# AWS Foundations and SysOps Overview

> Chapter 1 of the Courseiva AWS-SYSOPS-ASSOCIATE curriculum — https://courseiva.com/learn/aws-sysops-associate/aws-foundations-and-sysops-overview

**Official objective:** 1.1 — Explain the role of the SysOps Administrator and AWS global infrastructure

## Introduction

The AWS Certified SysOps Administrator Associate (SOA-C02) exam validates your ability to operate and manage applications on the Amazon Web Services (AWS) platform. This chapter establishes the foundational concepts you need: what a SysOps Administrator actually does, how AWS organises its global infrastructure, and how those two topics connect for the exam. Understanding this foundation is critical because every later chapter — from monitoring to networking to security — builds on these core ideas.

## The Apartment Building Common Area Analogy

A property management team runs a large apartment building. The team handles the building's physical infrastructure: the plumbing, the electrical system, the fire alarms, and the security foyer. They do not own the apartments or decide who lives in them. Their job is to make sure the building's shared systems are available, secure, and well-maintained. If a pipe bursts in the basement, the management team does not rebuild the pipe themselves. They call in a specialist plumber, approve the work order, and monitor the fix to ensure it meets the building's standards and budget. They also plan for growth: if the building adds a new wing of apartments, the team must provision new electrical capacity and network cabling well before the new tenants move in. The SysOps Administrator acts exactly like this property management team. The administrator does not write the software that runs on AWS. Instead, they manage the cloud 'building' — the AWS accounts, the permissions, the costs, the monitoring, the backups, and the security patches. They configure the cloud equivalent of fire alarms (Amazon CloudWatch alarms) and the security foyer (AWS Identity and Access Management roles and policies). When a developer's application needs more server capacity, the SysOps Admin provisions it. When a security vulnerability is discovered in a shared operating system image, the SysOps Admin applies the patch across the entire fleet. The analogy is precise: the SysOps Admin owns the platform's reliability and access controls, not the application's source code.

## Core explanation

Let us start with the role itself. A SysOps Administrator is an IT professional who manages the day-to-day operations of a cloud environment. Think of it as the person who ensures the cloud 'house' is running smoothly: the lights are on, the doors are locked, the bills are paid, and someone is watching for problems. The term 'SysOps' stands for System Operations, and it is distinct from a developer or a solutions architect. A developer writes the application code. A solutions architect designs the overall system. The SysOps Administrator is the one who deploys that code, monitors it in production, handles backups, responds to alerts, manages user permissions, and controls costs. In a traditional on-premises data centre, this role would have involved physically racking servers, installing cables, and applying operating system patches by hand. On AWS, that work moves to software-based management, but the responsibilities remain the same.

Now, what is the cloud itself? AWS (Amazon Web Services) is a cloud computing platform. Cloud computing means you rent computing resources — servers, storage, databases, networking — from a provider like Amazon, instead of buying and maintaining your own hardware. You pay only for what you use, the way you pay for electricity or water. The key technical term here is 'virtualisation'. A single physical server in an AWS data centre can run multiple 'virtual machines' (VMs) simultaneously. Each VM acts like a separate computer, with its own operating system, but they all share the underlying physical hardware. AWS manages this virtualisation layer, and you, as the SysOps Admin, manage the VMs (called 'instances' in AWS, specifically Amazon EC2 instances). This arrangement is what makes elastic scaling possible: you can add or remove instances in minutes, something impossible with physical hardware.

The second foundational concept is AWS global infrastructure. This is the physical layout of AWS data centres around the world. AWS organises its resources into 'Regions', 'Availability Zones', and 'Edge Locations'. A Region is a geographic area that contains at least two, and often more, Availability Zones. Each Availability Zone is one or more discrete data centres, each with redundant power, networking, and connectivity, housed in separate facilities. The critical fact is that Availability Zones within a single Region are connected by high-speed, low-latency networking, but they are physically separate enough that a disaster in one (like a power outage or flood) should not affect the other. This design underpins high availability: you can run identical copies of your application in two different Availability Zones, so if one fails, the other keeps working. Edge Locations are smaller sites used by services like Amazon CloudFront (a content delivery network) to cache data closer to end users for faster performance.

Why does a SysOps Admin need to understand this? Because your operational decisions — where to deploy resources, how to structure backups, how to design for fault tolerance — all depend on Region and Availability Zone architecture. For example, if you launch an EC2 instance, you must choose a Region. That choice affects latency for your users, compliance with data residency laws, and the cost of data transfer. If you launch all your instances in a single Availability Zone, a fire in that one data centre could take down your entire application. The SysOps Admin's job is to design and manage the system to avoid that single point of failure.

A related infrastructure concept is the AWS Shared Responsibility Model. This model defines who is responsible for what in the cloud. AWS is responsible for the security 'of' the cloud: the physical data centres, the hardware, the network infrastructure, and the hypervisor (the software that separates virtual machines from each other). The customer — and specifically the SysOps Admin working on behalf of the customer — is responsible for security 'in' the cloud: configuring the operating system, managing firewalls (called Security Groups in AWS), managing access permissions (using IAM), and encrypting data. This model is a core exam topic. The exam will test whether you know where AWS's responsibility ends and yours begins. For instance, if a customer's data is leaked because an S3 bucket (a cloud storage container) was made public, that is the customer's fault, not AWS's. AWS provides the tool to make the bucket private; the SysOps Admin must configure it correctly.

Finally, you must understand the concept of 'elasticity'. On AWS, you can increase or decrease your compute resources automatically based on demand. This capability is managed through services like Auto Scaling and Elastic Load Balancing. Auto Scaling automatically launches new EC2 instances when traffic increases and terminates them when traffic drops. Elastic Load Balancing (ELB) distributes incoming application traffic across multiple healthy instances. The SysOps Admin configures the rules for scaling and the health checks that the load balancer uses to decide if an instance is working. The exam will ask you to interpret CloudWatch metrics (performance data like CPU utilisation) to determine when scaling should occur, and to troubleshoot why scaling might not be happening as expected.

In summary, this chapter lays the groundwork. A SysOps Administrator owns the operational health of AWS resources. AWS global infrastructure provides the physical foundation of Regions and Availability Zones. The Shared Responsibility Model defines who secures what. Elasticity enables automatic scaling. Every other topic in the SOA-C02 exam — from monitoring to automation to networking — relies on understanding these four pillars.

## Real-world context

Consider a mid-sized e-commerce company called 'ShopFast' that sells clothing online. Until last year, ShopFast ran all its IT on servers in a rented room in a local data centre. The single person who managed those servers, Maria, handled everything: swapping out failed hard drives, installing security patches, and rebooting the server when it froze. The company decides to migrate to AWS. Maria's role now becomes a SysOps Administrator role for the AWS environment.

On day one, Maria logs into the AWS Management Console. She does not touch any physical hardware. Instead, she creates an AWS account and sets up 'IAM users' (Identity and Access Management users) for herself, the lead developer, and the finance person. Each user gets a policy: Maria gets 'AdministratorAccess' (full control), the developer gets permission only to deploy code and view logs, and the finance person gets read-only access to billing reports. This step — identity and access management — is the first concrete action a SysOps Admin takes.

Next, Maria chooses an AWS Region. Because ShopFast's main customers are in the UK and Europe, she chooses 'eu-west-2' (London). She selects at least two Availability Zones within that Region: 'eu-west-2a' and 'eu-west-2b'. She now launches two EC2 instances (virtual servers), one in each Availability Zone. She installs the ShopFast application on both. She then configures an Elastic Load Balancer (ELB) to distribute incoming web traffic between the two instances. She also configures an 'Auto Scaling group' that maintains a minimum of two instances and can scale up to ten when CPU utilisation exceeds 70% for five minutes.

Now, a real-world incident occurs. At 2:00 PM, traffic spikes because a celebrity is spotted wearing a ShopFast jacket. The Auto Scaling group detects the CPU spike via CloudWatch metrics and launches two additional EC2 instances in the existing Availability Zones within three minutes. The load balancer automatically adds these new instances to its rotation. Customers experience no slowdown. At 6:00 PM, traffic drops, and Auto Scaling terminates the extra instances, saving cost. Maria did nothing manually. Her job was to configure the scaling rules and the load balancer health checks correctly beforehand.

Later that month, a developer accidentally assigns a public IP to a database server that should be private. Maria receives a CloudWatch alarm and an email notification. She immediately logs in, identifies that the Security Group (a virtual firewall) attached to the database server allows traffic from the internet (0.0.0.0/0), and removes that rule. She then creates an 'IAM policy' that prevents any user from opening a database server to the internet without approval from her role. This action is another core SysOps duty: enforcing security boundaries.

At the end of the month, Maria reviews the AWS Cost Explorer dashboard. She sees that data transfer costs (the cost of moving data between Regions) are unexpectedly high. She investigates and discovers that a nightly backup job copies data from the London Region to a bucket in the US East (Virginia) Region. She changes the backup destination to a bucket in the same London Region to eliminate cross-Region transfer charges. She also sets up a 'budget' alert that will email her if monthly costs exceed $5,000.

This scenario shows the real responsibilities: user and permission management (IAM), infrastructure deployment and scaling (EC2, Auto Scaling, ELB), security incident response (Security Groups, IAM policies), and cost management (Cost Explorer, budgets). These are the exact skills the SOA-C02 exam tests.

## Exam focus

The SOA-C02 exam tests your understanding of the SysOps role and AWS infrastructure in several specific ways. You need to know these question patterns and traps to pass.

First, the exam will ask you to identify the SysOps Administrator's typical tasks. You will see a multiple-choice question like: 'Which of the following is a primary responsibility of a SysOps Administrator?' The correct answer will involve operational management: deploying and managing resources, monitoring performance, managing IAM users, and configuring backups. The trap options will include development tasks (writing code) or architectural decisions (choosing a database service for a new application). Remember: SysOps Admins do not write application code. They manage the environment where that code runs.

Second, expect at least one question about the Shared Responsibility Model. A common question presents a security issue (like a compromised S3 bucket or a breached EC2 instance) and asks 'Who is responsible for this?' The answer pattern: if the issue is about physical security or the underlying hypervisor, it is AWS's responsibility. If the issue is about your data, your IAM permissions, your Security Groups, your operating system patches, or your application configuration, it is the customer's responsibility. The exam loves to set a trap where a security breach happens due to an unpatched operating system on your EC2 instance. Beginners often guess 'AWS', but the correct answer is 'customer'.

Third, the exam tests AWS global infrastructure concepts. You will see questions about Regions and Availability Zones. For example: 'How many Availability Zones must an application use to be considered highly available?' The correct answer is at least two. Another common question: 'Which component of global infrastructure is designed to reduce latency for static and dynamic content?' The answer is Edge Locations (used by CloudFront). A trap question might say 'Select the statement that is true about AWS Regions.' The false statement will be that 'All AWS Regions are automatically enabled by default' — they are not. Some Regions are opt-in, meaning you must explicitly request access.

Fourth, the exam tests Elasticity and scaling concepts. You will see questions like: 'What AWS service automatically scales the number of EC2 instances based on demand?' Answer: Auto Scaling. A harder question: 'An application hosted on EC2 is experiencing performance degradation during peak hours. A SysOps Administrator notices that the CPU utilisation is consistently above 80% but no new instances are being launched. Which configuration is most likely misconfigured?' The correct answer is the Auto Scaling group's scaling policy or the CloudWatch alarm threshold. Traps include suggesting the load balancer is misconfigured (it distributes traffic but does not launch instances) or that the Security Group is blocking traffic.

Fifth, you need to know the names and purposes of key AWS foundational services. The exam will not ask you to memorise every service, but it will expect familiarity with EC2 (virtual servers), S3 (object storage), IAM (user and permission management), VPC (virtual private cloud — your isolated network on AWS), CloudWatch (monitoring and logging), and CloudTrail (audit logging). You must understand what each service does at a high level. For instance, a question might ask: 'Which service should a SysOps Administrator use to record all API calls made in the AWS account?' The answer is AWS CloudTrail, not CloudWatch. CloudWatch monitors performance; CloudTrail audits actions.

Finally, you should memorise the concept of 'regions vs. availability zones vs. edge locations'. The exam may present a diagram and ask you to identify which component is which. Or it might ask: 'A company needs to ensure that if an entire data centre fails, the application remains available. Which deployment strategy should a SysOps Administrator use?' The answer: deploy the application across multiple Availability Zones within a single Region. Deploying across multiple Regions offers even more fault tolerance but is more costly and complex. The exam expects you to know the difference and suggest the right level.

In summary, focus on: the definition of SysOps tasks, the Shared Responsibility Model boundary, the structure of Regions and Availability Zones, the purpose of Auto Scaling and ELB, and the basic function of core services. These are the concepts the exam will harp on.

## Step by step

1. **Define the SysOps Role** — The first step is to understand what a SysOps Administrator actually does: deploying resources, monitoring performance, managing IAM users, configuring backups, responding to alarms, and controlling costs. This role is distinct from a developer or architect. The exam tests your ability to identify this role's responsibilities.
2. **Learn the AWS Global Infrastructure Components** — You must be able to distinguish between Regions, Availability Zones, and Edge Locations. A Region is a geographic area with multiple, isolated data centres (Availability Zones). Edge Locations are for content caching. Understanding this hierarchy is essential for questions about high availability, disaster recovery, and latency.
3. **Understand the Shared Responsibility Model** — Draw a clear line: AWS is responsible for the physical security of data centres, the hypervisor, and the network infrastructure. You (the customer) are responsible for your data, operating system patches, IAM permissions, Security Groups, and application configuration. Exam questions often present a security incident and ask who is at fault.
4. **Master Elasticity Concepts: Auto Scaling and Load Balancing** — Auto Scaling launches and terminates EC2 instances based on demand. Elastic Load Balancing distributes traffic across healthy instances. You must know how to configure scaling policies based on CloudWatch metrics (like CPU utilisation) and how to interpret why scaling might not be occurring.
5. **Identify Core AWS Services by Function** — Memorise the primary purpose of EC2 (virtual servers), S3 (object storage), IAM (users and permissions), CloudWatch (monitoring and alarms), CloudTrail (audit logging), and VPC (isolated network). The exam will ask which service to use for a specific operational task, such as recording API calls or setting a budget alert.

## Comparisons

### AWS Region vs Availability Zone

**AWS Region:**
- A geographic area with multiple data centres.
- Resources are bound to a Region and cannot be moved without recreation.
- All Availability Zones in a Region are connected by low-latency networking.

**Availability Zone:**
- A single physical data centre or a cluster of data centres.
- Each Zone is isolated from failures in other Zones.
- Deploying resources across two or more Zones provides high availability.

### AWS CloudTrail vs Amazon CloudWatch

**AWS CloudTrail:**
- Records all API calls made in the AWS account for auditing.
- Logs who did what and when.
- Primarily used for security and compliance investigations.

**Amazon CloudWatch:**
- Monitors performance metrics like CPU utilisation and memory.
- Can trigger alarms when metrics cross a threshold.
- Primarily used for operational monitoring and scaling decisions.

### Auto Scaling vs Elastic Load Balancing

**Auto Scaling:**
- Automatically launches or terminates EC2 instances.
- Responds to demand changes based on CloudWatch metrics.
- Maintains a desired number of healthy instances.

**Elastic Load Balancing:**
- Distributes incoming traffic to multiple instances.
- Performs health checks and routes traffic away from unhealthy instances.
- Works with Auto Scaling but does not launch or terminate instances.

### Security Group (Instance Firewall) vs Network ACL (Subnet Firewall)

**Security Group (Instance Firewall):**
- Acts as a virtual firewall for individual EC2 instances.
- Stateful: return traffic is automatically allowed.
- Supports allow rules only; no explicit deny rules.

**Network ACL (Subnet Firewall):**
- Acts as a firewall for an entire subnet (group of instances).
- Stateless: return traffic must be explicitly allowed.
- Supports both allow and deny rules.

### IAM User vs IAM Role

**IAM User:**
- A permanent identity tied to a specific person or service.
- Has long-term credentials (access key, password).
- Can be used for direct login to the AWS Management Console.

**IAM Role:**
- A temporary identity assumed by a user, service, or resource.
- Provides temporary security credentials that expire.
- Best practise for granting permissions to AWS services like EC2 or Lambda.

## Common misconceptions

- **Misconception:** The SysOps Administrator is responsible for writing and deploying application code. **Reality:** The SysOps Administrator manages the operational environment (servers, networking, permissions, monitoring) but does not write the application code. Developers write code; SysOps deploys and supports it. (Beginners often see 'operations' and assume it includes software development. In cloud environments, these roles are distinct. The exam reinforces this separation.)
- **Misconception:** AWS Regions and Availability Zones are the same thing, just different names. **Reality:** An AWS Region is a geographic area with multiple Availability Zones. Each Availability Zone is one or more physically separate data centres. They are not interchangeable; a Region contains many Availability Zones. (The terminology is similar and often confused. Beginners think 'zone' is just a smaller region, but the architectural difference is critical for high-availability design.)
- **Misconception:** If I use AWS, I no longer need to worry about security at all because AWS handles everything. **Reality:** AWS is responsible for the security of the cloud (physical facilities, hypervisor, network). The customer is responsible for security in the cloud (data, operating system, IAM, applications). (The Shared Responsibility Model is one of the hardest concepts for new learners to internalise. People assume outsourcing infrastructure means outsourcing all responsibility.)
- **Misconception:** Once you launch resources in an AWS Region, you can easily move them to another Region by just changing a setting. **Reality:** Resources are tied to the Region where they were launched. To move a resource to another Region, you must create a new copy (e.g., an AMI from an EC2 instance) and launch it in the target Region. There is no simple 'move' button. (New users expect cloud resources to be location-agnostic. The exam tests this by asking about cross-Region resource migration, and beginners often pick the wrong, simpler answer.)
- **Misconception:** The SysOps Administrator's job is finished once the application is deployed on AWS. **Reality:** The SysOps Administrator's role is continuous: monitoring, patching, scaling, responding to incidents, managing costs, and auditing compliance. Deployment is just one phase. (People often compare SysOps to a one-time setup job, like setting up a home Wi-Fi network. In reality, cloud operations require ongoing attention, and the exam tests this lifecycle understanding.)

## Key takeaways

- The SysOps Administrator manages the operational health of AWS resources, including deployment, monitoring, security, and cost control, but does not write application code.
- AWS global infrastructure consists of Regions (geographic areas), Availability Zones (physically separate data centres within a Region), and Edge Locations (caching endpoints for faster content delivery).
- The Shared Responsibility Model means AWS secures the physical infrastructure, and the customer secures everything inside their environment, including data, operating systems, and access permissions.
- Deploying resources across at least two Availability Zones within a single Region is the minimum requirement for high availability.
- Auto Scaling automatically adjusts the number of EC2 instances based on demand, and Elastic Load Balancing distributes traffic to healthy instances.
- AWS CloudTrail records all API calls for auditing, while CloudWatch monitors performance metrics and logs.

## FAQ

**What exactly does a SysOps Administrator do on AWS?**

A SysOps Administrator manages the operational side of AWS: deploying and monitoring resources, managing user permissions (IAM), configuring backups and scaling, responding to incidents, and controlling costs. They do not write the application code.

**How is an AWS Region different from an Availability Zone?**

An AWS Region is a geographic area (e.g., London, Tokyo) that contains at least two separate Availability Zones. Each Availability Zone is a physically distinct data centre with independent power and networking. You deploy resources in a Region and across its Availability Zones for high availability.

**Who is responsible for patching the operating system on my EC2 instance?**

You are responsible. AWS patches the underlying hypervisor and physical hardware, but the operating system (Linux or Windows) running on your EC2 instance is your responsibility as the customer, typically managed by the SysOps Administrator.

**Do I need to configure a load balancer to use Auto Scaling?**

No, Auto Scaling can work without a load balancer, but they are often used together. Auto Scaling ensures you have the right number of instances, and the load balancer distributes traffic to those instances. The exam expects you to understand both services work in concert for scaling applications.

**What is the single most important concept for the SOA-C02 exam?**

The Shared Responsibility Model is arguably the most tested foundational concept. You must know exactly where AWS's responsibility ends and yours begins, because many questions present a security issue and ask who is responsible for fixing it.

**Can I use one AWS Region for everything?**

Yes, you can deploy all resources in a single Region, but that creates a single point of failure if the entire Region experiences an outage. For high availability, you deploy across multiple Availability Zones within that Region. For disaster recovery, you also replicate to another Region.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/aws-sysops-associate/aws-foundations-and-sysops-overview