Fundamentos de AWS | Zerionis Learn

Qué es AWS What is AWS

Amazon Web Services es la plataforma de cloud computing más grande del mundo. Ofrece 200+ servicios que van desde servidores virtuales hasta inteligencia artificial. En lugar de comprar y mantener hardware físico, rentas recursos por demanda y pagas solo lo que usas. Amazon Web Services is the world's largest cloud computing platform. It offers 200+ services ranging from virtual servers to artificial intelligence. Instead of buying and maintaining physical hardware, you rent resources on demand and pay only for what you use.

ModeloModel	Qué significaWhat it means	EjemploExample
IaaS	Te dan la máquina, tú instalas todo.They give you the machine, you install everything.	EC2, VPC
PaaS	Plataforma lista, tú solo subes código.Platform ready, you just upload code.	Elastic Beanstalk
SaaS	Todo listo, solo lo usas.Everything ready, just use it.	WorkSpaces, Chime

RegiónRegion

Área geográfica independiente con múltiples data centers. Ejemplo: us-east-1, eu-west-1. Los datos no se replican entre regiones automáticamente.Independent geographic area with multiple data centers. Example: us-east-1, eu-west-1. Data doesn't replicate between regions automatically.

Availability Zone (AZ)

Cada región tiene 2–6 AZs. Cada AZ es un data center físicamente separado. Multi-AZ = alta disponibilidad.Each region has 2–6 AZs. Each AZ is a physically separate data center. Multi-AZ = high availability.

🔐 IAM: Identidad y AccesoIdentity & Access

Controla quién puede hacer qué en tu cuenta AWS. Cuatro conceptos fundamentales: Controls who can do what in your AWS account. Four fundamental concepts:

ConceptoConcept	Qué esWhat it is
User	Persona o app con credenciales propiasPerson or app with its own credentials
Group	Colección de usuarios con mismos permisosCollection of users with the same permissions
Role	Identidad temporal que un servicio puede asumirTemporary identity a service can assume
Policy	Documento JSON que define qué se permite o deniegaJSON document defining what is allowed or denied

Best practices

Nunca usar el usuario root. Privilegio mínimo. Preferir roles sobre access keys. Rotar credenciales. Activar MFA.Never use root user. Least privilege. Prefer roles over access keys. Rotate credentials. Enable MFA.

🌐 VPC: Tu red privada en la nubeYour private cloud network

Una VPC es tu red aislada dentro de AWS. Defines el rango de IPs (CIDR), la divides en subnets públicas y privadas, y controlas el tráfico con Security Groups y NACLs. A VPC is your isolated network within AWS. You define the IP range (CIDR), divide it into public and private subnets, and control traffic with Security Groups and NACLs.

Subnet públicaPublic subnet

Tiene Internet Gateway. Para ALBs, bastion hosts, NAT Gateways.Has Internet Gateway. For ALBs, bastion hosts, NAT Gateways.

Subnet privadaPrivate subnet

Sin acceso directo a internet. Para app servers, bases de datos. Sale a internet vía NAT Gateway.No direct internet access. For app servers, databases. Reaches internet via NAT Gateway.

Security Groups	NACLs
Stateful, nivel instancia, solo AllowStateful, instance-level, Allow only	Stateless, nivel subnet, Allow + DenyStateless, subnet-level, Allow + Deny

⚡ CómputoCompute

Cuatro formas de correr código en AWS, cada una con un nivel diferente de control:Four ways to run code on AWS, each with a different level of control:

ServicioService	Qué esWhat it is	Ideal paraIdeal for
EC2	Servidores virtuales que tú gestionasVirtual servers you manage	Control total, apps legacyFull control, legacy apps
Lambda	Funciones serverless por eventoServerless event-driven functions	APIs ligeras, webhooks, procesos <15minLight APIs, webhooks, processes <15min
ECS/Fargate	Contenedores orquestados. Fargate = serverlessOrchestrated containers. Fargate = serverless	Microservicios, apps containerizadasMicroservices, containerized apps
App Runner	Deploy automático desde imagen o códigoAuto deploy from image or code	Deploy rápido sin config de infraQuick deploy without infra config

Auto Scaling

EC2 Auto Scaling Groups ajustan automáticamente la cantidad de instancias según métricas (CPU, requests). Defines mínimo, máximo y deseado.EC2 Auto Scaling Groups automatically adjust instance count based on metrics (CPU, requests). You define minimum, maximum, and desired.

💾 Almacenamiento (S3)Storage (S3)

S3 es almacenamiento de objetos infinito. Cada objeto vive en un bucket con un key único. Soporta versionado, lifecycle rules, presigned URLs y políticas de acceso.S3 is infinite object storage. Each object lives in a bucket with a unique key. Supports versioning, lifecycle rules, presigned URLs, and access policies.

ClaseClass	Costo/GBCost/GB	AccesoAccess
Standard	$0.023	InmediatoInstant
Infrequent Access	$0.0125	Inmediato, cargo por lecturaInstant, retrieval fee
Glacier Instant	$0.004	MilisegundosMilliseconds
Glacier Deep Archive	$0.00099	12–48h

🗄️ Bases de datosDatabases

RDS / Aurora

Bases de datos relacionales administradas (PostgreSQL, MySQL, etc). Backups automáticos, Multi-AZ, Read Replicas. Aurora es 3–5x más rápido con storage auto-escalable hasta 128TB.Managed relational databases (PostgreSQL, MySQL, etc). Automatic backups, Multi-AZ, Read Replicas. Aurora is 3–5x faster with auto-scaling storage up to 128TB.

ElastiCache

Cache en memoria administrado: Redis (estructuras avanzadas, persistencia, Pub/Sub) o Memcached (simple key-value, multi-threaded).Managed in-memory cache: Redis (advanced structures, persistence, Pub/Sub) or Memcached (simple key-value, multi-threaded).

🔀 Load Balancing y API GatewayLoad Balancing & API Gateway

ServicioService	CapaLayer	Ideal paraIdeal for
ALB	Layer 7 (HTTP/S)	Routing por path, host, headers. EC2/ECSRouting by path, host, headers. EC2/ECS
NLB	Layer 4 (TCP/UDP)	Ultra-baja latencia, millones de conexionesUltra-low latency, millions of connections
API Gateway	Layer 7	Lambda backends, auth, caching, throttlingLambda backends, auth, caching, throttling

📨 Mensajería y EventosMessaging & Events

SQS

Cola de mensajes para procesamiento asíncrono. Desacopla servicios. Standard (ilimitado, at-least-once) o FIFO (300 msg/s, exactly-once, orden estricto).Message queue for async processing. Decouples services. Standard (unlimited, at-least-once) or FIFO (300 msg/s, exactly-once, strict order).

EventBridge

Bus de eventos serverless. Pub/sub con reglas de routing, filtrado por contenido y scheduling (cron). Diferente a SQS: es fan-out, no punto a punto.Serverless event bus. Pub/sub with routing rules, content filtering, and scheduling (cron). Different from SQS: fan-out, not point-to-point.

🚀 CI/CD

Pipeline completo en AWS: push a Git → CodeBuild (test, build, docker push) → ECR (registry de imágenes) → CodeDeploy (deploy blue/green a ECS) — todo orquestado por CodePipeline.Full pipeline on AWS: Git push → CodeBuild (test, build, docker push) → ECR (image registry) → CodeDeploy (blue/green deploy to ECS) — all orchestrated by CodePipeline.

🌍 DNS, CDN & DistribuciónDistribution

Route 53

DNS administrado con routing inteligente: Simple, Weighted (canary), Latency-based, Failover, Geolocation, Multi-value.Managed DNS with intelligent routing: Simple, Weighted (canary), Latency-based, Failover, Geolocation, Multi-value.

CloudFront

CDN global con 400+ edge locations. Cachea contenido cerca del usuario. Soporta S3, ALB, EC2, API Gateway como origin.Global CDN with 400+ edge locations. Caches content near users. Supports S3, ALB, EC2, API Gateway as origin.

📊 ObservabilidadObservability

CloudWatch

Métricas, logs centralizados, alarmas (umbrales → notificaciones) y dashboards personalizados.Metrics, centralized logs, alarms (thresholds → notifications), and custom dashboards.

CloudTrail

Auditoría de cada llamada API: quién hizo qué, cuándo, desde dónde. Esencial para compliance (SOC2, HIPAA, PCI).Audit log of every API call: who did what, when, from where. Essential for compliance (SOC2, HIPAA, PCI).

🛡️ Seguridad avanzadaAdvanced Security

ServicioService	Qué haceWhat it does
WAF	Firewall HTTP: reglas OWASP, rate limiting, geo-blocking. Protege ALB, API Gateway, CloudFront.HTTP firewall: OWASP rules, rate limiting, geo-blocking. Protects ALB, API Gateway, CloudFront.
Shield	Protección DDoS. Standard (gratis, L3/L4). Advanced ($3k/mes, L7, equipo 24/7).DDoS protection. Standard (free, L3/L4). Advanced ($3k/mo, L7, 24/7 team).
Secrets Manager	Almacena passwords y API keys con rotación automática.Stores passwords and API keys with automatic rotation.
Parameter Store	Configuración general (feature flags, URLs, settings).General configuration (feature flags, URLs, settings).

📝 Infrastructure as Code

Define tu infraestructura en código (YAML/JSON) y deja que AWS la cree, actualice y destruya en orden correcto.Define your infrastructure in code (YAML/JSON) and let AWS create, update, and destroy it in the correct order.

CloudFormation	Terraform
AWS nativo, YAML/JSON, solo AWSAWS native, YAML/JSON, AWS only	Multi-cloud, HCL, mejores módulosMulti-cloud, HCL, better modules

🏛️ Arquitectura de referenciaReference Architecture

App web moderna en AWS — capas típicas de una arquitectura de producción:Modern web app on AWS — typical layers of a production architecture:

Capas de la arquitectura Architecture layers

Usuario → Route 53 → CloudFront + S3 (frontend)
            → API Gateway / ALB + WAF (entry point)
            → ECS Fargate (app tier)
            → RDS Aurora + ElastiCache + S3 (data tier)
            → Cognito (auth)
            → EventBridge → Lambda / SQS (async)
            → CloudWatch / CloudTrail / X-Ray (observability)
            → CodeBuild → ECR → CodeDeploy (CI/CD)

Costo estimado Estimated cost

Esta arquitectura completa cuesta aproximadamente $150–200 USD/mes para tráfico moderado.This complete architecture costs approximately $150–200 USD/month for moderate traffic.