AWS From Zero to Deployed

What you will build

Your laptop
   |
   |  1) SSH (port 22) with your private key
   v
EC2 instance (t2.micro, free tier)
   |
   |  2) runs Nginx or your app (port 80 / 8080)
   v
Your browser  <--- http://PUBLIC_IP  ---  anyone on the Internet

By the end you will have: a secured AWS account with MFA and budget alerts; AWS CLI configured on your PC; an EC2 server you can SSH into; a web app serving traffic on a public IP; and a cleanup plan so experiments do not cost money.

1. What you need before starting

No prior cloud or Linux experience is required. Every command is provided.

2. Cloud and AWS in plain English

Traditionally, to run a web app you buy a server, put it in a data center, and pay for it whether you use it or not. Cloud computing means renting computers, storage, and networking over the internet, minute by minute, and paying only for what you use. Amazon Web Services (AWS) is the largest cloud provider.

3. Create your AWS account

1. Open https://aws.amazon.com/free/ (or aws.amazon.com → Create an AWS Account).
2. Enter email → verify with the code AWS sends → password (this is the root account) → account name.
3. Contact information: Personal or Business, full name, phone, country, address.
4. Payment information: card for verification; AWS may place a small temporary authorization hold (refunded).
5. Identity verification: phone OTP by SMS or call.
6. Support plan: choose Basic Support — Free.

Signup flow
    |
    v
Email + password  -->  Contact info  -->  Card  -->  Phone OTP
                                                      |
                                                      v
                                            Support plan (Basic/Free)
                                                      |
                                                      v
                                            Root console access

What happens next

• You land in the AWS Management Console at https://console.aws.amazon.com/.
• Your account has a unique 12-digit Account ID (top-right account menu) — used in ARNs like arn:aws:iam::123456789012:role/....
• New accounts typically get 12 months of selected free-tier usage (e.g. 750 hours/month of t2.micro/t3.micro in most regions). Limits change — bookmark https://aws.amazon.com/free/.

Store root email + password in a password manager immediately. The root user must never be used for daily work.

4. Lock down the root account

The root account = your signup email + password. It can do everything, including deleting your whole account. Secure it before creating anything.

Enable MFA on root — today

1. Log in as root (account email → Root user).
2. Top-right account menu → Security credentials.
3. Multi-factor authentication (MFA) → Assign MFA device.
4. Choose Virtual MFA device → next.
5. Install an authenticator app (Google Authenticator, Authy, Microsoft Authenticator).
6. Scan the QR code → enter two consecutive codes → Activate.

Login:  email + password  +  6-digit code from phone
              \______________/   \___________________/
                   something        something
                     you know         you have

Root hygiene: enable MFA; do not create access keys for root; use root rarely (billing, account close, some support cases); do daily work as IAM.

5. Billing and budgets (do this on day one)

Budgets are your safety net for the day you forget a running server. Nothing in this guide should cost real money if you stay on free-tier shapes and stop or terminate unused resources.

Create a cost budget with alerts

1. Billing → Budgets → Create budget.
2. Choose Use a template → Zero-spend budget or Custom cost budget.
3. Custom example: name monthly-learning, amount $5, alert at 80% and 100% to your email.
4. Confirm email → Create budget.

Spend $0.00          $4.00 (80%)           $5.00 (100%)
   |--------------------|---------------------|
   OK                 Warning email        Critical email
                                          (stop non-free resources)

Free-tier usage alerts

Billing → Preferences → enable Receive Free Tier Usage Alerts → confirm email.

Cost Explorer

Billing → Cost Explorer → enable if prompted. Use later to see which service drove a charge.

The 12-month free tier starts at account creation. Build the habit: stop instances when idle.

6. Console tour: regions, services, CloudShell

Region: us-east-1 (N. Virginia)     <-- pick one and stay there while learning
   |
   +-- AZ: us-east-1a   (data center cluster)
   +-- AZ: us-east-1b
   +-- AZ: us-east-1c

Region selector: top-right of the console. Resources are regional — an EC2 instance in us-east-1 is invisible from eu-west-1. Global services (IAM, Route 53) appear the same from every region.

Services search: top bar — type EC2, IAM, S3…

AWS CloudShell (icon >_ in the top bar): a browser terminal with AWS CLI pre-authenticated as your current console user.

7. Create your daily-use admin identity

Never work as root. Classic beginner path:

1. Search IAM → Users → Create user.
2. Username: admin.
3. Permissions options → Attach policies directly → check AdministratorAccess.
4. Create user → open it → Security credentials → Create access key → use case Command Line Interface (CLI) → Download the .csv (secret shown only once).
5. Also set a console password for this user and assign MFA (same as root).

Root (email + MFA)
  |-- used rarely: billing changes, account close, some support
  |
  +-- IAM user: admin (AdministratorAccess + MFA + CLI access keys)
        |-- daily console + CLI work while learning
        |
        +-- later: narrow policies / roles per project (see IAM guide)

For org-grade access, prefer IAM Identity Center — see the IAM guide.

8. Install the AWS CLI on your PC

aws --version

aws configure
# AWS Access Key ID:     AKIA...   (from the CSV)
# AWS Secret Access Key: wJal...   (hidden while typing)
# Default region name:   us-east-1
# Default output format: json

aws sts get-caller-identity
# Arn should be arn:aws:iam::123456789012:user/admin  (NOT root)

Keys are stored in ~/.aws/credentials — protect this file; never commit it.

9. Mental map of core services

10. Launch your first EC2 instance

EC2 Dashboard → Launch instance. Region top-right must be your chosen one.

Key pair rules

Click "Launch"
     |
     +--> EC2 boots your AMI in the chosen AZ
     +--> AWS attaches an EBS root volume
     +--> Places it in your subnet (private IP)
     +--> With auto-assign public IP: maps a public IPv4
     +--> Security group: only port 22 from your IP so far
     |
     v
Instance state: running    Status checks: 2/2 passed  (wait ~1–3 min)

11. Connect from your PC with SSH

You need five things:

1. Instance running + 2/2 status checks
2. Reachable public IPv4 (console → select instance)
3. Correct username for the AMI
4. Private key matching the key pair
5. Security group allows TCP 22 from your current IP

macOS / Linux

mkdir -p ~/aws-keys
mv ~/Downloads/first-server-key.pem ~/aws-keys/
chmod 400 ~/aws-keys/first-server-key.pem

ssh -i ~/aws-keys/first-server-key.pem ubuntu@3.94.12.34

First connection: type yes to trust the host fingerprint.

Windows (OpenSSH built into 10/11)

mkdir C:\aws-keys
move $env:USERPROFILE\Downloads\first-server-key.pem C:\aws-keys\
icacls C:\aws-keys\first-server-key.pem /inheritance:r /grant:r "$env:USERNAME:R"

ssh -i C:\aws-keys\first-server-key.pem ubuntu@3.94.12.34

PuTTY alternative: convert .pem → .ppk with PuTTYgen.

Success looks like: ubuntu@ip-10-0-1-45:~$ — the 10.x host is the private IP (normal).

12. First ten minutes on the server

Commands assume Ubuntu; on Amazon Linux use sudo dnf update -y instead.

whoami
hostname

sudo apt update
sudo apt upgrade -y
sudo apt install -y curl git jq ufw

# Optional non-root app user
sudo adduser deploy
sudo usermod -aG sudo deploy
echo 'deploy ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/deploy
sudo chmod 440 /etc/sudoers.d/deploy

UFW note

AWS security groups are your primary firewall for this guide. If you enable UFW, allow SSH first or you will lock yourself out:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw --force enable
sudo ufw status

13. Run your first web application

Path A — Nginx static page

sudo apt install -y nginx
sudo systemctl enable --now nginx

echo '<h1>Hello from my first AWS server</h1>' \
  | sudo tee /var/www/html/index.html

curl -I http://localhost
# HTTP/1.1 200 OK

Path B — Node.js app on port 8080

curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

mkdir -p ~/myapp && cd ~/myapp
cat > server.js <<'EOF'
const http = require('http');
const port = process.env.PORT || 8080;
const server = http.createServer((req, res) => {
  res.writeHead(200, { 'Content-Type': 'text/html' });
  res.end(`<h1>It works!</h1><p>Path: ${req.url}</p>`);
});
server.listen(port, '0.0.0.0', () => {
  console.log(`Listening on 0.0.0.0:${port}`);
});
EOF

node server.js
# then in another SSH session or after detaching:
# curl http://127.0.0.1:8080

Keep it running after disconnect

sudo apt install -y tmux
tmux new -s app
node server.js
# Detach: Ctrl+b then d    Reattach: tmux attach -t app

14. Open the app to the world (ports and security groups)

Add inbound rule: EC2 → Instances → select server → Security tab → security group → Edit inbound rules → HTTP, source Anywhere-IPv4 → Save.

Browser  --HTTP:80-->  Public IPv4  --NAT-->  EC2 :80
                           ^
              Security group must allow 80 from 0.0.0.0/0
              (SSH rule stays limited to your IP)

Then open http://<Public IPv4>. If local curl works but the browser fails: security group, app bind address, then UFW — in that order.

15. Port forwarding explained

For private services (databases, internal dashboards), tunnel through SSH instead of opening ports to the internet.

Local port forwarding (most common)

# On YOUR laptop:
ssh -i ~/aws-keys/first-server-key.pem \
    -L 8080:127.0.0.1:8080 \
    ubuntu@3.94.12.34

# Then browse: http://127.0.0.1:8080

Laptop browser: http://127.0.0.1:8080
        |
        v
Local port 8080  ===SSH tunnel===  EC2  -->  app on server 127.0.0.1:8080

Forward to a private database

ssh -i key.pem -L 15432:10.0.3.25:5432 ubuntu@BASTION_PUBLIC_IP
psql -h 127.0.0.1 -p 15432 -U appuser appdb

Remote forwarding (reverse)

ssh -i key.pem -R 9000:127.0.0.1:3000 ubuntu@SERVER
# On server: curl http://127.0.0.1:9000 reaches your laptop's :3000

Session Manager alternative

No open port 22, no key on disk — attach instance profile with AmazonSSMManagedInstanceCore, then:

aws ssm start-session --target i-0123456789abcdef0

16. Elastic IPs and stable addresses

A normal public IPv4 changes on stop/start. An Elastic IP is static and reassignable.

1. EC2 → Elastic IPs → Allocate Elastic IP address.
2. Select → Associate → choose first-server.

17. Storage and snapshots

Instance lifecycle
   running <----start---- stopped
      |                    |
   reboot              EBS volume persists
      |                    |
      +---- terminate --> volume deleted (default)

Snapshots are point-in-time EBS backups (EC2 → Volumes → Create snapshot). Take one before big upgrades; delete old experiment snapshots (they cost money). Instance store (local NVMe on some types) is ephemeral — never your only copy of data.

18. Monitoring and billing checks while you work

EC2 → Monitoring tab: CPU, network, disk, status checks (free basic metrics). CloudWatch is the service behind these.

Weekly cost check (2 minutes): Billing Dashboard → month-to-date; Cost Explorer group by Service; stop forgotten Running instances; release unattached Elastic IPs; prune EBS snapshots.

19. Deploying updates to your app

20. What you built: architecture recap

+---------------- AWS Account (12-digit ID) ----------------+
|  Root (MFA)          IAM admin user (MFA, CLI keys)      |
|  Budgets: $5 alert   Free-tier email alerts               |
|                                                           |
Region (e.g. us-east-1)                                     |
  +-- Default VPC                                           |
  |     +-- Public subnet                                   |
  |           +-- EC2 t3.micro "first-server"               |
  |                 AMI: Ubuntu 24.04                       |
  |                 EBS gp3 root volume                     |
  |                 Public IPv4 (or Elastic IP)             |
  |                 SG: 22 from YourIP, 80 from Anywhere    |
  |                 App: Nginx :80  or  Node :8080          |
  |                 SSH key pair on your laptop             |
  +-- (unused for now: S3, RDS, ALB, multi-AZ...)

You now understand the entire beginner loop: account → identity → budget → server → key → firewall → app → port → browser.

21. Stop vs terminate: avoiding surprise bills

End of day:       Stop instance   ->  pay only for EBS pennies
End of project:   Terminate + cleanup  ->  pay ~zero

22. Cleanup checklist

• EC2 → Instances → Terminate all learning instances.
• Release unassociated Elastic IPs.
• Delete orphaned volumes (state “available”).
• Delete old experiment snapshots.
• Delete key pairs for terminated instances.
• Delete unused security groups (keep default).
• Review IAM users / rotate or delete stale keys.
• Keep the budget — it protects future work.
• Delete local .pem files for instances that no longer exist.

23. Troubleshooting common errors

Three diagnostic commands (memorize)

# On your laptop
aws sts get-caller-identity
curl https://checkip.amazonaws.com

# On the server
ss -tulpn

24. What is free and what is not

Verify current terms at https://aws.amazon.com/free/.

Common beginner bill sources
  EC2 left running            ████████████
  EBS volumes/snapshots       ████
  Public IPv4 charges         ██
  NAT/ALB (if you "advance")  ██████████

Rule of thumb: if you did not click “launch” on it this week, it should not be Running.

25. Where to go next

This guide (account + first server + first app)
        |
        v
EC2 guide (production patterns, Session Manager)
        |
        +--> VPC guide --> ALB/ASG
        +--> IAM guide (roles, boundaries)
        +--> S3 + RDS + HTTPS guides
        |
        v
CI/CD to AWS  +  backups/alerts

26. Final beginner checklist

• AWS account created; card verified; root password in a password manager.
• MFA enabled on root.
• Budget + free-tier email alerts enabled; test that emails arrive.
• IAM admin user with MFA + CLI access keys stored safely.
• AWS CLI installed; aws sts get-caller-identity shows the IAM user.
• Region chosen and consistent.
• EC2 launched: free-tier type, key pair (chmod 400), SG = SSH from My IP.
• SSH works; packages updated.
• Web app runs bound to 0.0.0.0.
• SG allows HTTP as needed; page loads via public IP.
• Understood port forwarding for private services.
• Instance stopped at end of day; terminate + cleanup when done.
• Billing dashboard checked after first day of experiments.