Get oriented in AWS: understand IAM users, roles, and policies; set up the AWS CLI; and configure your first environment.
AWS is where production AI runs. S3 stores your training data and model artifacts. App Runner deploys your API containers. RDS holds your application data. Once you learn the core services, everything else becomes configuration.
This course teaches the services you'll actually use: IAM, S3, App Runner, RDS, Route 53, ACM, and CloudFront. No certifications, no theory — just deployments.
IAM controls who can do what in your AWS account. Every API call requires credentials from either a user or a role. Get this wrong and you either lock yourself out or create a security hole.
Go to IAM → Users → Create User. Give it a name like cli-user, enable programmatic access, and attach the policies you need. For this course: AmazonS3FullAccess, AWSAppRunnerFullAccess, AmazonRDSFullAccess, AmazonECR_FullAccess.
# Install (macOS) brew install awscli # Install (Linux) curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" unzip awscliv2.zip && sudo ./aws/install # Configure aws configure
Enter your Access Key ID, Secret Access Key, default region (use us-east-1 to start), and output format (json).
aws sts get-caller-identity # Should return your account ID and user ARN aws s3 ls # Lists your S3 buckets (empty for new accounts)
AWS runs in ~30 regions worldwide. Each region is isolated — resources in us-east-1 are not visible from eu-west-1. Choose a region and stay consistent. For US customers, us-east-1 (N. Virginia) has the most services and lowest latency to the internet backbone.
export AWS_DEFAULT_REGION=us-east-1 to your shell profile so you don't have to pass --region on every command.Users have long-lived credentials (access keys) that you manage. Roles have temporary credentials that AWS services assume automatically. When your App Runner service needs to pull from ECR, it assumes a role — it doesn't use your personal credentials.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"Service": "build.apprunner.amazonaws.com"
},
"Action": "sts:AssumeRole"
}]
}
aws configure with the new credentialsaws sts get-caller-identityaws ec2 describe-regions --output table to see all available regionsAWS_DEFAULT_REGION in your shell profileThe foundations from today carry directly into Day 2. In the next session the focus shifts to Day 2 — building directly on everything covered here.
Before moving on, verify you can answer these without looking:
Live Bootcamp
Learn this in person — 2 days, 5 cities
Thu–Fri sessions in Denver, Los Angeles, New York, Chicago, and Dallas. $1,490 per seat. June–October 2026.
Reserve Your Seat →