Twelve visual chapters that take you from az login
to aws sts get-caller-identity and beyond. Built for engineers who already know Azure - every concept anchored against an Azure equivalent, side-by-side code in both clouds, and honest call-outs where the mapping breaks down.
You already ship on Azure. So why learn AWS? Three reasons that matter in practice:
| If you care about | Azure gives you | AWS gives you |
|---|---|---|
| Market reach | Strong in enterprise + Microsoft shops. AAD/Office integration is best-in-class. | Largest cloud by revenue. Most third-party tooling targets AWS first. |
| Mental model | Hierarchy: tenant → mgmt group → subscription → resource group → resource. | Flatter: organization → account → region → resource. Tags do the grouping work. |
| Identity | AAD-centric. Users, groups, service principals, managed identities, all one system. | IAM split: users + roles + policies, plus separate AWS SSO / Identity Center for humans. |
| Networking | VNets with NSGs (stateful), no separate stateless layer by default. | VPCs with SGs (stateful) and NACLs (stateless). Two-layer model takes adjustment. |
| Serverless | Functions + Logic Apps + APIM + Event Grid. | Lambda + Step Functions + API Gateway + EventBridge. Same shapes, different glue. |
| Ecosystem fit | Enterprise IT, .NET shops, Microsoft 365 + Power Platform tie-ins. | Startups, ML/data, anything Kubernetes-shaped (EKS), most CNCF projects test on AWS first. |
Twelve bite-sized chapters. Each builds on the previous, but each also stands alone if you need a refresher later. Foundations (1-3) before services (4-9) before synthesis (10-12).
Accounts vs subscriptions, regions, AZs, CLI install, aws configure vs az login, profiles, MFA. The "where do I click first" chapter.
Users, groups, IAM roles vs Azure managed identities, identity- vs resource-based policies, trust policies, STS assume-role, permission boundaries. The densest chapter.
3VPC vs VNet, subnets, route tables, IGW, NAT GW, SGs (stateful), NACLs (stateless), VPC peering, Transit Gateway vs Azure vWAN.
4EC2 instance families, AMIs vs Azure images, Lambda vs Functions, ECS/Fargate vs ACI, EKS overview.
5S3 buckets vs Blob containers, storage classes, versioning, lifecycle rules, EBS vs Managed Disks, EFS vs Azure Files.
6RDS engines vs Azure SQL/PG flex, Aurora basics, DynamoDB vs Cosmos DB (partition keys, capacity modes).
7SQS vs Service Bus, SNS vs Event Grid topics, EventBridge, Kinesis vs Event Hubs. Closest 1:1 mapping of any chapter.
8KMS vs Key Vault keys, Secrets Manager vs Key Vault secrets, ACM vs App Service certs, GuardDuty intro.
9CloudWatch logs/metrics/alarms vs Log Analytics/Azure Monitor, CloudTrail vs Activity Log, X-Ray vs App Insights. KQL → CW Logs Insights.
10EKS control plane, node groups vs AKS node pools, IRSA vs workload identity, AWS LB Controller, EBS CSI, Karpenter.
11Lambda + API GW + DynamoDB + EventBridge end-to-end vs Functions + APIM + Cosmos + Event Grid. Cold starts, layers.
12Terraform AWS provider, modules, AWS Organizations vs Management Groups, SCPs vs Azure Policy, Control Tower landing zones.
Every chapter follows the same 7-block shape. Once you know the shape, you can skim or deep-read any chapter without losing your place.
| Block | What you'll find |
|---|---|
| 1. Sticky nav | Jump between chapters anytime. Highlighted = current chapter. |
| 2. Hero | Chapter title, number, one-line subtitle. |
| 3. Lead + TOC | "Why this matters for an Azure dev" paragraph, plus jump-to TOC. |
| 4. Azure ↔ AWS cheat table | The chapter's standout block. Concept-by-concept mapping. Honest gap call-outs in italic red where AWS lacks a clean equivalent. |
| 5. Concept sections | 3-6 deep-dives per chapter. Each has an ELI5 box, a diagram (where useful), side-by-side Azure / AWS code, gotchas, and engagement blocks (see below). |
| 6. "Try it" mini-lab | 1-2 copy-pasteable commands. Every lab labeled with rough cost ($0, ~$0.01/hr, etc). |
| 7. Quick-check quiz | 4-5 multiple-choice questions with click-to-reveal answers. Active recall before you move on. |
| 8. Recap + next | Bullet recap, pitfalls box, link to the next chapter. |
| Block | What it is |
|---|---|
| Fun fact | Trivia and surprising defaults that explain AWS quirks. Dashed purple border. e.g., why us-east-1 hogs all the global services. |
| Etymology box | "What's in a name?" - origins of AWS service acronyms (S3, STS, ARN, IRSA, SCP). Helps the abbreviations stick. |
| Bug hunt | Broken code or config - find the bug, then click to reveal the solution. Amber border. Trains your eye for real "access denied" debugging. |
| Cost trap puzzle | A realistic deployment scenario that hides a 4-5 figure surprise bill. Spot the cause, then click to reveal the math and the fix. |
| Real-world incident | Actual AWS disaster (Code Spaces shutdown, 2017 S3 outage) with dollar-amount badges. Makes the gotchas visceral. |
| Try it lab | Copy-pasteable commands marked with $0 / paid cost badges. Most are read-only and free. |
| Project Compass | The recurring build-along. Every chapter adds one slice of a fictional gfn-reports service. By chapter 12 you've wired up almost the whole AWS stack. |
gfn-reports, a fictional NVIDIA service that reads GeForce NOW session telemetry, aggregates it in DynamoDB, exposes a query API via Lambda + API Gateway, runs in a dedicated VPC, encrypts with KMS, and ends up Terraform-managed in a multi-account org. Each chapter's Compass slice picks up where the previous left off. You can skip Compass if you only want the concepts - the chapters stand on their own - but following Compass gives you a real working system at the end.
You'll get the most out of this if you:
terraform plan without apply). When a lab spends real money it'll say so up front.