Open the AWS console for the first time and you are looking at more than 200 services. It is easy to assume you need a lot of them, or to hire someone who sets up a lot of them. Most small businesses don't. A typical business website, customer portal, or internal tool runs well on a handful of services, and the rest can wait until you have a specific reason to use them.
This is the short list we start from, in plain terms.
The short answer
- Somewhere to run your app: Amazon Lightsail, Amazon EC2, or AWS Lambda.
- A database: Amazon RDS.
- File storage and backups: Amazon S3 and AWS Backup.
- Speed and your domain: Amazon CloudFront, Amazon Route 53, and AWS Certificate Manager.
- Security basics: AWS IAM with multi-factor sign-in, plus AWS Secrets Manager.
- Monitoring and cost control: Amazon CloudWatch, AWS CloudTrail, and AWS Budgets.
1. Where your application runs
Amazon Lightsail is the simplest option: a virtual server with storage and a data allowance bundled at a predictable monthly price. It suits a business website, a small web app, or a WordPress site, and it is the easiest AWS bill to understand.
Amazon EC2 gives you full control over virtual servers, with more sizes and the option to add capacity automatically when traffic rises. Choose it when you outgrow Lightsail or need a specific setup.
AWS Lambda runs small pieces of code only when something happens, such as a form being submitted or a file being uploaded, and you pay for the time the code actually runs. It is a good fit for automations and background jobs rather than a whole website.
2. Your database
Amazon RDS runs familiar databases such as PostgreSQL and MySQL for you, and handles backups, patching, and, if you turn it on, a standby copy in another data center. Unless you have a specific reason to run your own database, a managed one is cheaper than the time it takes to look after one yourself. Amazon DynamoDB is worth a look for very high volumes of simple lookups, but most business apps start happily on RDS.
3. Files and backups
Amazon S3 stores files of any kind: uploads, documents, images, exports, and backups. You can set rules that move older files into cheaper archive storage automatically. AWS Backup puts the backups for your servers and databases on one schedule, so you can see in one place that they are actually happening. Test a restore at least once; a backup you have never restored is a guess.
4. Speed, your domain, and the padlock
Amazon CloudFront serves your site from locations close to your visitors, which makes pages load faster. Amazon Route 53 manages your domain's DNS. AWS Certificate Manager issues the certificates behind the padlock in the browser, free for use with services like CloudFront, and renews them automatically.
5. Security basics that matter most
Many small-business cloud problems start with weak access, not exotic attacks. Turn on multi-factor sign-in for the main account and stop using it day to day. Give each person their own sign-in through AWS IAM or IAM Identity Center, with only the access they need. Keep passwords and API keys out of your code with AWS Secrets Manager. When you are ready for more, Amazon GuardDuty watches your account for suspicious activity.
6. Monitoring and the monthly bill
Amazon CloudWatch collects logs and metrics and can alert you when something breaks. AWS CloudTrail records who changed what in your account. AWS Budgets sends an alert when spending heads past a number you choose. Set a budget alert on day one. Surprise bills are one of the most common AWS complaints, and they are almost always avoidable.
What you can safely ignore for now
Kubernetes (Amazon EKS), machine learning platforms (Amazon SageMaker), on-premises hardware (AWS Outposts), and data transfer devices (the AWS Snow family) are all useful to the businesses that need them. If no one can explain the specific problem one of them solves for you, you don't need it yet. Starting small also keeps your setup easier to understand, secure, and hand over.
If you work with the government
Government contractors handling sensitive or regulated data often run in AWS GovCloud (US), a set of isolated AWS regions built for US government workloads and regulated data such as export-controlled information. Access is limited to vetted US entities. If your contract names specific requirements, such as a FedRAMP authorization level, check them against AWS's published list of services in scope before you design anything. Not every AWS service is available or authorized in every region.
A typical starting setup
For a customer portal or internal business app, a sensible first version usually looks like this:
- The app on EC2 (or Lightsail while it is small), with a managed PostgreSQL database on RDS.
- Uploads and exports in S3, with nightly backups through AWS Backup.
- CloudFront and a free certificate in front, DNS in Route 53.
- Individual sign-ins with multi-factor, secrets in Secrets Manager.
- CloudWatch alerts for errors and downtime, and a budget alert on the bill.
That is roughly ten services, each with a clear job. Everything else gets added when there is a reason.
Want a second opinion on your setup?
We help businesses and government contractors plan, build, and clean up cloud setups, including moving off aging hosting. If you are not sure which of these you need, or why your bill looks the way it does, tell us what you are running and we will give you a straight answer. You can also read more about our cloud and infrastructure work.