Lesson 1 of 7 · 8 min
How AWS is laid out, and who is responsible for what
Regions, Availability Zones and edge locations — plus the shared responsibility line that every security question turns on.
Regions, AZs and edge locations
A Region is a geographic area — eu-west-1 is Ireland, us-east-1 is Northern Virginia. Regions are fully isolated from each other, which is deliberate: a failure in one should not propagate.
Inside a Region are Availability Zones, each one or more data centres with independent power, cooling and networking, connected by low-latency links. Running across two AZs is what protects you from losing a single data centre, and it is the default expectation for anything production.
Edge locations are a separate, much larger network used by CloudFront and Route 53 to serve cached content and DNS close to users. They do not run your compute.
Shared responsibility
AWS is responsible for security *of* the cloud: the hardware, the hypervisor, the physical facilities. You are responsible for security *in* the cloud: your data, your access control, your network configuration.
Where the line falls depends on the service. On EC2 you own the guest OS and its patches. On RDS, AWS patches the database engine — but you still own who can connect, whether the instance is publicly reachable, and whether the data is encrypted.
Global versus regional
| Scope | Services | Consequence |
|---|---|---|
| Global | IAM, Route 53, CloudFront, Organizations | Their API endpoints resolve to us-east-1 |
| Regional | EC2, VPC, RDS, Lambda, most others | Resources exist in one Region only |
| Zonal | EC2 instances, EBS volumes, subnets | Tied to a single Availability Zone |
Worth remembering
- A Region contains multiple isolated Availability Zones; spreading across AZs is the basic resilience move.
- AWS secures the cloud; you secure what you put in it.
- For managed services the line moves, but access control and encryption choices stay yours.
Test it now
Infrastructure and responsibility questions open the easy bank.