AWS has more than 200 services. Reading the docs end to end is not a strategy — it is a fantasy. The good news: roughly 90% of the work in 90% of cloud engineering jobs touches the same ten services. Master these and you can ship.
Here they are, ranked by how often you will reach for them in your first year as a working cloud engineer.
1. EC2 (and the launch templates that make it bearable)
Yes, “EC2 is dead” takes are still wrong. EC2 underpins ECS, EKS, EMR, Sagemaker, Batch, and most third-party AWS appliances. You should be able to launch an instance, attach an EBS volume, write a user-data script, build a launch template, and roll it into an Auto Scaling Group without thinking.
2. IAM
Eighty percent of AWS bugs are IAM bugs. You should be able to read a policy and predict the answer to can this principal call this action on this resource without help from the policy simulator. Learn the difference between identity policies, resource policies, permission boundaries, and SCPs.
3. VPC
Subnets, route tables, IGWs, NAT, security groups, NACLs, VPC endpoints, peering, Transit Gateway. If you cannot whiteboard a three-tier VPC from memory, you will be slow on every other AWS task.
4. S3
The most-used storage service on Earth. Master:
- Storage classes and lifecycle policies (cost engineering lives here).
- Bucket policies, ACLs, and public access blocks (security engineering lives here).
- Multipart upload, transfer acceleration, signed URLs.
5. CloudWatch + CloudWatch Logs
Metrics, logs, alarms, dashboards, log subscription filters. The single most useful skill: writing a CloudWatch Logs Insights query that returns the right rows in under 30 seconds.
6. Lambda
Even non-serverless shops use Lambda for glue. Learn the cold-start tax, the IAM-execution-role pattern, and the difference between synchronous, asynchronous, and stream invocation modes. Bonus: master the SAM CLI for local dev.
7. RDS / Aurora
Most production data still lives in a relational database. You should be able to launch a Multi-AZ RDS instance, set up a read replica, configure parameter groups, and restore from a snapshot.
8. DynamoDB
The other half of the data layer. The skill that separates juniors from seniors here is access-pattern modeling. If you can articulate why your table has a composite primary key with PK = USER#<id> and SK = ORDER#<ts>, you are ahead of most engineers.
9. ECS / EKS (pick one to start)
If your shop runs Kubernetes elsewhere, learn EKS. Otherwise, ECS Fargate is the cleanest container experience on AWS — task definitions, services, capacity providers, ALB integration. Containers are the dominant compute primitive in 2026.
10. Route 53
DNS is forever. Hosted zones, record types, health checks, routing policies (simple, weighted, latency, failover, geolocation). When something is broken in production, the answer is DNS more often than you think.
Honourable mentions
- SQS / SNS / EventBridge — for decoupling. Learn one in depth, the other two are easy.
- Secrets Manager + Parameter Store — never hardcode secrets again.
- CloudFormation or CDK or Terraform — pick one, get fluent. The mindset transfers.
- Cost Explorer + Budgets — if you cost the company nothing, you matter twice as much.
How to actually master them
Reading docs is not learning. The pattern that works:
- Watch one short video on the service to get the vocabulary.
- Run a hands-on lab that builds the simplest useful thing.
- Break it intentionally — wrong region, wrong IAM, wrong subnet — and fix it.
- Rebuild the same thing in IaC.
The Cloud Arena labs catalog covers each of the ten above with at least one focused lab. Pick the one you are weakest on and run it tonight.