C19 — Crunch AWS · Amazon Web Services Engineering

§ I · The Program

Engineering that happens to use AWS.

Crunch AWS is the Amazon Web Services specialization of the Code Crunch academy — a production-engineering course on the largest public cloud, built for engineers who already write code, already deploy containers, and already know what a route table is. It is not a survey of two hundred services. It is the curriculum a principal would hand a senior engineer joining their AWS shop on day one.

You design a multi-account Organization with SCPs before you launch an EC2 instance. You write IAM policies that pass a code review. You ship containers on EKS with Karpenter Spot nodes and IRSA, and Lambda functions with a CDK pipeline and OpenTelemetry traces. You model a single-table DynamoDB schema for a multi-tenant SaaS, compose an event-driven backbone in EventBridge and Step Functions, and finish with a capstone that survives an AZ failure and a cross-region failover drill. The certs are a side effect.

"Crunch AWS is not AWS certification training. It is engineering training that happens to use AWS. The certs are a side effect."— Crunch AWS, course README

§ II · Who It's For

Four engineers, one console.

AWS is opinionated about its audience. C1 (Convos) plus C15 (DevOps) is the floor — you should already write Python, already deploy containers, and already have a Terraform module library you trust.

No. 01

The Python Developer

Ships FastAPI services. Has an EC2 instance they SSH into. Wants to stop SSHing and start designing — IAM, VPCs, Lambda, EventBridge, DynamoDB single-table, CDK — and own a deployable, observable platform.

No. 02

The SRE on Cert Track

Knows Linux, k8s, Terraform. Wants depth on EKS production patterns, multi-account governance with Organizations and SCPs, permission boundaries, cross-region DR, and to walk into a SAP or DOP interview not guessing.

No. 03

The Mobile / Web Dev

Ships iOS, Android, or Next.js apps and rents a backend from Firebase or a friend. Wants to own it — Cognito, S3 + CloudFront, SNS, a Lambda-and-DynamoDB API — for $40 a month and an AZ outage survived.

No. 04

The Mid Backend Engineer

Has "used AWS" for years. Copy-pastes IAM JSON. Does not actually understand sts:AssumeRole chains, permission boundaries, or session policies. Week 2 alone is worth the cost of admission.

§ III · Four Phases

From identity to capstone.

The arc of the program is composed in four phases — three to four weeks each — ordered on one conviction: IAM and networking before compute, single-table before serverless, observability before "more services."

Phase I · Wk. 01—03

Foundations & Identity

The AWS mental model. Accounts, Organizations, OUs, SCPs. IAM in depth — users, roles, policies, conditions, permission boundaries, AssumeRole chains. Identity Center for humans. Billing as a feature. CDK bootstrap.

Phase II · Wk. 04—07

Compute & Networking

Production VPCs with endpoints and PrivateLink. EC2 → ECS Fargate → EKS, with judgment on which one and why. S3 deep, EBS, EFS, FSx. CodePipeline, CodeBuild, CodeDeploy, ECR with blue/green and OIDC.

Phase III · Wk. 08—11

Data & AI

RDS and Aurora — provisioned, Serverless v2, Global. DynamoDB single-table from scratch. SQS, SNS, EventBridge, Step Functions, Kinesis, MSK. S3 + Glue + Athena data lake. SageMaker training and endpoints, Bedrock managed.

Phase IV · Wk. 12—15

Production & Capstone

OpenTelemetry via ADOT. KMS, GuardDuty, Security Hub, Macie, Inspector, WAF, Shield. Multi-region DR with measured RTO/RPO. FinOps with Savings Plans and Spot. Capstone build, chaos drill, postmortem, career pack.

§ IV · The Curriculum

Fifteen weeks, week by week.

Each entry corresponds to a folder in the GitHub repository with lecture notes, exercises, challenges, a quiz, homework, and a hands-on lab. Detailed acceptance criteria live in the syllabus.

01

The AWS Mental Model, Accounts & Billing

History of AWS as primitives · Region/AZ/edge topology · shared responsibility · Organizations, OUs, SCPs · root hygiene · free tier · Budgets, Cost Explorer, Cost & Usage Reports · CLI, profiles, aws sso login.

Lab 01

Multi-OU Organization + SCP deny + $5/$25/$80 budget alarms

02

IAM Done Right

Users vs roles vs groups vs policies · explicit deny wins · condition keys · permission boundaries · session policies · sts:AssumeRole chains · cross-account trust · Access Analyzer.

Lab 02

Three-account topology with Identity Center + permission boundary proof

03

CDK, CloudFormation & Local Tooling

CloudFormation as substrate · CDK (TS + Python) constructs L1/L2/L3 · cdk bootstrap · CDK pipelines · drift · SAM · LocalStack, dynamodb-local, MinIO for local dev.

Lab 03

VPC + KMS-encrypted S3 + Lambda in CDK TS, then Python, then OpenTofu

04

VPC, Networking & Edge

CIDR planning · public/private/isolated subnets · NAT vs Egress-only IGW · Security Groups vs NACLs · VPC endpoints (gateway + interface) · PrivateLink · TGW · Route 53 · CloudFront · ACM · WAF · Shield.

Lab 04

Three-AZ VPC with endpoints — prove zero-NAT egress to S3 and ECR

05

Compute Spectrum: EC2 → ECS Fargate → EKS

EC2 instance families · ASG, launch templates, Spot · ECS Fargate vs EKS · managed node groups, Karpenter, Fargate profiles, IRSA, ALB Controller, External DNS, EBS CSI · AWS Batch.

Lab 05

Same FastAPI app on Fargate, on EKS with Karpenter Spot, and on Lambda — cost-vs-latency doc

06

Storage: S3, EBS, EFS, FSx

S3 storage classes · lifecycle · intelligent tiering · object lock · versioning · SRR/CRR · Object Lambda · presigned URLs · EBS gp3/io2 · EFS · FSx Lustre/Windows/ONTAP · MinIO, Ceph, JuiceFS comparators.

Lab 06

Lifecycle bucket + CRR + Object-Lambda watermark + EFS shared mount

07

CI/CD on AWS: CodeBuild, CodePipeline, CodeDeploy, ECR

CodeBuild buildspec · multi-arch linux/arm64 for Graviton · CodePipeline approvals · CodeDeploy blue/green · ECS deployment groups · Lambda traffic shifting · ECR scanning · GitHub Actions OIDC into AWS.

Lab 07

Blue/green ECS pipeline with 10% canary + auto-rollback, then OIDC replica

08

Relational: RDS, Aurora, Aurora Serverless v2

RDS vs Aurora storage · read replicas · ACU math · Performance Insights · RDS Proxy · IAM database auth · PITR · cross-region snapshots · Aurora Global Database · Patroni HA & Citus comparators.

Lab 08

Aurora Postgres writer + 2 readers, force failover, then convert to Serverless v2

09

DynamoDB & Single-Table Design

Partition + sort keys · single-table pattern · GSIs vs LSIs · sparse indexes · write-sharding for hot partitions · TTL · Streams → Lambda · transactions · on-demand vs provisioned · Global Tables · DAX.

Lab 09

Multi-tenant SaaS single-table — hot-partition stress test + sharding fix

10

Event-Driven: SQS, SNS, EventBridge, Step Functions, Kinesis, MSK

SQS standard vs FIFO · DLQs · SNS fan-out · EventBridge buses, archive, replay, pipes · Step Functions Standard vs Express · Kinesis shards & KCL · MSK managed Kafka · NATS & Temporal comparators.

Lab 10

API → Lambda → EventBridge → (SQS + Step Functions + Firehose) order pipeline, with DLQ replay

11

Data Lake & AI: S3 + Athena + Glue, OpenSearch, SageMaker, Bedrock

Glue Catalog & Crawlers · Athena partitioning & Parquet · Lake Formation row/column security · OpenSearch managed and Serverless · SageMaker training on Spot · real-time/serverless/async endpoints · Bedrock as a router.

Lab 11

Firehose → Glue → Athena (Parquet) + a SageMaker endpoint vs a Bedrock Claude Haiku call

12

Observability: CloudWatch, X-Ray, OpenTelemetry, ADOT

Log groups, Logs Insights, embedded metric format · composite & anomaly alarms · Synthetics canaries · RUM · X-Ray service maps · ADOT collector on EKS & Lambda · Container Insights · burn-rate alarms on a 99.9% SLO.

Lab 12

Add OpenTelemetry to the Week-10 pipeline + burn-rate alarm fires on synthetic outage

13

Security Stack & Multi-Region DR — Capstone build begins

KMS CMKs · key policies vs grants · multi-region keys · Secrets Manager vs SSM · GuardDuty · Security Hub · Macie · Inspector · Network Firewall · WAF managed rules · Shield Advanced · ACM Private CA · Aurora Global · DynamoDB Global Tables · Route 53 failover.

Lab 13

Org-wide GuardDuty + DynamoDB Global Tables + Aurora cross-region + manual failover

14

FinOps, Edge & Capstone build continues

Savings Plans vs RIs · Spot interruption handling · Compute Optimizer · Graviton arm64 savings · Cost & Usage Report → Athena → QuickSight · anomaly detection · tag-based allocation · CloudFront Functions vs Lambda@Edge · origin failover.

Lab 14

CloudFront + WAF + Lambda@Edge tenant routing, plus a QuickSight cost dashboard

15

Capstone Defense, Chaos Drill & Career Pack

Chaos drill — AZ failover, DynamoDB throttle, Lambda concurrency exhaustion, NAT saturation, CloudFront origin failure · blameless postmortem · SAP/DOP cert-prep mapping · system-design interview drills (FAANG & AWS-shop variants).

Capstone

Event-Driven SaaS Backbone — 30-min oral defense + 10-min public walkthrough

§ V · The Toolchain

Vendor-aware, not vendor-loyal.

Every AWS-native primitive below is shadowed by its open-source equivalent. You will leave knowing which trade-off you took, and why.

Containers

EKS · Karpenter · IRSA

k8s done the AWS way

Serverless

Lambda · Powertools

cold-start budgets, layers

Database

DynamoDB · single-table

Streams + Global Tables

Storage

S3 · lifecycle · CRR

treat it like a database

Events

EventBridge · pipes

archive & replay spine

Orchestration

Step Functions · Express

workflows that survive

IaC

CDK · CloudFormation

TypeScript + Python

ML

SageMaker · Bedrock

train, deploy, route

Tracing

OpenTelemetry · ADOT

vendor-neutral instrumentation

Monitoring

CloudWatch · X-Ray

logs, metrics, traces, alarms

Crypto

KMS · Secrets Manager

envelope encryption, rotation

Edge

WAF · Shield · CloudFront

L7 defense + edge logic

§ VI · Skills You Will Carry

What you walk away with.

By the end of Week 15, you are able to do each of the following — credibly, in a real design review, in front of a senior reviewer.

Design a multi-account AWS Organization with SCPs, OUs, dev/stage/prod isolation, and Identity Center for human access.
Write IAM policies that pass a code review — least-privilege, conditions, permission boundaries, AssumeRole chains.
Build production VPCs: multi-AZ subnets, NAT strategy, TGW hub-and-spoke, PrivateLink, VPC endpoints, SG vs NACL.
Run EKS in production with IRSA, Karpenter Spot autoscaling, ALB ingress, Container Insights, blue/green rollouts.
Design DynamoDB single-table schemas with GSIs, sparse indexes, write-sharding, Streams fan-out, and real cost math.
Compose event-driven systems with EventBridge, SQS, SNS, Step Functions Express/Standard, Kinesis, and MSK.
Ship serverless properly — concurrency, cold-start budgets, Powertools, Lambda@Edge, and a SAM/CDK pipeline.
Run AWS as code with CDK (TypeScript + Python), drift detection, OpenTofu for cross-cloud, and CodePipeline delivery.
Observe a system end-to-end with CloudWatch, X-Ray, OpenTelemetry via ADOT, Synthetics, and a cost-aware metric budget.
Harden production: KMS rotation, Secrets Manager, GuardDuty, Security Hub, Macie, Inspector, WAF, Shield, Network Firewall.
Plan multi-region DR with Aurora Global, DynamoDB Global Tables, Route 53 failover, S3 CRR, and proven RTO/RPO.
Apply FinOps — Savings Plans, Spot, Compute Optimizer, anomaly detection, per-team unit-economics dashboards.
Train, deploy, and route to a SageMaker real-time endpoint, then defend it against a Bedrock managed alternative.
Run a real chaos drill — AZ failover, hot-partition throttle, Lambda concurrency exhaustion — and write the postmortem.
Write a production runbook another on-call engineer can read at 3 AM.
Walk into a SAP, DOP, or AWS-shop system-design interview and not be guessing.

§ VII · The Capstone

One backbone. Shipped, signed, observed.

Weeks 13 through 15 are reserved for a single substantial system — the kind a real product team would scope across a quarter. Architecture diagrams, live deploy, video walkthrough, chaos-drill postmortem.

Capstone Brief

Event-Driven SaaS Backbone

Build a hybrid event-driven backbone: EKS with Karpenter Spot for the long-running tier, Lambda + Step Functions for the event-handler tier, ECS Fargate for one stateful sidecar — all behind a single CloudFront distribution. EventBridge as the spine, with SQS for retry, Kinesis Firehose to S3, DynamoDB single-table for transactional state, Aurora Postgres (multi-AZ + cross-region) for analytics, and a SageMaker real-time endpoint for inference. CDK IaC, OpenTelemetry tracing, multi-AZ + cross-region from day one. All tiers come from your code.

CDK monorepo (TypeScript primary, one stack in Python) deploying the entire system with cdk deploy --all, plus GitHub Actions OIDC.
DynamoDB single-table with Streams → Lambda fan-out, plus Aurora Postgres with a cross-region read replica.
SageMaker real-time endpoint called from Lambda, with a parallel Bedrock-Claude call benchmarked for cost & latency.
OpenTelemetry via ADOT to X-Ray and CloudWatch, with a 99.9% SLO and a 1-hour / 6-hour burn-rate alarm.
Multi-region DR with DynamoDB Global Tables, Aurora cross-region read replica, S3 CRR, and Route 53 health-checked failover. RTO and RPO documented and proven.
Chaos drill: AZ failover, DynamoDB hot-partition throttle, Lambda concurrency exhaustion, plus one of your choice — blameless postmortem with action items.
A 10-minute public video walkthrough, a runbook another engineer can read at 3 AM, and a tagged dollar-number cost report for one week of operation.

§ VIII · Getting Started

Three commands. Then begin.

The setup is intentionally lightweight. If you have a laptop, a terminal, and an AWS account you control, you can begin Week 1 today. The first two weeks fit inside the free tier.

# 1. Clone the curriculum repository
git clone https://github.com/CODE-CRUNCH-WORLDWIDE/C19-CRUNCH-AWS.git
cd C19-CRUNCH-AWS

# 2. Configure AWS (SSO recommended; static keys discouraged)
aws configure sso                                       # Identity Center — preferred
aws configure --profile c19-dev                          # static keys — sandbox only

# 3. Optional — run locally with LocalStack to keep the bill at $0
docker run -p 4566:4566 localstack/localstack            # S3, DynamoDB, Lambda, SQS, SNS, Step Functions

# 4. Open Week 1 README and begin
$EDITOR curriculum/week-01-foundations/README.md

Worried about the bill? The entire course runs against LocalStack + MinIO + dynamodb-local + KinD for $0 — see the README for the LocalStack-only path.

§ IX · Frequently Asked

Questions, anticipated.

Designed for under $80 total if you follow the rules. Weeks 1–7 fit inside the free tier for most services. EKS work is concentrated into a two-week burst with a nightly cdk destroy. We use Spot on every stateless worker (60–85% savings), VPC endpoints to avoid the silent NAT-Gateway bill, and configure $5 / $25 / $80 Budget alarms in Week 1. If cost is a hard blocker, the entire course can run against LocalStack + MinIO + dynamodb-local + KinD for $0.

§ X · Begin

Fifteen weeks from now,
you will have shipped a backbone.

Open the repository. Read Week 1. The console is yours.

Read the Course →All Labs tracks ↩

Crunch AWS.