Learn AWS for Free: The Plain-English Series (2026 Hub)

In April 2022, this page asked a question: shall we start AWS tutorials on this blog, free as always? Consider this the answer, four years and a whole library later: yes — and here is every post, in the order to read them. This is the hub for our free, plain-English AWS series: twenty-one service guides that read like stories — from S3 and EC2 through Lambda, VPC, and Bedrock to CloudWatch, CloudTrail, GuardDuty, Inspector, Security Hub, Config, and Macie — a first real project with its own domain, plus the machine-learning certification track for the AWS AI Practitioner and ML Engineer exams. No paywall, no signup, no "full course in my bio." And one fact up front that removes the fear most beginners carry in: on a new AWS account's free plan, you can no longer accidentally run up a bill — since mid-2025, free-plan accounts come with credits, and when they run out AWS simply stops the account rather than charging you. The scariest thing about learning the cloud was retired while nobody was looking.

Jake is the reason the series reads the way it does. When he first asked how the cloud worked — wanting off-site backups for the repair shop's customer data — he did what everyone does: searched "AWS tutorial," landed in an alphabet soup of two hundred services, started with the trendiest one, and gave up twice. The information was all out there. The order was missing: nothing told him that storage makes sense before compute, that permissions only click after you have something to protect, or that the billing page is scarier in your imagination than in your account.

Ethan: "Learning AWS from the service list is learning English by reading the dictionary — every word is in there, alphabetically, uselessly. What you want is a phrasebook: the sentences you actually need, in the order you'll actually need them. This series is the phrasebook."

From a 2022 question to a library

The original version of this page was a genuine question to readers — and enough of you said yes that it became a promise. The promise grew into two tracks. The plain-English track explains one AWS service per post, for people who have never touched a cloud console: real analogies, real prices, and every post carries its own surprise — a true, counterintuitive fact most tutorials never mention. The certification track goes deeper, following the syllabus territory of the AWS AI Practitioner and Machine Learning Engineer exams. Both are and will remain free. Each post also keeps a promise at the end: it names the next stop, so the series reads like chapters instead of scattered articles.

The plain-English track: read in this order

1. What Is Amazon S3? — cloud storage, the service everything else leans on.
2. What Is Amazon EC2? — renting computers by the hour: the heart of the cloud.
3. What Is Amazon EBS? — the "hard drive" your cloud computer uses, and why it is not inside it.
4. What Is AWS IAM? — who may touch what: the permissions layer that keeps you safe.
5. AWS Billing in Plain English — the money post: free plan, budgets, and the traps.
6. What Is AWS Lambda? — serverless: code that runs without any computer to manage.
7. What Is Amazon DynamoDB? — the serverless database: instant answers at any size, pennies a month.
8. What Is Amazon API Gateway? — the front door: routes, sign-in checks, the 29-second rule, and the 3.5× pricing trap.
9. What Is Amazon SQS? — the waiting line: receive-process-delete, the visibility timeout, and why duplicate delivery is a feature your code must survive.
10. What Is Amazon SNS? — the broadcaster: one event, many listeners, and why a delivery to nobody still counts as success.
11. What Is Amazon RDS? — the managed database: an address instead of a server, and why you can never SSH in — on purpose.
12. What Is Amazon VPC? — the network post: the free VPC you already own, and the $32-a-month courier hiding in "proper" tutorials.
13. What Is Amazon SageMaker? — where AWS and machine learning meet; the bridge to the cert track.
14. What Is Amazon Bedrock? — renting ready-made AI by the sentence: the food court to SageMaker's kitchen.
15. Your First Real AWS Project, End to End — the graduation exercise, delivered: S3 + Lambda + API Gateway + DynamoDB wired into a working link shortener, bill included ($0.00).
16. Your Own Domain + HTTPS: CloudFront & Route 53 — the project’s ugly execute-api address replaced with a name you own: the free certificate, the alias record, and the $0 Free plan that now covers DNS too.
17. Amazon CloudWatch: Metrics, Logs & the $0 Alarm — find the logs your Lambda was writing all along, set the free 2 a.m. billing alarm in seven steps, and learn why the watcher must never cost more than the watched.
18. AWS CloudTrail: Who Did What in Your AWS Account — the audit log every account already has, the search that names who deleted the server, and the $0 root sign-in alarm — plus the blind spot: the log skips the reads you would most want audited.
19. Amazon GuardDuty: The Guard Who Reads Your Logs — the threat detector that reads CloudTrail, flow logs, and DNS for you, what its findings mean, the honest bill after the 30-day trial, and the $0 "email me when it’s serious" alarm — plus the twist: it watches the S3 reads CloudTrail skips, without you turning them on, for less.
20. Amazon Inspector: The Inspector Who Checks the Locks — the vulnerability scanner for EC2, containers, and Lambda: three finding types in plain English, why its score can be lower than the CVE’s, the honest per-resource bill after the 15-day trial, and the $0 "email me when it’s Critical" alarm — plus the surprise that Amazon Linux 2 is now itself a Critical finding.
21. AWS Security Hub: The Front Desk Where It All Lands — the collection point: configuration checks scored against AWS’s own checklist, every GuardDuty and Inspector finding in one ranked list, the honest bill for both products, and the $0 one-rule-covers-every-service Critical alarm — plus the rename: what every older tutorial calls Security Hub is now Security Hub CSPM, and the new product wearing the name costs ten times as much.
22. AWS Config: The Clerk Who Writes Everything Down — the recorder under it all: every change in your account kept as a replayable timeline, the one security service with no free tier (it bills through everyone else’s trial), the four-changes-a-day recording rule that makes "cheaper" daily mode a 4x increase for most accounts, and the $0 NON_COMPLIANT email alarm.
23. Amazon Macie: The Librarian Who Reads Your Buckets — the only service that reads what is inside the files: which S3 buckets actually hold sensitive data (phone numbers, cards, credentials), the $1-per-GB number up front, the trial that never covers targeted jobs, and the sample-the-shelves strategy that keeps a small account at a couple of dollars.

The order is deliberate: store things → compute on them → give the computer a disk → lock the doors → understand the bill → then get clever with serverless and machine learning — and once you have built something real and given it a name, watch it (CloudWatch), know who touched it (CloudTrail), and have someone read that log for you (GuardDuty). Files before servers, locks after belongings, money before magic, alarms after shipping, a guard after the alarms. Skip around if a title calls to you — every post stands alone — but read in order and each one hands the next its vocabulary.

What's inside each one (including the surprise)

When it breaks: the error-message companions

The reading order teaches each service; these shorter companions exist for the day one of them refuses to work. Each is built around the exact error text you will see on screen, so they are easiest to find by pasting that text into search — but they are collected here too, because the CloudFront and Route 53 stop above is where most first-project owners meet them.

Which track is for you?

They are not either/or — the plain-English track is the on-ramp, and its SageMaker post hands you directly to the certification material. Plenty of readers run both: a service post with morning chai, a cert chapter on the weekend.

The certification track: AI Practitioner & ML Engineer

The deeper track targets the territory of AWS's AI and machine-learning certifications — the foundational AI Practitioner and the associate-level Machine Learning Engineer exams. It began as numbered "days," grew into numbered "parts," and the numbering shows its history — read it in this order and it flows:

1. Day 1: What is AI, GenAI, and its future? — the foundations, no math required.
2. Day 2: Clustering, inference, and how machines learn — supervised vs unsupervised, feedback loops.
3. What is enhanced reasoning in AI? — the thinking-models chapter.
4. Part 4: Problem formulation — does your business even need ML?
5. Part 5: Data fundamentals — ingestion, transformation, and the key AWS services.
6. Part 6: Data cleaning & feature engineering — imputation, outliers, Glue, SageMaker basics.
7. Part 7: Pretraining bias — class imbalance, SMOTE, and Clarify.
8. SageMaker built-in algorithms, demystified — the exam's favorite question factory.
9. The 2026 AWS certification changes — read this before booking any exam date.

Can you really practice for free? The 2026 truth

For years the honest answer had an asterisk: AWS had no spending cap, so a forgotten server could quietly bill you for months — our billing post tells that story in full. But the ground shifted in July 2025: new accounts on the free plan get real credits ($100 at signup, up to $100 more for completing activities), and when the credits run out, the account simply stops working rather than charging your card. The nightmare scenario — a beginner's surprise bill — was engineered out for free-plan learners. Everything this series teaches can be practiced inside that safety net; the billing post shows the two budget alarms to set anyway, because the habit will matter the day you upgrade to a paid account on purpose.

What's next in the series

Promises kept, in order: SQS delivered SNS, RDS landed behind it, VPC covered the network — and the longest-standing promise of all is now kept: your first real AWS project, end to end is live above, S3, Lambda, API Gateway, and DynamoDB from these twenty-three stops wired into one small thing that actually runs, bill included ($0.00, and the post proves it) — and the thread it left hanging, the ugly execute-api address, is now tied off too: your own domain with HTTPS, CloudFront and Route 53, is live above. And the loudest gap left — you have shipped something real and have no way of knowing when it breaks — is now closed too: Amazon CloudWatch in plain English is live above, and the 2 a.m. alarm it promised really does cost $0.00, seven steps, receipts included. And the question every new alarm raises — CloudWatch says what happened, but who did it? — is answered too: AWS CloudTrail in plain English is live above, with the $0 root sign-in alarm it promised. And the promise that log raised — someone has to read it — is kept too: Amazon GuardDuty in plain English is live above, the guard who reads the log for you, with the $0 "email me when it’s serious" alarm it promised. And that promise is kept too: Amazon Inspector in plain English is live above, the inspector who checks the locks before anyone tries them, with the $0 Critical-finding alarm it promised. And the page Inspector promised in turn — the front desk where the detector, the log, the guard, and the inspector all finally report — is live above as well: AWS Security Hub in plain English, with one $0 rule that covers every service’s Critical findings at once. And the fine print that page pointed at is honored too: AWS Config in plain English is live above — the clerk with the ledger, the no-free-tier bill it named in advance, the four-changes-a-day arithmetic, and the $0 NON_COMPLIANT alarm it promised. And the last hire is made too: Amazon Macie in plain English is live above — the librarian who reads what is inside the files, with the $1-per-GB honesty and the sample-first strategy it promised. With that, the security staff this series hired one by one is complete — and the question the librarian opened on her first day is the next promise: she found the sensitive data, so who holds the keys that encrypt it? Next: AWS KMS in plain English — the locksmith who holds the keys to your data. It will be linked from this page the day it publishes, as will everything after it — that is what a hub is for. If there is a service you want explained in plain English sooner, say so through the contact page; the series has taken reader requests since it was a reader request. Beyond that, the shortlist follows the same logic as the reading order — what a solo builder or small shop actually meets next, including the AI services that sit on top of SageMaker. The order may bend when AWS ships something worth explaining first; the promise-the-next-stop rule will not.

How to get the most out of these posts

Three habits, learned from readers. Read the FAQ even if you skip the middle — every post mirrors its key answers there, so the FAQ works as a five-minute revision card before an interview or exam. Follow one link per post, not five — each post names its next stop; trust the trail instead of opening twelve tabs. And do the one hands-on thing each post suggests — creating a bucket, setting a budget alarm — because thirty seconds in the console cements what thirty minutes of reading only introduces. None of it requires spending a cent, per the section above.

FAQ — the series, the exams, and the money

Is this AWS series really free?

Completely — every post, both tracks, no signup. The site runs on ordinary ads; that is the whole business model, visible on the page you are reading.

Which post should I read first?

The S3 post — storage is the foundation everything else references. If you are certification-bound, Day 1 of the AI/ML track is your alternative front door.

Do I need to know how to code?

Not for the plain-English track — it is written for smart beginners, not developers. The certification track assumes comfort with concepts more than code, though hands-on practice helps everywhere.

Do I need an AWS account to follow along?

No — every post teaches fine as pure reading. An account makes it stick: the free plan covers everything the series suggests trying.

Does AWS still require a credit card at signup?

Yes, a card is part of signup verification — but on the post-2025 free plan the card is not charged when credits run out; the account pauses instead. The billing post covers the details and the fine print.

Can I really not get a surprise bill anymore?

On the free plan, running out of credits stops the account rather than billing you — that is the July 2025 change. Paid accounts remain uncapped, which is why the budget-alarm habit still matters.

What order should I read the service posts in?

S3 → EC2 → EBS → IAM → Billing → Lambda → DynamoDB → API Gateway → SQS → SNS → RDS → VPC → SageMaker → Bedrock, then the first project, its domain, CloudWatch, CloudTrail, GuardDuty, Inspector, Security Hub, Config, and Macie. Store, compute, disk, locks, money, the clever stuff, then build, name, watch, audit, guard, collect, record, and read. Each also stands alone if one title is exactly your question.

Which AWS certification should I take first?

For most readers of this series: AI Practitioner first (foundational, no prerequisites), then Machine Learning Engineer Associate if you want the deeper credential. Check the 2026 cert-changes post before booking — exam versions and dates moved this year.

Is an AWS certification worth it?

As proof-of-vocabulary for hiring filters, yes, especially early-career. As a substitute for being able to do things, no — which is why this series teaches the doing and treats the badge as a byproduct.

Why does the certification track's numbering jump around?

History, honestly: it began as "Day 1, Day 2" in 2024 and matured into "Part 4, 5, 6, 7" as the exam series took shape. The reading order on this page is the real sequence.

What is the next post in the series?

AWS KMS in plain English — the locksmith who holds the keys to your data: what "encrypted" on a bucket really means, who can use which key, and the billing surprises encryption carries. This hub gets updated whenever a new series post lands, which is the reason to bookmark it.

Is "serverless" really serverless?

There are servers — you just never see, rent, or patch them. The Lambda post unpacks what you actually pay for instead, by the millisecond.

Are these posts kept up to date?

Yes — AWS changes prices and rules, and each post carries a revision note recording what changed and when. If you catch something stale before we do, the contact page reaches a human who will fix it.

How is this different from AWS's own documentation?

The docs are a reference written for people who already understand; this series is an explanation written for people who don't yet. You will graduate to the docs — that is the goal, not the competition.

With AI everywhere, is learning cloud still worth it?

The AI everyone is excited about runs on exactly this plumbing — storage, compute, permissions, billing. Understanding the layer under the magic has gotten more valuable, not less; it is also where the AI-era certifications live.

Can I request a topic?

Please do — through the contact page. This entire series exists because readers answered a question this page asked in 2022; requests are its native fuel.

Where to go next (beyond AWS)

Revision note. Originally published April 2022 as an open question to readers: shall we start AWS tutorials, free as always? Rewritten August 18, 2026, into the answer and updated through September 1, 2026, with the CloudWatch, CloudTrail, GuardDuty, Inspector, Security Hub, Config, and Macie stops — the hub for everything that question became: twenty-one plain-English service guides plus the first full project build and its own-domain follow-up, the AI/ML certification track, and a standing promise that the next post is always named before it exists. If you were one of the readers who said yes back in 2022, this page is yours; it just took four years to grow into its title. Spotted something wrong or something missing? Tell me through the contact page and I will fix it. Happy learning — the cloud is friendlier than it looks.