Bạn là backend developer, không phải sysadmin. Bạn cần đủ rộng để không lạc trong AWS console, và đủ sâu để không mắc sai lầm trên production.

Loạt bài AWS thực chiến không dạy bạn “AWS là gì” — mà dạy bạn dùng AWS đúng từng service một, qua tình huống thực tế. Mỗi bài là một vấn đề cụ thể, kèm lệnh AWS CLI, code TypeScript SDK, Mermaid diagram, và những sai lầm mình đã trả giá bằng production incidents.

Kiến thức nền

Loạt bài giả định bạn đã hoàn thành Docker thực chiến hoặc tương đương, quen CLI, Git, và có kinh nghiệm build ít nhất một ứng dụng backend nhỏ.

Các bài viết liên quan trong blog:

Giai đoạn 1: Foundation — Setup đúng trước khi code (5 bài)

Trước khi đụng đến bất kỳ service nào, bạn cần một AWS account được setup đúng, IAM vững, và công cụ CLI/SDK trong tay.

  1. Phần 1: Tài khoản AWS, root user & billing alarm — Root vs IAM user, MFA, billing alarm CloudWatch+SNS, AWS Budgets, Cost Explorer [/posts/aws/01-tai-khoan-aws-root-billing/]
  2. Phần 2: IAM user, group, role, policy — least privilege — Policy JSON structure, managed vs inline, role vs user, Access Advisor, permission boundary [/posts/aws/02-iam-user-group-role-policy/]
  3. Phần 3: IAM nâng cao — cross-account, ABAC, SCP — AssumeRole, ExternalId, tag-based access control, Service Control Policy [/posts/aws/03-iam-nang-cao-cross-account-abac-scp/]
  4. Phần 4: CLI, SDK TypeScript v3 & credential chain — aws configure, credential chain, @aws-sdk/client-*, pagination, retry, –query JMESPath [/posts/aws/04-cli-sdk-typescript-credential-chain/]
  5. Phần 5: CloudTrail & auditing fundamentals — Management vs data events, org trail, S3+CloudWatch log, Athena query [/posts/aws/05-cloudtrail-auditing-fundamentals/]

Giai đoạn 2: Core Services — Storage, Compute, Database (8 bài)

Làm chủ 4 service nền tảng: S3 (storage), EC2 (compute truyền thống), Lambda (serverless), RDS + DynamoDB (database).

  1. Phần 6: S3 cơ bản — bucket, object, encryption, static hosting — SSE-S3/KMS, bucket policy, public access block, CORS, versioning [/posts/aws/06-s3-co-ban-bucket-object-encryption/]
  2. Phần 7: S3 nâng cao — lifecycle, replication, pre-signed URL, event — CRR, pre-signed URL TypeScript SDK, S3 Event→Lambda, Object Lambda [/posts/aws/07-s3-nang-cao-lifecycle-replication-event/]
  3. Phần 8: EC2 thực hành — từ AMI đến production instance — AMI, instance types, user data, SSM Session Manager, IMDSv2, placement group [/posts/aws/08-ec2-thuc-hanh-ami-den-production/]
  4. Phần 9: Auto Scaling Group & Application Load Balancer — Launch template+ASG, target tracking, ALB listeners+rules, health check, session stickiness [/posts/aws/09-asg-alb-auto-scaling-load-balancer/]
  5. Phần 10: Lambda cơ bản — serverless từ dòng code đầu tiên — Handler, event types, execution role, cold start, CloudWatch Logs, SAM CLI [/posts/aws/10-lambda-co-ban-serverless-dau-tien/]
  6. Phần 11: Lambda nâng cao — VPC, concurrency, provisioned, Powertools — VPC-attached Lambda, reserved/provisioned concurrency, Lambda Layers, Powertools for TypeScript [/posts/aws/11-lambda-nang-cao-vpc-concurrency-powertools/]
  7. Phần 12: RDS & Aurora PostgreSQL — managed SQL toàn tập — PostgreSQL sizing, backup+PITR, read replica, Aurora Serverless v2, RDS Proxy, parameter group [/posts/aws/12-rds-aurora-postgresql-managed-sql/]
  8. Phần 13: DynamoDB — NoSQL cho serverless, single-table intro — PK+SK, GSI/LSI, capacity modes, DocumentClient, TTL, single-table design preview [/posts/aws/13-dynamodb-nosql-serverless-single-table/]

Giai đoạn 3: Networking & CDN — Kết nối mọi thứ (5 bài)

DNS, CDN, API Gateway, và VPC — infrastructure backbone cho mọi ứng dụng.

  1. Phần 14: Route 53 — domain, DNS, health check, routing policy — Hosted zone, ALIAS vs CNAME, failover/latency/geolocation routing, DNS firewall [/posts/aws/14-route53-domain-dns-health-check/]
  2. Phần 15: CloudFront + ACM — CDN & TLS thực hành — Distribution, cache policy, OAC, ACM certificate, invalidation, WAF integration [/posts/aws/15-cloudfront-acm-cdn-tls-thuc-hanh/]
  3. Phần 16: API Gateway — REST, HTTP, WebSocket, authorizer — REST vs HTTP API, JWT/Cognito authorizer, Lambda/custom authorizer, CORS, throttling [/posts/aws/16-api-gateway-rest-http-websocket/]
  4. Phần 17: VPC căn bản — subnet, route table, NAT, Internet Gateway — Public/private subnet, IGW, NAT Gateway, security group vs NACL, Flow Logs [/posts/aws/17-vpc-can-ban-subnet-route-nat/]
  5. Phần 18: VPC nâng cao — endpoint, PrivateLink, Transit Gateway — Gateway endpoint, Interface endpoint, VPC Peering, Transit Gateway route table [/posts/aws/18-vpc-nang-cao-endpoint-privatelink-tgw/]

Dự án 1: Static Website trên AWS (1 bài)

  1. Phần 19: Dự án — Deploy static website lên AWS — S3+CloudFront+Route53+ACM+GitHub Actions OIDC, CDK deploy [/posts/aws/19-du-an-static-website-s3-cloudfront-cdk/]

Giai đoạn 4: Container & Infrastructure as Code (5 bài)

Từ Docker Compose lên ECS Fargate, quản lý toàn bộ infrastructure bằng CDK TypeScript.

  1. Phần 20: ECR — container image registry — Image scanning, lifecycle policy, cross-account replication, pull-through cache [/posts/aws/20-ecr-container-image-registry/]
  2. Phần 21: ECS Fargate — chạy container không cần quản lý server — Task definition, service+ALB, auto-scaling, service discovery, CloudWatch container insights [/posts/aws/21-ecs-fargate-container-khong-server/]
  3. Phần 22: Infrastructure as Code với CDK TypeScript — cdk init, app→stack→construct, deploy/diff/destroy, L3 constructs, context [/posts/aws/22-cdk-typescript-iac-co-ban/]
  4. Phần 23: CDK nâng cao — pipeline, testing, aspect, best practice — CDK Pipelines, custom construct, aspect pattern, snapshot testing, cdk-nag [/posts/aws/23-cdk-nang-cao-pipeline-testing-aspect/]
  5. Phần 24: GitHub Actions + AWS OIDC — deploy không cần access key — OIDC federation, configure-aws-credentials, matrix deploy, environment protection [/posts/aws/24-github-actions-aws-oidc-deploy/]

Giai đoạn 5: Messaging & Event-Driven — Decouple mọi thứ (6 bài)

Message queue, pub/sub, event bus, workflow orchestration, và authentication — những thứ biến một app đơn giản thành hệ thống phân tán thực sự.

  1. Phần 25: SQS — message queue: Standard, FIFO, DLQ, visibility timeout — Standard vs FIFO, DLQ+redrive, visibility timeout, batch, long polling [/posts/aws/25-sqs-message-queue-standard-fifo-dlq/]
  2. Phần 26: SNS — pub/sub & fan-out pattern — Topic, subscription filter, fan-out SNS→SQS, message attribute, SMS/email [/posts/aws/26-sns-pubsub-fanout-pattern/]
  3. Phần 27: EventBridge — event bus, rule, schema registry — Custom event bus, rule+event pattern, archive+replay, schema discovery, API destination [/posts/aws/27-eventbridge-event-bus-rule-schema/]
  4. Phần 28: Step Functions — workflow orchestration — State machine, Parallel/Choice/Map, Retry/Catch, Express vs Standard, callback pattern [/posts/aws/28-step-functions-workflow-orchestration/]
  5. Phần 29: Cognito — authentication & authorization — User pool, OAuth2/OIDC, Lambda trigger, JWT verification, hosted UI [/posts/aws/29-cognito-authentication-authorization-jwt/]
  6. Phần 30: Secrets Manager & SSM Parameter Store — Auto-rotation, secure string, cost comparison, Lambda extension [/posts/aws/30-secrets-manager-ssm-parameter-store/]

Dự án 2: Serverless REST API (1 bài)

  1. Phần 31: Dự án — Serverless REST API: API Gateway + Lambda + DynamoDB + Cognito + SQS — HTTP API+Lambda+DynamoDB+Cognito JWT+SQS worker, CDK deploy, integration test [/posts/aws/31-du-an-serverless-rest-api/]

Giai đoạn 6: Observability & Security — Nhìn thấy và bảo vệ (5 bài)

Log, metric, trace, encryption, và cache — những thứ giúp bạn ngủ yên khi app chạy trên production.

  1. Phần 32: CloudWatch cơ bản — log, metric, alarm, dashboard — Log group, metric filter, dashboard, alarm→SNS, subscription filter [/posts/aws/32-cloudwatch-co-ban-log-metric-alarm/]
  2. Phần 33: CloudWatch nâng cao — EMF, Logs Insights, anomaly detection — Embedded Metric Format, Contributor Insights, Synthetics canary, anomaly detection [/posts/aws/33-cloudwatch-nang-cao-emf-insights-anomaly/]
  3. Phần 34: X-Ray — distributed tracing — Service map, trace/segment/subsegment, annotation, sampling rule, SDK integration [/posts/aws/34-xray-distributed-tracing/]
  4. Phần 35: KMS — encryption key management — CMK vs AWS-managed, key policy, envelope encryption, grant, rotation [/posts/aws/35-kms-encryption-key-management/]
  5. Phần 36: ElastiCache — Redis managed — Cluster mode, auto-failover, ioredis client, eviction policy, backup/restore [/posts/aws/36-elasticache-redis-managed/]

Dự án 3: 3-Tier Application (1 bài)

  1. Phần 37: Dự án — 3-Tier App: ALB → ECS Fargate → RDS + Redis — VPC 3-tier, ALB→ECS Fargate→RDS+ElastiCache, WAF, CDK deploy [/posts/aws/37-du-an-three-tier-app-ecs-rds-redis/]

Giai đoạn 7: Advanced & Production (5 bài)

Những chủ đề nâng cao giúp bạn tối ưu cost, thiết kế theo Well-Architected, sẵn sàng disaster recovery, và master DynamoDB single-table.

  1. Phần 38: Cost optimization — Savings Plans, S3 Intelligent-Tiering, Compute Optimizer, Budget actions, Cost Anomaly Detection [/posts/aws/38-cost-optimization-savings-plans-tips/]
  2. Phần 39: Well-Architected Framework — 6 pillars thực hành — WA Tool review, cải thiện operational excellence, security, reliability, performance, cost, sustainability [/posts/aws/39-well-architected-framework-6-pillars/]
  3. Phần 40: Disaster recovery — RPO/RTO & multi-region — Backup/restore, pilot light, warm standby, active-active, Route 53 ARC [/posts/aws/40-disaster-recovery-rpo-rto-multi-region/]
  4. Phần 41: DynamoDB nâng cao — single-table design — Single-table pattern, GSI overload, sparse index, Stream+Lambda, DAX intro [/posts/aws/41-dynamodb-nang-cao-single-table-design/]
  5. Phần 42: Serverless nâng cao — event-driven patterns — SQS→Lambda batch, EventBridge→Step Functions, WebSocket API, fan-out với SNS [/posts/aws/42-serverless-nang-cao-event-driven-patterns/]

Bonus (2 bài)

  1. Bonus 1: Amazon Bedrock & GenAI cho developer — Foundation models, knowledge base (RAG), agent, guardrail, prompt engineering [/posts/aws/43-bedrock-genai-cho-developer/]
  2. Bonus 2: Tổng kết — AWS skill map & lộ trình certification — Skill heatmap cho backend dev, lộ trình thi SAA/DA, tài nguyên học tiếp [/posts/aws/44-tong-ket-aws-skill-map-certification/]

Loạt liên quan