The Big Picture: Vercel vs AWS Mindset

Concept

Vercel is a PaaS — Platform as a Service. A PaaS is a service that runs your code for you. You do a git push, and Vercel decides the rest: where your code runs, how it grows with more users, and how HTTPS works. You never see a server. Everything is hidden from you.

AWS is IaaS — Infrastructure as a Service. An IaaS gives you only raw building blocks: a virtual computer, a network, a database. You connect them together. Nothing is hidden. At first this feels hard. But many backend engineers know AWS for this reason, and the ideas you learn (servers, networks, databases) also help on other cloud providers.

Here is the same idea, job by job. Every cell marked You on the AWS side is something this course teaches you to do.

Why this matters

Vercel is very good. But you will hit its limits when:

• Cost goes up at scale — Vercel charges by usage, such as requests and bandwidth (data sent out). With small traffic it is cheap. When many real users come, the bill grows fast.
• You need long-running work — background jobs, PDF generation, queue workers (programs that take jobs from a waiting list). Serverless functions (small pieces of code that run only when called) have a time limit, and they stop when it ends.
• You need a real database beside your app — not a separate paid service with its own limits and bill.
• You need full control — your own caching, Redis (a fast in-memory data store), and private networking. For a multi-tenant SaaS this control matters a lot.

Architecture — where you are going

This is the full target setup. Every later lesson fills in one box of this flow. Today you only need to recognise the names.

1. Browser / User

   Someone opens yourapp.com
2. Route 53 (DNS)

   Turns your domain name into a server IP address
3. CloudFront (CDN)

   Keeps copies of your static files on servers around the world, so pages load fast
4. ALB + EC2 (Auto Scaling)

   The load balancer shares traffic between your app servers, which run Next.js / Node.js. When more users come, more servers start automatically
5. RDS (PostgreSQL)

   Your managed database. AWS does the backups, the software updates (patching) and the switch to a spare copy if the main one fails (failover)

The flow above is the path one request takes. The map below shows the same pieces as they sit in AWS. Some are global. Some live inside your region (a region is a group of AWS data centres in one area). Some are hidden inside your private network, where the internet cannot reach them.

What each name means, in one line

Real example

Take a multi-tenant SaaS. SaaS means Software as a Service: an app that people use online. Multi-tenant means many companies (tenants) use one application, but each company's data is kept separate. Such a project needs:

• A real PostgreSQL database that you control, not a shared serverless database with limits on connections.
• Room to run background jobs, such as making PDF quotations or sending emails, with no time limit.
• A way to grow from one app server to many servers, for example when a client's whole team logs in at month end.

Commands — your only setup for today

You create no AWS resources today, so you pay nothing. You only set up your identity in a safe way.

[default]
aws_access_key_id     = AKIA…
aws_secret_access_key = ••••••••

[default]
region = ap-south-1
output = json

1. Create your AWS account

   Go to aws.amazon.com and sign up. This creates a root user, the owner login of the account. It can do everything. Use it only when you must, and never for daily work. Think of it like your bank locker key: very powerful, so keep it locked away.

2. Turn on MFA for the root user

   MFA (multi-factor authentication) means you need a second proof besides your password, such as a code from your phone. Go to Security Credentials, then Multi-factor authentication, and add an authenticator app. Do this on the same day. This one step stops many of the most common and costly account break-ins.

3. Create an IAM admin user for yourself

   An IAM user is a login for one person inside your account. Open IAM, then Users, then Create user. Attach the AdministratorAccess policy (a policy is a list of allowed actions). This is the user you work with every day, not the root user.

4. Install the AWS CLI on your machine

   CLI means Command Line Interface. It is a tool that lets you control AWS by typing commands, instead of clicking in the website.

   # On Mac
   brew install awscli
   
   # On Linux
   curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
   unzip awscliv2.zip
   sudo ./aws/install

5. Connect the CLI to your IAM user

   An Access Key is a pair of values (an ID and a secret) that works like a username and password for the CLI. Create one for your IAM user in the AWS console. Then run this and paste the values.

   aws configure
   
   # AWS Access Key ID:     <paste here>
   # AWS Secret Access Key: <paste here>
   # Default region name:   ap-south-1   (Mumbai)
   # Default output format: json

   Choose the Mumbai region so your servers are physically near your users in India. Shorter distance means less delay, so pages load faster.

   Region1 trip5 trips

   Mumbai

   ap-south-1

   ~30 ms150 ms

   Singapore

   ap-southeast-1

   ~75 ms375 ms

   London

   eu-west-2

   ~140 ms700 ms

   N. Virginia

   us-east-1

   ~230 ms1.1 s

   5 trips ≈ DNS lookup, TCP connect, TLS handshake, the HTML, and one API call. A CDN (Lesson 11) removes most of them for static files.

6. Verify that everything is working

   aws sts get-caller-identity

   This command asks AWS “who am I?”. If it prints your IAM user's ARN (the unique name of a thing in AWS) and it does not say “root”, your setup is correct and safe. Lesson 0 is complete.

   $ aws sts get-caller-identity
   {
       "UserId": "AIDA2EXAMPLEID",
       "Account": "123456789012",
       "Arn": "arn:aws:iam::123456789012:user/admin"
   }

   arnit's an ARN

   :

   awspartition

   :

   iamservice

   :

    region (IAM is global, so empty)

   :

   123456789012your account ID

   :

   user/adminwho you are

   ✓ correct

   …:123456789012:user/admin

   ✕ still root

   …:123456789012:root

Practice task before Lesson 1

Nothing here creates a paid resource. The goal is to check that your CLI talks to AWS as the right user, in the right region, and that you can read what it says back.

aws sts get-caller-identity          # 1. who am I? the Arn must contain "user/", never "root"
aws configure get region             # 2. must print ap-south-1
aws ec2 describe-regions --output table   # 3. list the AWS regions — find ap-south-1 (Mumbai) in it
aws iam list-users                   # 4. you should see exactly one user: the IAM admin you created
aws s3 ls                            # 5. lists your buckets — an empty result is correct, nothing exists yet

Then answer these in your own words. You do not need to write them down, but be sure you can:

1. Why did we create an IAM user instead of using the root account every day?
2. Vercel charges per request. An EC2 server costs the same whether it serves 10 or 500 users. When is each model cheaper?
3. In the architecture flow above, which box handles “yourapp.com” → IP address, and which box adds more servers when traffic grows?
4. Where on your machine does aws configure store your keys? (Hint: cat ~/.aws/credentials.) Why must that file never be committed to git?

Conclusion

Vercel is a PaaS: you push code and the platform hides the servers from you. AWS is IaaS: you get raw building blocks (compute, network, database) and connect them yourself. That extra work is the price of control. You need that control when you have long-running jobs, a real database next to your app, or a bill that grows with every request.

• Cost model: Vercel is cheap with little traffic and expensive at scale. AWS is mostly a fixed cost. It is cheap at scale only if you manage it well, because nobody tunes it for you.
• The target architecture: Route 53 → CloudFront → ALB + EC2 (Auto Scaling) → RDS. Every future lesson fills in one of those boxes.
• Security first: the root user is locked away with MFA, an IAM admin user does the daily work, and access keys live only in aws configure, never in your repository.
• Region: ap-south-1 (Mumbai), so your servers are close to your users.

You have spent nothing, and you have a safe, checked AWS identity. From here on, every lesson builds something real on top of it.

End of Lesson 0. Next: Lesson 1 — Linux Fundamentals.

Also read: Hosting Platforms Explained → — where Vercel, Railway, Dokploy and AWS each fit, and why the deciding factor is stateless (keeps nothing between requests) vs persistent (keeps data over time).