Walking a Rented Kingdom

Amazon Web Services is a kingdom you can rent but never own. That is the whole business: they built the castles, the roads, the granaries, and the walls, and for a fee you may move your things in and live there. I am studying for the exam that certifies you can arrange a household in this kingdom sensibly, the AWS Certified Solutions Architect Associate, and somewhere along the way the studying turned into cartography.

I do not learn a territory from a list of facts about it. I learn it from a map, a physical one, on paper, where every fact has a place and the places hold still. So the study system I built kept producing maps, and this week it produced its largest one yet: a hundred-plus page atlas of the entire exam world. A world map first, showing where each subsystem lives. Then a breakout map for every district, compute, storage, networking, databases, the cost markets, down to the street level where the individual rules and limits and exam traps live. I printed it, put it in a binder, and read the whole thing the way you would read an atlas of a country you are about to visit, which is exactly what it is.

Then today I visited.

Terrain under the maps

I logged into the actual console, the web interface where the kingdom is administered, and just walked around. No building, no configuring, nothing to show for it. I went to the districts I have been studying and looked at them. Clicked into the storage service and saw what a bucket actually looks like when you are standing in front of it. Wandered the networking pages and watched the diagrams I had memorized turn into forms with real fields in them.

A map is a promise about terrain, and until you walk the terrain the promise is all you have. Ten minutes of standing inside a service does something no page can do: it converts where things are into what things look like, and the two together are what remembering is made of. The atlas gave me the geography. The console gave me the ground truth. Neither one is sufficient and I no longer believe either one is optional.

Take off the crown

There is one more thing the kingdom taught me today, and it taught it the way all good territories teach, by mild embarrassment.

I walked in as root. The root account is the crown itself, the identity that owns the whole tenancy and can do absolutely anything, including things that cannot be undone. And one of the first lessons in the very exam I am studying for is that the crown is for the vault, not for errands. You are supposed to lock root behind a second factor, make yourself a working identity through IAM, Identity and Access Management, the kingdom's system of keys and permissions, and do your daily walking as someone who can open the doors they need and no others.

So the first item my walk added to the study list was not a service limit or a pricing tier. It was: practice what the exam preaches. Make the steward account. Hang up the crown.

The exam is in less than two weeks. Between now and then it is maps in the evening, terrain in small doses, and a deck of flashcards built from everything I get wrong. The kingdom does not care whether I pass. But I intend to arrive at the gate already knowing my way around.

Update, August 31: I arrived at the gate

I wrote the above on July 19 with the exam twelve days out. It went to six weeks instead. The timed set the following Sunday came back at 52 percent, my worst of the whole study, so I moved the date out a month on purpose and spent the month differently. The packet these maps came out of, and what that bad set exposed about the way I had been using it, is its own post.

The change is the part worth recording here, because it is a correction to this post. I said the atlas gave me geography and the console gave me ground truth, and that neither was optional. That was right and it stopped a step short. Reading a console is still reading. What I did with the extra month was build a small working copy of the kingdom, nine cents an hour, and then break it on purpose: refuse a packet at the subnet, kill a node and watch the failover, strand an instance behind a route I had drawn correctly on paper and built wrong in the world.

A map is a promise about terrain. A console visit is a photograph of terrain. A thing you have broken and repaired is terrain, and it is the only one of the three that can tell you that you were wrong.

And I did hang up the crown, further than the study list asked. Instead of making one working identity inside the account I had walked into, I stood up a separate account for the lab work, and then a second one for the specific purpose of learning how several accounts behave together, which is its own district of the exam and not one you can read your way into. Root carries a second factor in each of them and does nothing day to day. The daily work runs through admin and limited roles, with a small set of IAM users kept only where a user is genuinely the right shape for the job. The crown is in the vault. I walk in as a steward now, which took an afternoon and is the first architectural decision of the whole tenancy, and that is the joke the exam is making when it puts that lesson on the first page.

This morning I sat the real exam and scored 799, against a line of 720 and a ceiling of 1000. A pass with room, and not a commanding one. The kingdom did not care either way, which was the point of the last line above and is still true. I did arrive knowing my way around. The part of the knowing that held up under the clock was not the part I had read. It was the part I had already broken.