_iam_instance_profile.web.name
  user_data            = file("cloud-init.sh")

  metadata_options {
    http_tokens = "required"   # force IMDSv2 - blocks the SSRF class of attacks
  }

  root_block_device {
    volume_size = 20
    volume_type = "gp3"
    encrypted   = true
  }

  tags = { Name = "web-01", Project = "compass" }
}

AMIs vs Azure images

An AMI is a region-scoped artifact containing: the root EBS snapshot, the kernel and boot loader metadata, optional extra EBS snapshots, and ENA/virtualization hints. Every EC2 launch starts from one.

Looking up the latest AMI without hardcoding

The Azure equivalent of "use the latest Ubuntu" is --image Ubuntu2204. AWS gives you SSM Parameter Store paths that AWS itself keeps up to date:

# Latest Amazon Linux 2023, x86_64
aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \
  --query 'Parameter.Value' --output text

# Latest Amazon Linux 2023, arm64 (Graviton)
aws ssm get-parameter \
  --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-arm64 \
  --query 'Parameter.Value' --output text

# Latest Ubuntu 22.04, x86_64
aws ssm get-parameter \
  --name /aws/service/canonical/ubuntu/server/22.04/stable/current/amd64/hvm/ebs-gp2/ami-id \
  --query 'Parameter.Value' --output text

Lambda

Lambda is the FaaS service you reach for when (a) you don't want to manage a host, (b) workload is bursty or event-driven, and (c) individual invocations fit in 15 minutes and 10 GB RAM. Beyond that you're picking a container service.

The lifecycle: init, warm, cold

What triggers a cold start?

• First invocation after creation or after the function has been idle long enough that AWS reclaimed environments.
• Scale-up under burst - if 50 requests arrive simultaneously and you only had 5 warm environments, the other 45 are cold.
• Code or config update - any deploy invalidates the existing environments.
• Runtime patching - AWS replaces environments transparently when they upgrade the runtime.
• VPC-attached Lambdas used to add seconds for ENI provisioning; AWS fixed that in 2019 with the Hyperplane ENI work. Today VPC-attached cold start adds well under 100ms.

Anatomy: function definition

# function_app.py
import azure.functions as func

app = func.FunctionApp()

@app.function_name(name="hello")
@app.route(route="hello")
def hello(req: func.HttpRequest) -> func.HttpResponse:
    name = req.params.get("name", "world")
    return func.HttpResponse(f"hello {name}")

# handler.py
import json

# module-level code runs once per cold start - reuse clients here
import boto3
s3 = boto3.client("s3")

def handler(event, context):
    name = event.get("name", "world")
    return {
        "statusCode": 200,
        "body": json.dumps({"message": f"hello {name}"}),
    }

Deploy with Terraform

resource "aws_lambda_function" "hello" {
  function_name = "hello"
  role          = aws_iam_role.hello_exec.arn
  runtime       = "python3.12"
  handler       = "handler.handler"          # module.function_name
  filename      = "build/hello.zip"
  source_code_hash = filebase64sha256("build/hello.zip")

  memory_size = 512                            # MB. CPU scales with this.
  timeout     = 30                             # seconds, max 900 (15 min)
  architectures = ["arm64"]                   # Graviton: ~20% cheaper

  environment {
    variables = { LOG_LEVEL = "INFO" }
  }

  # Optional: attach to VPC for private-subnet access
  vpc_config {
    subnet_ids         = [aws_subnet.private_a.id, aws_subnet.private_b.id]
    security_group_ids = [aws_security_group.lambda.id]
  }
}

Concurrency, the lever that bites

resource "aws_lambda_function" "csv_processor" {
  function_name = "csv-processor"
  role          = aws_iam_role.csv.arn
  runtime       = "python3.12"
  handler       = "app.handler"
  filename      = "build/csv.zip"

  timeout     = 900          # 15 min - the max!
  memory_size = 128          # save money...
}

Layers and container-image Lambdas

ECS / Fargate vs ACI / Container Apps

ECS has two halves that often get conflated:

Mapping the Azure container menu

Task definitions: the heart of ECS

A task definition is a JSON document. It pins the container image, the resources, the IAM role, environment variables, port mappings, log driver. Think of it as a docker-compose snippet that AWS treats as a versioned artifact - every edit creates a new revision.

{
  "family": "gfn-reports-api",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "awsvpc",
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::123:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::123:role/gfn-reports-task-role",
  "containerDefinitions": [{
    "name": "api",
    "image": "123.dkr.ecr.us-east-1.amazonaws.com/gfn-reports:1.2.3",
    "portMappings": [{ "containerPort": 8080, "protocol": "tcp" }],
    "environment": [
      { "name": "LOG_LEVEL", "value": "INFO" }
    ],
    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "/ecs/gfn-reports-api",
        "awslogs-region": "us-east-1",
        "awslogs-stream-prefix": "api"
      }
    }
  }]
}

Service vs task: when does each fit?

Same idea in Terraform

resource "aws_ecs_cluster" "main" {
  name = "compass"
}

resource "aws_ecs_task_definition" "api" {
  family                   = "gfn-reports-api"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "512"
  memory                   = "1024"
  execution_role_arn       = aws_iam_role.ecs_execution.arn
  task_role_arn            = aws_iam_role.api_task.arn
  container_definitions    = jsonencode([/* container block from above */])
}

resource "aws_ecs_service" "api" {
  name            = "gfn-reports-api"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.api.arn
  desired_count   = 2
  launch_type     = "FARGATE"

  network_configuration {
    subnets          = [aws_subnet.private_a.id, aws_subnet.private_b.id]
    security_groups  = [aws_security_group.api.id]
    assign_public_ip = false
  }
}

EKS overview (preview of chapter 10)

This is a 30,000-foot preview. Chapter 10 walks the whole setup. But the shape is worth seeing now because EKS will be the project's destination in chapter 10:

The key differences from AKS are at the edges - IAM integration is through IRSA (chapter 2) or EKS Pod Identity, networking is the VPC CNI (each pod gets a routable VPC IP), and the load balancer controller provisions ALBs/NLBs from Kubernetes Service/Ingress objects. We dig into all of that in chapter 10.

Auto Scaling vs VMSS

Auto Scaling Groups (ASG) are AWS's VMSS equivalent. They watch metrics or schedules, and add/remove EC2 instances to match. Three flavors:

resource "aws_launch_template" "web" {
  name_prefix   = "web-"
  image_id      = data.aws_ssm_parameter.al2023.value
  instance_type = "t3.small"
  user_data     = base64encode(file("cloud-init.sh"))

  iam_instance_profile { name = aws_iam_instance_profile.web.name }
  vpc_security_group_ids = [aws_security_group.web.id]
}

resource "aws_autoscaling_group" "web" {
  name             = "web-asg"
  min_size         = 2
  desired_capacity = 2
  max_size         = 10
  vpc_zone_identifier = [aws_subnet.private_a.id, aws_subnet.private_b.id]
  target_group_arns   = [aws_lb_target_group.web.arn]
  health_check_type   = "ELB"

  launch_template { id = aws_launch_template.web.id; version = "$Latest" }
}

resource "aws_autoscaling_policy" "web_cpu" {
  name                   = "web-target-cpu-50"
  autoscaling_group_name = aws_autoscaling_group.web.name
  policy_type            = "TargetTrackingScaling"

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ASGAverageCPUUtilization"
    }
    target_value = 50
  }
}

Try it: explore instance types and Lambda limits

# Total count of instance types in this region
aws ec2 describe-instance-types \
  --query 'length(InstanceTypes)' \
  --profile compass

# All Graviton (arm64) instance types - 4 vCPU, sorted by memory
aws ec2 describe-instance-types \
  --filters "Name=processor-info.supported-architecture,Values=arm64" \
             "Name=vcpu-info.default-vcpus,Values=4" \
  --query 'InstanceTypes[*].[InstanceType,MemoryInfo.SizeInMiB,VCpuInfo.DefaultVCpus,ProcessorInfo.SupportedArchitectures[0]]' \
  --output table \
  --profile compass

# Look at m6i (Intel), m6a (AMD), m7g (Graviton) at 2xlarge size
for t in m6i.2xlarge m6a.2xlarge m7g.2xlarge; do
  echo "=== $t ==="
  aws ec2 describe-instance-types \
    --instance-types "$t" \
    --query 'InstanceTypes[0].[InstanceType,VCpuInfo.DefaultVCpus,MemoryInfo.SizeInMiB,ProcessorInfo.SupportedArchitectures[0]]' \
    --output text \
    --profile compass
done

# For pricing, the Pricing API lives only in us-east-1, regardless of your workload region
aws pricing get-products \
  --service-code AmazonEC2 \
  --filters 'Type=TERM_MATCH,Field=instanceType,Value=m7g.2xlarge' \
            'Type=TERM_MATCH,Field=regionCode,Value=us-east-1' \
            'Type=TERM_MATCH,Field=tenancy,Value=Shared' \
            'Type=TERM_MATCH,Field=operatingSystem,Value=Linux' \
  --region us-east-1 --max-results 1 --profile compass

# Account-level Lambda concurrency cap
aws lambda get-account-settings --profile compass

# Look for: "ConcurrentExecutions" (typically 1000 by default)
# and "UnreservedConcurrentExecutions" (what's left after subtracting
# reserved concurrency from individual functions)

# EC2 vCPU quotas - the post-2019 quota model is "total vCPUs per family"
# Standard family quota (covers M, C, R, T, D, etc.)
aws service-quotas get-service-quota \
  --service-code ec2 \
  --quota-code L-1216C47A \
  --profile compass

# GPU instances (P family) - usually starts at 0, request increase before use
aws service-quotas get-service-quota \
  --service-code ec2 \
  --quota-code L-417A185B \
  --profile compass

Quick check

Gotchas for Azure devs

Project Compass: deploy the Lambda

Three chapters of scaffolding (profile, IAM role, VPC) finally pay off here. We deploy gfn-reports as a Lambda that uses the role from chapter 2, lives in the private subnets from chapter 3, and logs to CloudWatch. The first running compute in the project. Tiny, but real.

# gfn-reports/handler.py
import json
import logging
import os

log = logging.getLogger()
log.setLevel(logging.INFO)

def handler(event, context):
    log.info("received event: %s", json.dumps(event))
    log.info("environment: stage=%s region=%s",
             os.environ.get("STAGE", "dev"),
             os.environ.get("AWS_REGION"))
    return {
        "statusCode": 200,
        "body": json.dumps({
            "service": "gfn-reports",
            "message": "hello from compass",
            "input": event,
        }),
    }

mkdir -p build
cd gfn-reports
zip -r ../build/gfn-reports.zip handler.py
cd ..

# Confirm contents
unzip -l build/gfn-reports.zip

# Pull the artifacts we already created in earlier chapters
ROLE_ARN=$(aws iam get-role --role-name gfn-reports-role \
  --query 'Role.Arn' --output text --profile compass)

# Replace with the private subnet IDs from ch3 (export from terraform if you used IaC)
PRIV_SUBNETS="subnet-0aaa,subnet-0bbb"
LAMBDA_SG="sg-0lambda"      # a security group with egress only

aws lambda create-function \
  --function-name gfn-reports \
  --runtime python3.12 \
  --role "$ROLE_ARN" \
  --handler handler.handler \
  --zip-file fileb://build/gfn-reports.zip \
  --timeout 30 \
  --memory-size 256 \
  --architectures arm64 \
  --environment "Variables={STAGE=dev}" \
  --vpc-config "SubnetIds=$PRIV_SUBNETS,SecurityGroupIds=$LAMBDA_SG" \
  --tags "Project=Compass,ManagedBy=learn-aws" \
  --profile compass

# Send a test event and capture the response
aws lambda invoke \
  --function-name gfn-reports \
  --cli-binary-format raw-in-base64-out \
  --payload '{"hello": "world", "report_id": "r-001"}' \
  --log-type Tail \
  --query 'LogResult' --output text \
  /tmp/response.json --profile compass | base64 -d

echo "--- response ---"
cat /tmp/response.json

# Tail the CloudWatch log group for live logs
aws logs tail /aws/lambda/gfn-reports --follow --profile compass

Recap & next

What stuck?

• EC2 ~ Azure VM, with more visible plumbing - AMI, EBS, ENI, instance profile are each their own resource. Read instance names (m6i.2xlarge) like a sentence: family, generation, processor, size.
• Lambda ~ Azure Functions Consumption, with a hard 15-minute timeout and memory that also controls CPU. Architect for the warm path; provisioned concurrency for latency-sensitive endpoints.
• ECS / Fargate ~ Azure Container Apps. Two IAM roles (execution + task); no SSH on Fargate (use ECS Exec). App Runner is the simpler peer for "just run my container web app".
• EKS ~ AKS, sneak preview - mix node groups, Karpenter, and Fargate profiles in one cluster. Chapter 10 has the full setup.
• Auto Scaling ~ VMSS with target tracking, scheduled, and predictive scaling.
• Compute Savings Plans > Reserved Instances for almost everyone - they survive instance family migrations.

The mental model in one sentence

Common pitfalls so far