AWS Resources — End-to-End Learning Guide (Floci Edition)

Tool: Floci (https://floci.io) — drop-in LocalStack-compatible AWS emulator, MIT licensed, port 4566, 68 services Order: Top → Down by service dependency (foundations first, composed services last) Style: Each chapter = concept notes + hands-on Floci exercise + gotchas

---

Chapter 0 — Environment Setup

• Install floci-cli: curl -fsSL https://floci.io/install.sh | sh (macOS/Linux) or irm https://floci.io/install.ps1 | iex (Windows)
• Alternative: Docker — docker run --rm -p 4566:4566 -v /var/run/docker.sock:/var/run/docker.sock floci/floci:latest
• Start it: floci start
• Load env vars into shell: eval $(floci env) (sets AWS_ENDPOINT_URL, dummy AWS_ACCESS_KEY_ID=test, AWS_SECRET_ACCESS_KEY=test)
• Verify: floci doctor
• Note: no awslocal wrapper needed — plain aws CLI works directly once env vars are set
• Optional: install floci-ui for a visual dashboard (browse S3, DynamoDB, SQS, Lambda logs, etc.)

---

Chapter 1 — IAM (Identity Foundation)

Everything else assumes an identity/permission model exists. - Core concepts: Users, Groups, Roles, Policies (JSON), Trust relationships - Policy evaluation logic: explicit deny > allow, resource-based vs identity-based - STS: AssumeRole, temporary credentials - Hands-on: aws iam create-role, attach a policy, aws sts assume-role, inspect the returned temp credentials

Chapter 2 — Networking (VPC)

Compute/DB resources are placed inside networks. - VPC, CIDR blocks, Subnets (public/private) - Internet Gateway, NAT Gateway, Route Tables - Security Groups vs NACLs (stateful vs stateless) - Hands-on: aws ec2 create-vpc, create a subnet, create a security group, describe them back

Chapter 3 — Storage (S3)

Foundational for logs, artifacts, static hosting, data lakes. - Buckets, objects, keys, prefixes - Versioning, lifecycle policies, storage classes (conceptual) - Bucket policies vs IAM policies vs ACLs - Presigned URLs - Hands-on: aws s3 mb, upload/download objects, enable versioning, generate a presigned URL

Chapter 4 — Compute (EC2)

Depends on: VPC (Ch.2), IAM (Ch.1) - Instances, AMIs, key pairs, instance profiles (role attachment) - User data / bootstrap scripts - Hands-on: aws ec2 run-instances, describe instances, attach an IAM instance profile

Chapter 5 — Databases

Depends on: VPC (Ch.2) for RDS; standalone for DynamoDB

5a. DynamoDB (NoSQL)

• Tables, partition/sort keys, GSIs/LSIs
• Read/write capacity vs on-demand
• Streams (feeds into Lambda later)

• Hands-on: create table, put/get/query items, enable a stream

  5b. RDS (relational — Floci runs a real Postgres/MySQL engine underneath)

• DB instances, subnet groups, parameter groups

• Hands-on: aws rds create-db-instance, connect via psql/mysql client, run real SQL against it

Chapter 6 — Messaging & Eventing

Depends on: IAM (Ch.1); feeds Lambda (Ch.7) - SQS: standard vs FIFO queues, visibility timeout, dead-letter queues - SNS: topics, subscriptions, fan-out pattern (SNS → multiple SQS) - EventBridge: event buses, rules, pattern matching - Hands-on: create SNS topic → subscribe SQS queue → publish message → poll queue

Chapter 7 — Serverless (Lambda + API Gateway)

Depends on: IAM (Ch.1), and typically S3/DynamoDB/SQS as triggers - Lambda: handlers, layers, environment variables, execution role — Floci runs these in real Docker containers - Event sources: S3 events, DynamoDB streams, SQS, EventBridge - API Gateway: REST vs HTTP API, routes, integrations, stages - Hands-on: aws lambda create-function, wire it to an S3 bucket event, then expose it via API Gateway

Chapter 8 — Containers

Depends on: VPC (Ch.2), IAM (Ch.1) - ECR: image repos, push/pull - ECS: clusters, task definitions, services (Fargate vs EC2 launch type) - EKS: listed as a supported service — verify current depth of coverage before relying on it heavily - Hands-on: push an image to aws ecr, register a task definition, run an ECS task

Chapter 9 — Infrastructure as Code

Ties together everything above — should come after you understand the raw APIs - CloudFormation: templates, stacks, drift detection — test stacks entirely against the Floci endpoint - Terraform/OpenTofu: point the aws provider's endpoints at http://localhost:4566 - CDK: synthesize + deploy against Floci - Hands-on: write one CFN template covering S3 + Lambda + DynamoDB, deploy with aws cloudformation deploy

Chapter 10 — Observability

Cross-cutting — depends on resources existing to monitor - CloudWatch Logs: log groups, streams, retention - CloudWatch Metrics + Alarms - X-Ray tracing - Hands-on: tail Lambda logs via aws logs tail, create a custom metric

Chapter 11 — Security & Secrets

Cross-cutting, layered on top of IAM (Ch.1) - Secrets Manager: secret storage, rotation (conceptual) - KMS: keys, encryption/decryption, envelope encryption - Parameter Store (SSM) - Hands-on: store a secret, retrieve it in a Lambda via env var + SDK call

Chapter 12 — CI/CD Integration

Depends on: IaC (Ch.9), Containers (Ch.8) - Running Floci in GitHub Actions / GitLab CI as a service container (24ms cold start makes this cheap per job) - Ephemeral test environments: spin up → test → tear down per pipeline run - Hands-on: a GitHub Actions workflow that starts Floci, deploys a CFN stack, runs an integration test, tears down

Chapter 13 — Capstone Project

• Build a small end-to-end system entirely on Floci: S3 upload → Lambda trigger → DynamoDB write → SNS notification → SQS consumer → CloudWatch dashboard
• Deploy the whole thing via one Terraform/CDK config
• Write a teardown script

---

Reference — Floci Quick Facts

Item	Detail
Compatibility	Drop-in LocalStack replacement, same port (4566)
Services	68 AWS services, single binary
Auth	None required — no account, no API key, no telemetry
License	MIT, all services available to everyone
Startup	~24 ms cold start, ~13 MiB idle memory
Engine fidelity	Real Docker for Lambda, real Postgres/MySQL for RDS
CLI	floci start, floci env, floci doctor
Dashboard	floci-ui — browse S3, DynamoDB, SQS, Lambda logs, etc.