Cloud infrastructure
AWS Cloud Practical Labs
Hands-on labs covering IAM, EC2, S3, custom VPC networking, CloudTrail, CloudWatch, EventBridge and SNS in an AWS Free Tier account.
Lab approach
I used an AWS Free Tier account so each concept had an observable result: an EC2 instance reachable over SSH, a subnet with a working route, an IAM policy with a defined scope and an alarm delivered through SNS.
What I built
Identity & access
- Created IAM users and organised them into groups
- Wrote and attached permission policies
- Worked through least-privilege permission design
Compute
- Launched EC2 instances and connected over SSH with key pairs
- Configured security groups as instance-level firewalls
- Allocated and attached Elastic IPs for stable addressing
Storage
- Created buckets and configured access policies
- Enabled and tested versioning
- Worked through public vs. private object access
Networking
- Built a custom VPC from scratch rather than using the default
- Carved out subnets and attached an internet gateway
- Configured route tables to control egress
Observability
- Configured CloudWatch metrics and alarms
- Enabled CloudTrail for API-level audit logging
- Wired SNS notifications and EventBridge rules
Account concepts
- Studied AWS Organizations and multi-account structure
- Worked with billing, budgets and cost visibility
- Reviewed the support plan tiers
Where the networking background paid off
The networking model transferred directly: VPC CIDR planning, subnet boundaries, route tables, internet-gateway routes and stateful security-group rules. The new work was learning AWS resource boundaries and how those pieces connect.
IAM applied familiar access-control ideas such as users, groups, policies and least privilege through AWS identities and permission policies.
What broke
SSH connection refused after launching an instance
I traced the failed connection through the security-group inbound rule, key-pair permissions and the instance's network placement instead of treating SSH as a single check.
Custom VPC with no route out
The internet gateway was attached, but the subnet's route table had no default route to it. Adding the route made the dependency between subnet association, route table and gateway explicit.
IAM permission denials
I traced which policy, attached at which level, was or was not granting an action, then fixed the denial by narrowing permissions rather than widening them.
Verifying the audit and alerting path
A test event had to be captured and an SNS notification delivered before I treated the alerting path as complete.
Where this connects
These labs inform the MartialXPro scale-out plan: EC2 inside a custom VPC, IAM-scoped access, S3 for generated documents and CloudWatch for visibility. The current product still runs on one Ubuntu host.