AWS for DevOps: Which Services to Learn First

Why AWS comes after CI/CD

You have already run your app on one server. So you know what it needs: a machine, a network, a database and backups. That makes AWS easier to learn, because each service answers a problem you have already met. EC2 is your virtual machine. RDS is the Postgres you restored by hand at step 5.

Why AWS and not another cloud? It leads the sources we checked. In the Stack Overflow 2026 survey, 41.8% of those who answered the cloud and infrastructure question chose AWS. Virtualization Review describes that as extensive work over the past year. Azure had 25.1% and Google Cloud 24.5%. Those are developers, not job postings, and your local market may differ. If Azure leads near you, swap it in.

Read this first: AWS can bill you

AWS is the first step on this roadmap where a mistake can cost real money. Here is how to limit that.

Know your plan. These are the terms AWS listed on 31 October 2026. Check them yourself before you sign up.

• New accounts get $100 in credits and can earn up to $100 more.
• On the free plan, AWS says you are not charged unless you upgrade or turn on paid-only services.
• The free plan ends after 6 months or when your credits run out, whichever comes first. Then the account closes.
• The free plan covers select services. That list includes everything on this page, such as EC2, RDS and Elastic Load Balancing.
• On the paid plan, you pay for anything beyond your credits.

So open the account when you start this step, not before. By our estimates, this step and the later ones that use AWS take about six months in total, so the plan may end before you finish. Upgrade to the paid plan before then if you still need the account. Keep good notes too, because a closed account takes your setup with it.

Set a billing alarm on day one, before you create anything else. Follow the CloudWatch billing alarm guide:

1. In Billing preferences, turn on CloudWatch billing alerts. Data can take about 15 minutes to appear.
2. Switch to the US East (N. Virginia) Region, because billing data is stored only there.
3. Create an alarm on EstimatedCharges with a low limit, such as $10.
4. Open the email from AWS and confirm the subscription. If you skip this, the alarm goes nowhere.

An alarm tells you about money already spent. It does not stop anything. Users also report that EstimatedCharges stays at 0 while credits cover their usage. So this alarm may stay quiet until your credits are gone. AWS Budgets is another option, but it updates only up to three times a day. Check your credit balance each week as well.

Know what quietly costs money. Some things charge by the hour even with no traffic. As listed on the VPC pricing page on 31 October 2026:

• A NAT gateway (lets private servers reach the internet) costs $0.045 an hour in the US East (Ohio) example, plus $0.045 per GB. That is about $33 a month before any data.
• Each public IPv4 address costs $0.005 an hour, about $3.65 a month, even when idle.

Load balancers and RDS databases also charge while they run. Delete everything when you finish a study session, until you can do it with Terraform.

If you ever see a charge you cannot explain, or you think a key has leaked, contact AWS Support right away.

What to learn, in order

1. IAM. IAM (Identity and Access Management) controls who can do what. Learn it first, since every action in AWS passes through it. Protect the root user (the account owner) with MFA, then stop using it for daily work.
2. VPC. A VPC is your private network in AWS. Learn subnets, route tables and security groups (firewall rules for a resource). This is where step 2 pays off.
3. EC2. EC2 gives you virtual servers. Run your app on one, then attach an IAM role, so the server gets short-lived access with no keys in a file.
4. A load balancer. It sends traffic to healthy servers. Allow traffic to the server only from the load balancer, so nobody can skip past it.
5. RDS. RDS is a database that AWS runs for you. Put it in a private subnet and restore it from a snapshot once. A backup you never restored is only a hope.
6. S3. S3 stores files. Send your backups there and keep Block Public Access on.
7. CloudWatch. It collects metrics and logs. Make one alarm for your app. You will build on this at step 10.
8. Your bill. Read the billing page line by line. Being able to explain the bill is a job skill, not only a way to save money.

To avoid a NAT gateway while you learn, keep the app server in a public subnet with a tight security group. Keep only the database in a private subnet.

What to skip for now

• Most of the other AWS services. If your app does not need it, leave it.
• Lambda beyond knowing what it does (runs a function with no server to manage).
• EKS, the AWS Kubernetes service. You will use a local cluster first because it costs nothing to run.
• Multiple AWS accounts, AWS Organizations and landing zones.
• A second cloud.

Common mistakes

• Putting access keys on a server. Keys in a config file can leak and never expire by themselves. Use an IAM role.
• Attaching AdministratorAccess to make an error go away. It is the AWS version of chmod 777. Read the error, then grant the one action that is missing.
• Opening port 22 or 5432 to 0.0.0.0/0. That means the whole internet. Allow only the addresses or security groups that need access.
• Leaving things running over a weekend. Stopping an EC2 instance does not delete its disk or its other resources. Check every Region you used.
• Learning from the console only, with no notes. You will need those steps at the next stage. Write them down as you click.

Your project

Move your app to AWS by hand, in the console: network, server, load balancer, database and backups to S3. Write down every step and every setting you chose. Then delete all of it and rebuild it from your notes. The second run shows you what your notes left out, and those notes become the plan for Terraform.