AWS¶

AWS is the largest cloud provider and the default choice for much of the data and AI ecosystem. This sheet focuses on the services data scientists and ML engineers actually touch: S3 for storage, EC2 for compute, SageMaker for the ML platform, Lambda for serverless glue, and IAM for the permissions that keep it safe.

Installation / Setup¶

pip install awscli boto3
aws configure
#  Access Key ID: AKIA...
#  Secret Access Key: ...
#  Default region name [us-east-1]: us-east-1
#  Default output format [None]: json

Verify:

aws sts get-caller-identity   # who am I?
aws s3 ls                     # list buckets (tests credentials + perms)

Use named profiles for multiple accounts:

aws configure --profile work
export AWS_PROFILE=work

Core Services¶

Service	Category	What it does	Typical AI/data use
S3	Storage	Object storage, 99.999999999% durability	Datasets, models, artifacts, backups
EC2	Compute	Virtual machines (incl. GPU instances)	Training boxes, custom servers
SageMaker	ML platform	Notebooks, training jobs, endpoints	Managed training & serving
Lambda	Serverless	Run code on events, no servers	Data triggers, API glue, preprocessing
RDS	Databases	Managed relational DBs (Postgres/MySQL)	App + metadata storage
DynamoDB	NoSQL	Key-value / document store	Chat history, feature lookups
EKS	Containers	Managed Kubernetes	Deploy model services at scale
Bedrock	GenAI	Managed foundation models (Claude, Llama…)	LLM APIs without owning infra
IAM	Security	Users, roles, policies	All access control
CloudWatch	Observability	Logs, metrics, alarms	Monitoring jobs and services
EventBridge	Events	Event routing	Trigger pipelines on file uploads

Common Operations¶

S3 — the workhorse¶

aws s3 cp file.parquet s3://my-bucket/data/
aws s3 sync ./dataset s3://my-bucket/dataset/          # incremental mirror
aws s3 ls s3://my-bucket/models/                       # list objects
aws s3 cp s3://my-bucket/models/model.pt ./            # download
aws s3 rm s3://my-bucket/tmp/ --recursive              # delete prefix

# Presigned URL — temporary access without making the bucket public
aws s3 presign s3://my-bucket/models/model.pt --expires-in 3600

EC2 — compute¶

# Find a GPU AMI and launch (Deep Learning AMI is pre-loaded with CUDA/PyTorch)
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type g4dn.xlarge \
  --key-name my-key \
  --security-group-ids sg-12345678

aws ec2 describe-instances --query 'Reservations[].Instances[].PublicIpAddress'
aws ec2 stop-instances --instance-ids i-1234567890abcdef0
aws ec2 terminate-instances --instance-ids i-1234567890abcdef0   # billed until terminated, not stopped!

Lambda — serverless¶

# Package a function (zip or container) and deploy
zip function.zip lambda_function.py
aws lambda create-function \
  --function-name preprocess \
  --runtime python3.12 \
  --role arn:aws:iam::123456789012:role/lambda-basic \
  --handler lambda_function.handler \
  --zip-file fileb://function.zip

SageMaker — quick path to a training job¶

# Estimate cost: GPU training via managed job
aws sagemaker create-training-job \
  --training-job-name my-run-001 \
  --algorithm-specification TrainingImage=<ecr-image>,TrainingInputMode=File \
  --role-arn arn:aws:iam::123456789012:role/service-role/SageMaker-ExecutionRole \
  --input-data-config '[{"ChannelName":"train","DataSource":{"S3DataSource":{"S3DataType":"S3Prefix","S3Uri":"s3://bucket/train/"}}}]' \
  --output-data-config '{"S3OutputPath":"s3://bucket/output/"}' \
  --resource-config '{"InstanceType":"ml.g4dn.xlarge","InstanceCount":1,"VolumeSizeInGB":100}' \
  --stopping-condition '{"MaxRuntimeInSeconds":86400}'

Practical Examples¶

Example 1 — Train locally, push model to S3, serve via SageMaker endpoint¶

# 1. Upload the trained model artifact
aws s3 cp model.tar.gz s3://my-bucket/models/

# 2. Create an endpoint from a prebuilt or custom container
aws sagemaker create-model --model-name my-model \
  --primary-container '{"Image":"<inference-image>","ModelDataUrl":"s3://my-bucket/models/model.tar.gz"}'
aws sagemaker create-endpoint-config --endpoint-config-name my-model-cfg \
  --production-variants '[{"VariantName":"AllTraffic","ModelName":"my-model","InitialInstanceCount":1,"InstanceType":"ml.m5.large"}]'
aws sagemaker create-endpoint --endpoint-name my-model --endpoint-config-name my-model-cfg

Example 2 — S3-triggered preprocessing with Lambda¶

# lambda_function.py — runs when a file lands in s3://my-bucket/raw/
import boto3

s3 = boto3.client("s3")

def handler(event, context):
    bucket = event["Records"][0]["s3"]["bucket"]["name"]
    key = event["Records"][0]["s3"]["object"]["key"]
    print(f"Processing s3://{bucket}/{key}")
    # ... read, clean, write to s3://my-bucket/clean/
    return {"statusCode": 200}

Example 3 — Interact with Bedrock (managed LLMs)¶

import boto3

client = boto3.client("bedrock-runtime", region_name="us-east-1")
resp = client.invoke_model(
    modelId="anthropic.claude-3-5-sonnet-20240620-v1:0",
    contentType="application/json",
    accept="application/json",
    body='{"anthropic_version":"bedrock-2023-05-31","max_tokens":256,"messages":[{"role":"user","content":"Explain RAG in one sentence."}]}',
)
print(resp["body"].read().decode())

Common Patterns¶

Data lake layout¶

s3://bucket/
  raw/      # untouched source data
  clean/    # validated, deduplicated
  features/ # feature stores / prepared datasets
  models/   # artifacts + metadata
  logs/     # pipeline logs

IAM for ML workloads¶

Need	IAM pattern
Notebook user	Role with scoped S3 + SageMaker perms
Training job	Execution role (SageMaker) with bucket access
CI/CD deploy	OIDC role assumed from GitHub Actions — no long-lived keys
Lambda function	Execution role with only the services it calls

aws iam create-role --role-name ml-training-role --assume-role-policy-document file://trust.json
aws iam attach-role-policy --role-name ml-training-role --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

Cost controls¶

aws budgets create-budget \
  --account-id 123456789012 \
  --budget '{"BudgetName":"monthly-ml","BudgetLimit":{"Amount":"500","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}'

Best Practices¶

Use roles, not long-lived keys — assume roles with sts:assume-role; in CI use OIDC. Rotate any static keys.
Keep buckets private — serve via presigned URLs or CloudFront. Public buckets are the #1 AWS data breach.
Terminate GPU instances when done — stopping saves compute cost but EBS storage still bills; terminating frees everything.
Use aws s3 sync over cp for datasets — incremental, resumable, much faster on large trees.
Tag resources — Environment=prod, Team=ml, CostCenter=x for cost allocation.
Set CloudWatch alarms on training jobs — fail fast on errors; use --stopping-condition MaxRuntimeInSeconds on every SageMaker job.
Pin boto3/AWS CLI versions in CI — API drift between versions is a classic flaky-pipeline cause.

Common Mistakes¶

Mistake	Consequence	Correct approach
Making a bucket public "temporarily"	Public data leak	Presigned URLs or IAM-gated access
Access key committed to a repo	Full account access if it has broad perms	Scoped keys, secret scanning, rotate immediately
`aws ec2 stop` instead of `terminate`	Storage still billed; instance lingers	Stop only for short pauses; terminate when done
Using `us-east-1` for data with EU compliance	Regulatory violation, egress costs	Choose region by residency + cost
No `MaxRuntimeInSeconds` on training jobs	Paying for hung jobs for days	Always cap runtime
Deleting S3 objects without versioning	Permanent data loss	Enable versioning + lifecycle rules

Troubleshooting¶

Symptom	Cause	Fix
`AccessDenied` on S3	Policy/role lacks permission	`aws sts assume-role` context check; verify bucket policy + IAM
`ExpiredToken`	Credentials expired	Refresh; for roles call `aws sts get-session-token`
SageMaker job stuck `InProgress`	Resource limits or image issues	CloudWatch logs of the job; check `StatusReason`
Lambda timeout on big files	15-min function limit	Stream or split work; move to a batch job
`NoSuchBucket`	Wrong region or name	Bucket names are global; confirm region match
GPU instance can't find CUDA	Wrong AMI	Use the Deep Learning AMI (pre-loaded drivers/CUDA)

Home — repository landing page
Central Navigation Index — find related categories
cloud-fundamentals.md — shared cloud concepts and provider mapping
azure.md and google-cloud.md — provider alternatives
kubernetes.md — EKS and container deployment
docker.md — packaging for EC2/SageMaker/EKS
fastapi.md — the app you'd containerize and serve

Official Documentation¶

Last Updated¶

2026-09-07 — Initial version.

Found a mistake or something outdated? Open an issue or submit a pull request — see CONTRIBUTING.md.

AWS¶

Table of Contents¶

Installation / Setup¶

Core Services¶

Common Operations¶

S3 — the workhorse¶

EC2 — compute¶

Lambda — serverless¶

SageMaker — quick path to a training job¶

Practical Examples¶

Example 1 — Train locally, push model to S3, serve via SageMaker endpoint¶

Example 2 — S3-triggered preprocessing with Lambda¶

Example 3 — Interact with Bedrock (managed LLMs)¶

Common Patterns¶

Data lake layout¶

IAM for ML workloads¶

Cost controls¶

Best Practices¶

Common Mistakes¶

Troubleshooting¶

Related Cheat Sheets¶

Official Documentation¶

Last Updated¶