AWS fundamentals: global infrastructure and Well-Architected
Region, Availability Zone, edge location, the shared responsibility model and the 6 Well-Architected pillars: the framework for reading every architecture question.
- DomainResilient architectures
- DomainHigh-performing architectures
- DomainSecure architectures
- DomainCost-optimized architectures
- 10 diagrams
- 9 scenarios
- 10 services
5-minute essentials
- A Region is an independent geographic area; each Region has at least 3 Availability Zones (AZ).Data never leaves a Region on its own. Pick a Region by 4 criteria: compliance / data residency, latency to users, services available in that Region, price.
- An AZ is one or more data centers with separate power, networking and cooling; the AZs in a Region are linked by a private low-latency network.Tolerating one AZ failure = run in at least 2 AZs. Tolerating a whole-Region failure (disaster, legal requirement) = multiple Regions.
- An AZ name (us-east-1a) can point to different physical locations across older accounts; an AZ ID (use1-az1) is the same in every account.When coordinating multiple accounts (e.g. co-locating with shared subnets, PrivateLink), compare by AZ ID.
- Edge locations (CloudFront points of presence) greatly outnumber Regions; Route 53, CloudFront, Global Accelerator, WAF and Shield run at the edge.To cut latency for global users without opening more Regions: move content / connections to the edge.
- Local Zone: AWS infrastructure placed near a large city, connected to its parent Region; Wavelength: infrastructure inside a carrier's 5G network; Outposts: AWS hardware placed in your own data center.Single-digit ms latency for users in one city → Local Zone; 5G mobile apps → Wavelength; data must stay on-prem but you want AWS APIs → Outposts.
- Shared responsibility model: AWS secures the cloud itself (infrastructure, hardware, facilities); you secure what you put IN the cloud.Your share changes by service: on EC2 you patch the guest OS; on RDS / S3 / Lambda AWS patches the platform, but you still own data, encryption, IAM and network configuration.
- Well-Architected has 6 pillars: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability.SAA questions are often "meet requirement X with the least cost / operational effort": read the requirement pillar by pillar to eliminate answers.
- Scale up (vertical) = a bigger machine, limited and usually requires a stop; scale out (horizontal) = more machines behind a load balancer, practically unlimited.The answer to "handle traffic spikes with no downtime" is almost always scale out with Auto Scaling.
- High availability (less downtime) differs from fault tolerance (no interruption) and from disaster recovery (recovering after a major incident).Exams use exact wording: "must not be interrupted" needs redundancy running in parallel; "recover within 4 hours" is a DR problem with RTO/RPO.
- Prefer managed / serverless services when the question stresses "reduce operational burden".If both meet the requirement, the answer using RDS, Lambda, Fargate or DynamoDB usually beats the one self-installed on EC2.
- Data into AWS from the internet is free; data out to the internet and between AZs is charged.Multi-AZ architectures incur data transfer costs; serving static content through CloudFront is usually cheaper than serving it straight from EC2.
- Service Quotas (limits) are per Region and account; many limits can be raised on request.A question may ask why you cannot create more resources: you hit a quota, not an IAM error.
- AWS Health Dashboard reports events affecting your own account; Trusted Advisor checks configuration for cost, security, performance, limits and fault tolerance.To be notified automatically when AWS performs maintenance on the hardware running your EC2: Health event → EventBridge.
Diagrams
Region, Availability Zone and edge location
Step by step
- AZs in a Region are linked by a private network; if one AZ fails, the others keep running.
- Users hit the nearest edge location (CloudFront, Route 53), then travel over the AWS network to the Region.
AZ names vs AZ IDs across two accounts
Step by step
- A's us-east-1a is use1-az1, but B's us-east-1a is use1-az4.
- To target the same physical place: compare AZ IDs, not names.
Edge location and regional edge cache
Step by step
- Users reach the nearest edge location; on a cache hit it responds immediately.
- On a cache miss: ask the regional edge cache, and only finally the origin.
Local Zone, Wavelength and Outposts
Step by step
- Local Zone: EC2, EBS, etc. placed near a large city, connected to the parent Region.
- Wavelength: infrastructure inside the carrier's 5G network.
- Outposts: AWS hardware in your data center, managed from the Region over a service link.
Shared responsibility by service type
Step by step
- EC2: you patch the guest OS, configure Security Groups, encrypt data.
- RDS: AWS patches the OS and engine; you handle data, permissions, networking, enabling backups.
- Lambda / S3: AWS handles almost the whole platform; you handle code, data, IAM.
Scale up vs scale out
Step by step
- Scale up: stop the instance, change to a larger type; it has a ceiling and causes downtime.
- Scale out: Auto Scaling adds instances, and the ALB automatically spreads load to the new ones.
Three levels of fault tolerance
Step by step
- The SAA standard: run in parallel across ≥ 2 AZs.
- When the question demands whole-Region fault tolerance or geographic DR: add a second Region.
Where data transfer is charged
Step by step
- Data into AWS from the internet is free; data out to the internet is billed per GB.
- Transfer between AZs is billed in both directions: multi-AZ has a price.
- Content served through CloudFront: cached near users, usually cheaper than serving directly.
Choosing a Region for an application
Step by step
- Compliance is a hard condition: if law keeps data in-country, only use a Region (or Local Zone / Outposts) there.
- If unconstrained: check that the Region nearest users has the services, because not every service exists in every Region.
- When latency is equal, price decides: the same instance type can cost differently across Regions.
Global, Region and AZ scoped services
Step by step
- Global services: create once, use in every Region (IAM users / roles, Route 53 hosted zones, CloudFront distributions).
- Regional services: resources live in one Region; AWS spreads them across multiple AZs inside that Region.
- AZ-scoped resources: an EBS volume attaches only to EC2 in the same AZ; to move AZ, create a snapshot and restore it in another AZ.
Quick comparisons
Infrastructure layers
| Where | Use when | |
|---|---|---|
| Region | Geographic area, ≥ 3 AZs | Default; choose by compliance, latency, services, price |
| Availability Zone | Separate data centers within a Region | Fault tolerance: run in ≥ 2 AZs |
| Local Zone | Near a large city, connected to the parent Region | Very low latency for that city's users (gaming, rendering, livestreaming) |
| Wavelength Zone | Inside a carrier's 5G network | Mobile / IoT apps needing ultra-low latency over 5G |
| Outposts | AWS racks / servers placed in your data center | Data must stay on-prem, local processing needed, but with AWS APIs |
| Edge location | CloudFront points of presence worldwide | Content caching, DNS, DDoS protection, connection acceleration |
Responsibility by service type
| Task | EC2 (IaaS) | RDS (managed) | Lambda / S3 (serverless) |
|---|---|---|---|
| Patching the operating system | You | AWS | AWS |
| Patching the database engine | You (if self-installed) | AWS (in the maintenance window you choose) | Not applicable |
| Security group / networking | You | You | You (Lambda's VPC, if used) |
| Data encryption, backups | You | You enable, AWS performs | You configure |
| IAM, who can access | You | You | You |
| Hardware, data centers | AWS | AWS | AWS |
The 6 Well-Architected pillars
| Pillar | Key question | Exam keywords |
|---|---|---|
| Operational excellence | How do you run, monitor and improve? | IaC, automation, runbook, observability |
| Security | How do you protect data and systems? | least privilege, encryption, traceability |
| Reliability | How do you recover from failure? | Multi-AZ, self-healing, backup, DR |
| Performance efficiency | Are you using resources efficiently? | right type, cache, serverless |
| Cost optimization | Are you paying only for what you need? | right-sizing, Savings Plans, Spot, turn off when idle |
| Sustainability | Are you reducing environmental impact? | use fewer resources, managed, Graviton |
HA, fault tolerance and DR
| Goal | Example | |
|---|---|---|
| High availability | Little and short downtime | ALB + Auto Scaling across 2 AZs, RDS Multi-AZ |
| Fault tolerance | No interruption when a component fails | Redundancy running in parallel, Aurora / DynamoDB replicate automatically |
| Disaster recovery | Recover after a major incident per RTO / RPO | Backups to another Region, pilot light, warm standby |
Exam scenarios
1A company must keep EU customer data in the EU by law. How should it choose a Region?
Show answer
Right: Use only Regions in the EU, then choose among them by latency, required services and price
Data never leaves a Region on its own; compliance filters first, the other criteria decide afterwards.
Wrong: Choose the cheapest Region
Compliance is a hard constraint and comes before price.
Wrong: Choose the Region closest to company headquarters
Headquarters location has nothing to do with the data residency requirement.
2A web application must keep running when one data center loses power, at reasonable cost.
Show answer
Right: ALB + Auto Scaling spread across ≥ 2 AZs, Multi-AZ database
Each AZ is an independent data center in the same Region; this is the standard and cheapest level of fault tolerance.
Wrong: A larger EC2 instance
Still a single point of failure.
Wrong: Run two Regions active-active
It works but costs far more than required (only one data center's failure must be tolerated).
3Two accounts need to place resources in the exact same physical AZ.
Show answer
Right: Compare by AZ ID (e.g. use1-az1)
An AZ ID always refers to the same physical location in every account.
Wrong: Both choose us-east-1a
In older accounts, AZ names are mapped per account: us-east-1a in the two accounts can be two different places.
4A rendering studio in Los Angeles needs single-digit ms latency to workstations on AWS; the nearest Region is far away.
Show answer
Right: A Local Zone in that city
Runs EC2, EBS, etc. right next to users, managed as an extension of the parent Region.
Wrong: Add CloudFront
CloudFront caches content; it cannot run workstations / interactive compute.
Wrong: Outposts
Works, but you must host and operate hardware on site; a Local Zone meets the need without that.
5A factory must process data on site because of regulation and latency, but the dev team wants to use the same AWS APIs and tools.
Show answer
Right: AWS Outposts
AWS hardware sits in your data center, managed from the Region like other AWS services.
Wrong: Local Zone
A Local Zone is AWS infrastructure in a city, not inside your factory.
6Under the shared responsibility model, who patches the OS of EC2 and who patches the OS running RDS?
Show answer
Right: EC2: you. RDS: AWS
The more managed the service, the more AWS handles; data, IAM and access configuration are always yours.
Wrong: AWS patches both
On EC2, the guest OS is yours.
Wrong: You patch both
On RDS, AWS manages the OS and engine; you choose the maintenance window.
7Traffic grows 10x at peak hours, with no interruption allowed while scaling.
Show answer
Right: Scale out: Auto Scaling group behind a load balancer
Adds / removes instances with load without stopping the service.
Wrong: Switch to a larger EC2 instance type
Scale up is limited and usually requires stopping the instance to change type.
8The operations team wants automatic notification when AWS schedules hardware maintenance affecting their EC2 instances.
Show answer
Right: AWS Health (account-specific events) → EventBridge → SNS / automated remediation
Health sends events specific to your resources; EventBridge turns them into notifications or actions.
Wrong: Watch the public AWS status page
The public page does not tell which of your resources are affected, and it is not automatic.
9An application serves images and static video straight from EC2 to global users; both the data transfer bill and latency are high.
Show answer
Right: Put CloudFront in front (S3 or EC2 as origin)
Content is cached at edges near users; data transfer from an AWS origin to CloudFront is free.
Wrong: Add more EC2 in the same Region
Does not reduce latency for distant users or the amount of data going out to the internet.
Quick picks
Where should the resources go?
| When you need | Use |
|---|---|
| Tolerate one data center failure | ≥ 2 AZs in one Region · see diagram |
| Tolerate a whole-Region failure / distant DR required | Multiple Regions · see diagram |
| Ultra-low latency for users in one city | Local Zone · see diagram |
| Mobile apps over 5G | Wavelength Zone · see diagram |
| Data / processing must sit in your own data center | Outposts · see diagram |
| Content delivery, DNS, DDoS protection near users | Edge location (CloudFront, Route 53, Shield) · see diagram |
| Same physical AZ across multiple accounts | Use AZ ID · see diagram |
| Unpredictable load swings | Scale out with Auto Scaling · see diagram |
| Reduce patching, backup and operations burden | Managed / serverless services · see diagram |
Common pitfalls
- Thinking data replicates to another Region automatically: it does not; you must configure it (S3 CRR, snapshot copy, global tables...).
- Treating us-east-1a in two accounts as the same place.
- Putting the whole system in one AZ and calling it "high availability".
- Choosing a Region by price before checking compliance / data residency requirements.
- Assuming AWS patches the EC2 operating system.
- Assuming that using a managed service removes the need to worry about IAM and encryption.
- Confusing a Local Zone (AWS places it in a city) with Outposts (placed in your own facility).
- Choosing scale up for a "no downtime when load grows" requirement.
- Forgetting that data transfer between AZs is also charged.
- Forgetting that some services / newer instance types are not yet available in every Region.
Services in this module
Well-Architected Toolself-review against best practices
Organizationsmanage multiple accounts
SupportAWS technical support plans
Health DashboardAWS service health status
Trusted Advisorautomated account optimization advice
Local Zonesextend a Region closer to users
WavelengthAWS inside 5G networks
Outposts rackon-site AWS rack
CloudFrontCDN, cache near users- Service Quotasview and raise service limits
Numbers that change (checked against AWS docs)
- AWS has 39 Regions and 124 Availability Zones; 46 Local Zones, 33 Wavelength Zones; more than 750 CloudFront points of presence. checked 2026-10-16 ↗
- Every Region has at least 3 Availability Zones. checked 2026-10-16 ↗
- Accounts created before November 2025 in long-established Regions have AZ names mapped per account; an AZ ID is the same physical location in every account. checked 2026-10-16 ↗
- Well-Architected has 6 pillars: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability. checked 2026-10-16 ↗
- With EC2, the customer manages the guest OS; with S3 and DynamoDB, AWS operates the infrastructure layer. checked 2026-10-16 ↗
- Data from the internet into AWS is free; data out to the internet is charged; transfer between AZs in the same Region is charged in both directions. checked 2026-10-16 ↗
- Data transfer between CloudFront and an AWS origin is free when serving through CloudFront. checked 2026-10-16 ↗