Learning Notes

Personal study notes. Go, AWS, Terraform/OpenTofu, and HashiCorp Vault for secret consumers.
Side-by-side comparisons, real-world incidents, copy-paste labs, click-to-reveal quizzes.

Python → Go Azure → AWS Terraform/OpenTofu Vault
8
Go chapters
12
AWS chapters
18
Terraform/OpenTofu chapters
16
Vault chapters
~2.7 MB
Self-contained HTML
0
External deps
100+
Code examples
~8 hr
Read all end-to-end

Learn Go 8 chapters

For Python developers, with side-by-side Python ↔ Go comparisons. Covers syntax, types, control flow, functions, collections, structs, errors, and packages.
Course index →
1
Hello, Go
First program, build vs run, the toolchain. Python print → Go fmt.Println.
 2
Types & variables
Static typing, type inference, zero values, constants. Mandatory types vs optional hints.
 3
Control flow
if, for (only loop construct), switch. No while, no ternary - and that's fine.
 4
Functions
Multiple return values, named returns, variadic args, closures, defer.
 5
Collections
Arrays vs slices vs maps. Why Go has no list, dict, or set by those names.
 6
Structs & pointers
No classes. Composition over inheritance. Pointer semantics for the Python dev.
 7
Error handling
No exceptions. if err != nil idiom, wrapping, errors.Is/As.
 8
Packages & modules
go.mod, import paths, capitalization-as-export. Vs Python's __init__ dance.

Learn AWS 12 chapters

For Azure-fluent engineers, with side-by-side Azure ↔ AWS comparisons. Threads a build-along scenario (Project Compass) across all chapters.
Course index →
1
Hello, AWS
Accounts vs Subscriptions, regions, AZs, CLI auth. The "where do I click first" chapter.
 2
IAM & Identity
Users, roles, policies, STS, trust policies, permission boundaries, IRSA preview.
 3
Networking (VPC)
VPC, subnets, route tables, SGs (stateful), NACLs (stateless), peering, TGW.
 4
Compute
EC2 instance families, Lambda, ECS Fargate, Auto Scaling, EKS overview.
 5
Storage
S3, storage classes, lifecycle, versioning. EBS, EFS, FSx.
 6
Databases
RDS engines, Aurora, DynamoDB (partition keys, capacity), ElastiCache.
 7
Messaging & Events
SQS (standard + FIFO), SNS, EventBridge, Kinesis. Closest 1:1 cloud mapping.
 8
Security & Secrets
KMS keys, Secrets Manager, ACM, GuardDuty, Security Hub, Access Analyzer.
 9
Observability
CloudWatch metrics/logs/alarms, CloudTrail, X-Ray, Logs Insights vs KQL.
 10
Kubernetes on AWS (EKS)
EKS control plane, node groups, VPC CNI, IRSA, AWS LB Controller, Karpenter.
 11
Serverless patterns
Lambda + API Gateway + DynamoDB + EventBridge end-to-end. Step Functions.
 12
IaC & Multi-account
Terraform, CloudFormation, CDK. Organizations, SCPs, Control Tower.

Learn Terraform/OpenTofu 18 published / 24 planned

For AWS engineers who want to learn HCL, plan review, state safety, modules, and a three-AZ network without skipping the operational checks.
Course index →
1
Infrastructure as Code and Safe Setup
Choose a CLI, keep credentials short-lived, and review the first plan before applying.
 2
HCL as a Language
Expressions, types, collections, functions, and the console behind readable configuration.
 3
Resources and the Dependency Graph
Resources, data sources, and graph edges that decide what can change together.
 4
The Plan and Apply Lifecycle
Use init, validate, plan, apply, and destroy as a deliberate reviewed workflow.
 5
State Without Fear
Locking, import, moved blocks, recovery, and safe refactors without treating state as a mystery.
 6
Variables, Contracts, and Modules
Validation and module boundaries that turn shared infrastructure into an explicit contract.
 7
Environments, Testing, and Debugging
Separate environments, test safely, investigate drift, and debug the actual graph.
 8
AWS Providers and Remote State
Provider authentication, remote state, S3, KMS, and the ownership boundaries around them.
 9
Three-AZ Networking
A production-shaped VPC with subnets, routing, NAT choices, DNS, and cost trade-offs.
 10
IAM, Encryption, Secrets, and Network Controls
Trust policies, least-privilege permissions, KMS, secret metadata, and workload boundaries.
 11
Learning and Production Profiles
Compare plan output, resilience cost, retention, and deletion controls across explicit profiles.
 12
GitLab CI for Terraform/OpenTofu
OIDC, saved plans, manual approval, serialization, and read-only drift checks.
 13
EKS Control Plane and Access
Private API access, control-plane logs, encryption, access entries, and managed add-ons.
 14
EC2 Data Plane
Managed node groups for system, application, Spot, and Cassandra placement.
 15
Fargate and Mixed Scheduling
A narrow Fargate selector alongside deliberate EC2 workload placement.
 16
Autoscaling and Capacity
Karpenter prerequisites, interruption handling, and application-only elastic capacity.
 17
Persistent Storage on EKS
EBS CSI, KMS grants, topology-aware binding, snapshots, and retained data.
 18
Envoy Gateway at the Edge
An Argo-owned Gateway API edge on EC2 system nodes behind one internal NLB.

Learn HashiCorp Vault 16 chapters

Consumer-first identity, policy, KV v2, dynamic PostgreSQL, PKI, Agent, GitLab CI, AWS IAM, EKS, rotation, and outage drills.
Course index →
1
Vault from the Consumer Perspective
Identity, policy, engines, leases, and ownership in one request flow.
 2
Safe Local Lab and First Login
Disposable Compose lab and constrained learner credentials.
 3
CLI, API, UI, Paths, and Mounts
Translate friendly CLI paths into exact engine API routes.
 4
Tokens, Leases, TTLs, and Revocation
Independent lifetime clocks, renewal margin, and stop-using rules.
 5
Policies and 403 Troubleshooting
Exact paths, capabilities, default deny, and safe correlation.
 6
KV v2 Without Secret Sprawl
Versioned data, protected runtime delivery, reload, and deletion.
 7
Choose Workload Auth and Use AppRole
Native identity first; AppRole as a bounded fallback.
 8
Dynamic PostgreSQL Credentials
Leased users, pool replacement, query evidence, and revocation.
 9
Short-Lived PKI Certificates
Constrained SANs, safe inspection, atomic replacement, and expiry.
 10
Vault Agent for Applications
Auto-auth, protected templates, freshness, and reload ownership.
 11
GitLab CI with ID Tokens
Explicit audience, claim bounds, and file-type secret delivery.
 12
AWS IAM Authentication
Signed identity proof and exact AWS principal binding.
 13
Kubernetes Authentication on EKS
Bounded projected tokens, audiences, namespaces, and roles.
 14
Injector, CSI, or Direct API
Choose delivery by lifecycle ownership and failure semantics.
 15
Rotation, Reload, Caching, and Outages
A bounded fresh, stale, expired, and recovered state machine.
 16
Project Lockbox Readiness Drills
End-to-end evidence, failure drills, cleanup, and owner sign-off.

Recommended reading paths

54 published chapters is a lot. Here are sensible orderings depending on what you're after.

Just need to ship Go code

The minimum viable Go knowledge to read and write production Go services.

go-1 go-2 go-4 go-5 go-7

Go end-to-end

The complete Go arc. Roughly 2-3 hours to read all 8 chapters back-to-back.

go-1 go-2 go-3 go-4 go-5 go-6 go-7 go-8

I run workloads on AWS already

Skip the orientation. Focus on the dense identity/networking chapters and the things that bite Azure devs.

aws-2 aws-3 aws-5 aws-8 aws-9 aws-12

Migrating from Azure to AWS

The translator-focused arc. Every chapter has the cheat table up top.

aws-1 aws-2 aws-3 aws-4 aws-5 aws-6

Kubernetes engineer, learning EKS

Cluster networking, IAM, and ops patterns specific to EKS. Builds on the foundations.

aws-2 aws-3 aws-4 aws-8 aws-9 aws-10

Terraform/OpenTofu foundations

Start provider-free, then add HCL, the dependency graph, lifecycle review, and state safety in order.

iac-1 hcl-2 graph-3 plan-4 state-5

Project Compass build-along

The AWS doc threads a fictional NVIDIA service (gfn-reports) across all 12 chapters. Each chapter adds one slice; by the end you have a working stack.

profile role vpc lambda s3 ddb sqs kms alarms eks api terraform

Project Lockbox consumer path

Start with Priya's human access, then follow orders-api through workload identity, dynamic credentials, EKS delivery, and outage behavior.

login kv-v2 auth database eks readiness

Topic index - find by concept

Cross-references for when you remember the concept but not which chapter it lived in.

If you're looking for... Go chapter AWS chapter
Identity / auth / credentials - 1 - CLI auth, 2 - IAM, 8 - Secrets
Networking / DNS / routing - 3 - VPC
Compute - VMs / containers / functions - 4 - Compute, 10 - EKS, 11 - Serverless
Object storage / files / volumes - 5 - Storage
SQL / NoSQL / cache - 6 - Databases
Queues / pub-sub / streams - 7 - Messaging, 11 - Serverless
Logging / metrics / tracing - 9 - Observability
IaC / multi-account / governance - 12 - IaC
Functions / closures / multiple returns 4 - Functions -
Slices / maps / iteration 5 - Collections -
Errors / no-exceptions idiom 7 - Errors -
Modules / imports / dependency management 8 - Packages -
Types / structs / "classes" 2 - Types, 6 - Structs -

Terraform/OpenTofu

State / remote state / recovery: 5 - State, 8 - Remote state. HCL / dependency graph / plans: 2 - HCL, 3 - Graph, 4 - Lifecycle. VPC / subnets / NAT: 9 - Three-AZ networking.

HashiCorp Vault

Human login / access: 2 - Login, 5 - Policies. Application secrets: 8 - Dynamic database, 9 - PKI, 10 - Agent. EKS / lifecycle: 13 - Kubernetes auth, 15 - Rotation and outages.

About this site

Personal study notes I built while learning Go (coming from Python), AWS (coming from Azure), Terraform/OpenTofu for AWS infrastructure, and HashiCorp Vault from the secret consumer's perspective. Written for me first, shared with whoever finds them useful.

How to read

Every chapter is a single self-contained HTML file. No build step, no dependencies, no JS frameworks - just inline CSS and ~50 lines of vanilla JS for copy buttons and smooth scrolling. You can scp any file to a server, open it from file://, or load it from this Pages site - all work identically.

What's in every AWS chapter

BlockWhat it does
Azure ↔ AWS cheat tableConcept mapping at the top. Honest "no equivalent" call-outs where the mapping breaks.
Side-by-side codeAzure CLI / Bicep / azurerm Terraform on the left; AWS CLI / Terraform on the right.
ELI5 boxesPlain-English analogies for tricky concepts (e.g., "A role is a hat anyone allowed can wear").
Real-world incidentsActual AWS disasters (Code Spaces 2014, 2017 S3 outage, Capital One breach) with dollar amounts.
Cost-trap puzzlesRealistic scenarios that hide $1K-$10K+ surprise bills. Spot it, click to reveal.
Bug huntsBroken policy/config snippets. Find the issue, click to reveal the fix.
Etymology boxesWhy is it called "Lambda"? "Kinesis"? "IRSA"? These help acronyms stick.
"Try it" labsCopy-paste commands with explicit cost badges. Most are $0 read-only API calls.
Quick-check quizzes4-5 multiple-choice questions with click-to-reveal answers and explanations.
Project CompassA fictional NVIDIA service (gfn-reports) built one slice per chapter, ending in a complete Terraform deployment.
Wait, why does an NVIDIA engineer have AWS notes? Cloud is cloud. Knowing the multi-cloud landscape makes me a better Azure engineer, a better Kubernetes engineer, and a better architect. Your career outlives any one cloud vendor.