AWS for Thnkrr: A Beginner's Guide

10 October 2026. A reference for anyone at Thnkrr. No AWS or technical knowledge needed.

What this document is for

Thnkrr is a professional network for high-school students, a bit like LinkedIn for teenagers. Students build a profile, connect with classmates, post about what they've done, and get advice from mentors (university students). Teachers and school staff use it too. We're starting with a pilot: a trial with a few US schools, beginning with about 20 students and growing to about 1,000.

Thnkrr will run on Amazon Web Services (AWS), Amazon's business of renting out computers, storage and software over the internet. AWS sells over 200 products, with short names like EC2 (Elastic Compute Cloud), S3 (Simple Storage Service) and RDS (Relational Database Service) that mean little to most people.

This document explains, in plain words:

  1. What each job behind Thnkrr is, and which AWS product will do it.
  2. What other AWS products could do the same job, what they cost, and when we'd use one.
  3. What other companies do, from small startups to LinkedIn, and what we can learn from them.

Nothing is running on AWS yet. The app is built and tested on our own laptops. This document describes the launch plan: the setup we'll create on AWS before the first students join.


Contents

  1. The one-minute version
  2. Words you'll see
  3. What AWS is, in two minutes
  4. How Thnkrr will run on AWS
  5. How a social network grows
  6. Why we skip most of AWS
  7. The jobs, one by one (20 short sections, plus products Amazon is closing)
  8. Lessons from other companies
  9. The whole list of AWS products
  10. Sources

1. The one-minute version


2. Words you'll see

WordWhat it means
The appThnkrr itself: the program that runs everything students see and do. Students reach it through a web browser on their phone or laptop
ServerA computer that runs the app all day and night. We rent ours from Amazon
DatabaseWhere all accounts, posts and messages are stored, organised so any record can be found in a split second
StorageSpace for files, like photos and videos
MB, GB and TBMegabyte, gigabyte and terabyte: sizes of data. A phone photo is about 3 MB; 1 GB holds about 300 photos; 1 TB is 1,000 GB
RegionAn area where Amazon has several data centres. Ours is in Virginia, USA
Data centreA building full of computers. A region has several, miles apart, so one fire or power cut can't take them all out
ManagedAmazon looks after it (repairs, routine updates, backups). We pay a little more and do less
Pay per useYou pay only when something happens, like a photo being checked
BackupA saved copy we can go back to if data is lost or damaged
OutageA time when a service stops working. "Downtime" means the same
CacheA small, very fast copy of popular data, so the database isn't asked the same thing again and again
QueueA to-do list of slow jobs (like converting a video) that small background programs, called workers, work through
FirewallA filter that inspects incoming traffic and blocks requests that match known attack patterns
AI modelAn artificial intelligence program, trained on huge amounts of text or images, that can judge new ones, for example "does this post contain bullying?"
EncryptionScrambling data so only someone with the right key can read it

"Copy" means different things, so this document always says which:


3. What AWS is, in two minutes

Think of AWS as renting instead of buying. A company used to buy its own computers, put them in a cold room, and hire people to fix them. With AWS, you rent exactly what you need, by the hour, and Amazon owns and repairs the machines.

Three things make it useful for us:

About the credits. Amazon's startup programme gave us about $5,000 of AWS credit. It has an expiry date we still need to check. It's separate from AWS's "free tier", a small extra allowance (up to $200) that every new account gets.

About the names. Most AWS products have short names like those above. The first time each appears, this document gives its full name and says what it does, so you never need to remember the codes.

Why Virginia? Every region has outages now and then (Lesson 3). We chose Amazon's Virginia region because it's closest to our first schools around Pittsburgh, has every product we need, and checks pictures fastest.


4. How Thnkrr will run on AWS

Here's what will happen when a student posts a photo, and which AWS product does each step.

  1. The student types thnkrr.com. Route 53, Amazon's internet address book, tells their phone which computer to talk to.
  2. The pages load quickly from CloudFront, a network of computers around the world that keep copies of our pages close to every user.
  3. The student signs in. The app, running on one rented computer (EC2), checks their password against our database (RDS).
  4. They upload a photo. It goes into a private, locked folder in Amazon's file storage (S3), where only our safety team can see it.
  5. The photo and its caption are checked by machines:
    • Amazon's picture check (Rekognition) looks for things like nudity or violence;
    • an AI model (run by Bedrock) reads the caption for bullying, phone numbers, self-harm and similar;
    • it will also be compared against official lists of known child-abuse images, once the organisations that keep them approve us (section 7.6).
  6. A person on our safety team reviews it. Nothing goes live until they approve it.
  7. Once approved, classmates can see it, and they get an email from Amazon's email service (SES, Simple Email Service).

In the background:

What it will cost each month:

WhatAWS productStart (20 students)1,000 students, after a year of uploads
The computer running the appEC2$31$31
The databaseRDS$14$14
Storing photos and videos, and sending them outS3 and CloudFrontunder $1$14
AI check on writingBedrockunder $1$15
Picture checkRekognitionunder $1$6
Watching for break-insGuardDutyabout $10about $10
FirewallWAF$8$8
Alarms, address book, emailCloudWatch, Route 53, SES$3$5
Backups, staff logins, records of every actionSeveralfreefree
Totalabout $66about $103

Two of these are estimates. GuardDuty will cost between about $5 and $13; its first month is free and shows the real figure. Storage grows every month because nothing is deleted yet.


5. How a social network grows

The right setup depends on size. What's sensible for 1,000 students would be reckless for 10 million, and what's needed for 10 million would waste money at 1,000.

SizeMembersWhat the setup looks like
Pilot (our launch)20 to 1,000One computer, one database; a person reviews every photo, video and unclear post
Growing10,000 to 100,000Two or three computers, a standby database, a cache
Large1 to 10 millionHundreds of computers, the database split across many machines, a team for each area
LinkedIn's sizeAbout 1 billionIts own buildings full of computers, and tools it built itself

In the job sections, "Growing" and "Large" refer to these sizes.


6. Why we skip most of AWS

Almost every AWS product we don't use falls into one of three groups:

  1. It has a minimum price even when nobody uses it. Amazon's recommendation engine costs at least about $389 a month, a dedicated search engine at least $350, and one networking product (NAT Gateway, short for Network Address Translation Gateway, section 7.17) about $33 before it does anything. The first two each cost several times our whole setup.
  2. It solves a problem we don't have yet. A standby database, a cache or a second copy of the app all matter once thousands of people use Thnkrr at once. With 20 to 1,000 students, one computer and one database are plenty.
  3. Every extra product is one more thing to set up, watch and pay for. Each is a new way for something to break. Big companies have teams for this; we have a few people.

When we reach a size where a product makes sense, its job section says so.


7. The jobs, one by one

Each section explains one job behind Thnkrr: what it is, what we'll use, the other AWS options and their prices, and, where useful, what bigger companies do.

Reading the tables: "Price" is what Amazon charges. Where Amazon charges per use (per GB, per minute, per million), the column also gives what that would cost us, where we know.


7.1 The computer that runs the app

What this is. The app has to run all the time: answering every tap and click, running the safety team's review list, converting videos. It needs a computer that never switches off.

What we'll use. One rented computer from EC2 (Amazon's computer rental). It has 2 processors (the parts that do the work) and 4 GB of memory, about as powerful as a good laptop. It costs about $31 a month, including its hard drive and a fixed internet address that never changes. It uses Amazon's own chip (called Graviton), which costs less for the same work.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
LightsailA simpler computer rental with storage and internet traffic bundled into one fixed price; less powerful and harder to connect to other AWS products$24 a monthNot for us: too limited as we grow
FargateRuns the app packed in a "container" (the app plus everything it needs, sealed together); Amazon manages the computers underneathabout $58 a month for the same power as our computerGrowing: when we want two running copies
Auto ScalingWatches how busy our computers are and adds or removes identical ones automaticallyfree (you pay for the computers)Once we have two or more computers
LambdaRuns a small piece of code only when triggered (at a set time, or when a file arrives) and charges per run; each run stops after 15 minutes20¢ per million runs (pennies for us)Small side jobs, like a nightly export
EKS (Elastic Kubernetes Service)Amazon-run Kubernetes, the industry-standard system for spreading hundreds of programs across many computers and restarting any that fail$73 a month, plus the computersLarge: needs a dedicated team
Savings PlansPromise to rent for 1 to 3 years, and pay 30 to 60% less for the computer itself ($25 of the $31)saves about $7 to $15 a monthWhen our free credit runs out

Outside AWS: DigitalOcean rents the same size of computer for about $24 a month.

How bigger companies do it. LinkedIn began as one program, like ours. At about 100 million members it became unstable, so in 2011 the company stopped building new features for two months and split the program into many smaller ones. Splitting only makes sense with many engineers, so each small program has an owner.


7.2 The database

What this is. The database is the app's memory: every account, post, message, review decision and safety case. It must never lose anything, and must find any record in a fraction of a second.

What we'll use. RDS, Amazon's managed database service, running Postgres (the most popular free database software). A small one costs about $14 a month. Amazon handles repairs, daily backups and small updates. Big version upgrades, roughly once a year, are ours to schedule. Because Postgres is free software, we could move to another company without rewriting anything.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
Standby database ("Multi-AZ", short for Multi-Availability Zone, Amazon's term for a data centre)A live, constantly updated twin in a second data centre; takes over automatically in 1 to 2 minutes if the main one failsdoubles the cost (+$14 a month)When schools pay and expect no downtime
Read copyA live, read-only twin that answers look-ups (searches, profile views), leaving the main database free to save new data+$14 a monthGrowing: when the database gets busy
AuroraAmazon's re-engineered Postgres: faster, keeps six copies of the data across three data centres, and switches to a standby more quicklyfrom $57 a monthLarge: when the database is what slows everything down
DynamoDBA different kind of database that finds things by a single key, like a giant dictionary: very fast at any size, but can't combine data the way Postgres can ("posts by my classmates")per use: 63¢ per million savesLarge: billions of chat messages
NeptuneA "graph" database that stores people and the links between them, built for questions like "friends of friends of friends"from $68 a monthLarge: deep connection searches

Watch out: if we skip a big upgrade for too long, Amazon automatically charges an "old version" fee of about $146 a month on our database, ten times its normal price. Upgrading on time avoids it.

Outside AWS: Supabase (from $25 a month) also runs Postgres.

How bigger companies do it. Instagram, Pinterest, Figma and Notion all ran on one ordinary database for years. When it finally got too big, they split their data across many machines, for example one group of customers per machine. LinkedIn eventually built its own database, called Espresso. Lesson 2 has more.


7.3 Speeding things up (the cache)

What this is. Some things are asked for thousands of times: a popular profile, the number of unread messages. Instead of asking the database every time, apps keep a copy in very fast memory: a cache. It's like keeping your most-used things on your desk instead of in a cupboard.

What we'll use. Nothing separate. The database keeps popular data in its own memory, and that's enough at our size.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
ElastiCacheKeeps frequently used data in memory (far faster than disk), shared by every copy of the app; holds copies only, since a restart can wipe itfrom $6 a monthGrowing: when we run two copies of the app
MemoryDBLike ElastiCache, but saves everything safely, so it can be the only place some data livesfrom $25 a monthFor live counters, like a leaderboard

How bigger companies do it. Facebook's cache answers billions of requests a second. The hard part isn't speed; it's keeping copies correct when the original changes. Almost every growing social network adds a cache before anything else.


7.4 Storing photos and videos

What this is. Every uploaded photo and video must be stored safely: private until a reviewer approves it, and kept for years.

What we'll use. S3, Amazon's file storage. It keeps every file on many disks in several data centres, so files are practically never lost. Under $1 a month at the start, about $14 at 1,000 students after a year, because nothing is deleted yet.

S3 can also lock a file so nobody, not even us, can delete it before a set date. We'll use that for records we must keep when a safety case is open, for example for the police.

Cheaper shelves for older files. Like moving old boxes from the living room to the attic, S3 can move files nobody opens any more to cheaper storage:

ShelfPrice per GB a monthThe catchGood for
Standard (what we'll use)2.3¢NoneNew photos and videos
Infrequent Access1.25¢A small fee each time a file is openedPhotos older than a few months
Glacier0.4¢Paid for at least 3 months, even if deleted soonerArchives we rarely open
Glacier Deep Archive0.1¢Takes hours to get a file backRecords kept for years

We'll start moving older files once the founder decides how long we keep things.

Outside AWS: Backblaze B2 is one of the cheapest storage companies; we plan to keep a second copy of our backups there.

How bigger companies do it. Facebook built its own photo storage in 2010 to hold 260 billion photos. Dropbox moved its files off Amazon onto its own machines and reported saving about $75 million over two years. Both only make sense at enormous size; everyone else rents.


7.5 Our web address, and getting pages to phones quickly

What this is. Two related jobs:

What we'll use.

CloudFront can also be told to forget a file instantly. We'll use that when a photo is taken down. Our safety rules give us 2 hours to remove some images, such as private photos shared without permission.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
CloudFront fixed-price planOne fixed monthly price, with a firewall and address book included$15 a month per websiteWhen traffic passes the free amount. We'll run two websites (thnkrr.com, and media.thnkrr.com for photos and videos), so it would cost $30, against about $9 for our firewall and address book today
Amplify HostingBuilds the website from our code each time it changes and hosts it, with a preview copy of every change15¢ per GB sent (about twice CloudFront's price)For websites that need building on every visit; ours doesn't

Outside AWS: Cloudflare, a popular rival delivery network, is free to start.

How bigger companies do it. Netflix built its own delivery network, placing its machines inside internet providers' buildings, because sending video is its biggest cost.


7.6 Checking content and keeping students safe

What this is. Every post, photo and video must be checked for bullying, sexual content, contact details, self-harm and child abuse. Machines help; a person decides.

What we'll use:

What's checkedHowAbout a month at 1,000 students
Writing (posts, comments, messages)An AI model, run on Amazon's Bedrock service, reads each one$15
PhotosAmazon's picture check, Rekognition, flags worrying photos, then a person always reviews them$6
VideosThe speech is turned into text and checked like a post (section 7.7), then a person always watches themnothing extra

Who decides:

Our firm rule on AI: the AI model runs inside our own Amazon account, and Amazon is set not to save anything it reads. Students' writing is never sent to an outside AI company.

Known child-abuse material is checked a different way. Child-safety organisations keep lists of "fingerprints" of known abuse images and videos, and each upload is compared against them. This catches only material already on a list, so human review still matters. Each organisation only shares its list with platforms it has approved, so the founder has to apply to each one. Our app is ready to connect to the lists; which ones we connect is decided before launch.

ListCostChecks
NCMEC (National Center for Missing & Exploited Children, the US child-safety centre)Free; we must applyPhotos
Microsoft PhotoDNAFree; we must applyPhotos
Google CSAI Match (CSAI: Child Sexual Abuse Imagery)Free; we must applyVideos
Project Arachnid (Canada)FreePhotos and videos
IWF (Internet Watch Foundation, UK)Paid membership, about £5,000 a year and upPhotos

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
Bedrock GuardrailsAdjustable filters that block harmful topics or personal information going into or coming out of an AI model15¢ per 1,000 messagesIf we add a feature where AI writes to students
ComprehendAmazon's language-analysis service; its toxicity check scores text for insults, threats and harassment, but can't follow our own rules1¢ per 10,000 charactersNot needed: our AI model follows our rules and understands context better
TextractReads printed and handwritten text, forms and tables from scanned pages and photos of documents$1.50 per 1,000 pagesIf police or courts send us many documents (like court orders) to process

Outside AWS: WebPurify supplies human reviewers at 2¢ an image. Thorn sells tools that spot new abuse material, at about $30,000 a year.

How bigger companies do it. Meta works with over 15,000 human reviewers, while its AI removes most harmful posts before anyone reports them. Roblox built an AI that spots signs of grooming in chats, and in 2025 gave it away free to other companies. Small platforms have people decide and machines sort the list; huge platforms have machines decide obvious cases and people handle the hard ones.


7.7 Video

What this is. Phones record video in many formats. Each uploaded video is converted so it plays everywhere. The reviewer gets a cover image and a sheet of still frames, and the speech is turned into text so it can be checked like a post.

What we'll use. Two free programs running on our rented computer: ffmpeg converts the video and Whisper writes down the speech. Nothing extra to pay. A person watches every video before it goes live.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
MediaConvertConverts uploaded videos into the formats and sizes every phone can play, on Amazon's computers instead of oursabout 1¢ per minute of videoWhen videos start slowing our computer down
TranscribeTurns speech in audio or video into written text, more accurately than Whisper, and can flag abusive speech0.6¢ per minuteIf reviewers spend hours a day on video
Rekognition VideoChecks a video for nudity, violence and similar, frame by frame, and reports where in the video it found them10¢ per minuteNot planned: a person watches every video anyway
IVS (Interactive Video Service)Broadcasts live video to many viewers at once, like Twitch (which Amazon owns)from 20¢ an hourIf we ever add live events

Outside AWS: Mux handles video from upload to playback, but keeps the videos on its side, which makes leaving harder.

How bigger companies do it. Video is the most expensive thing any network handles. Large companies convert videos on separate computers, so a burst of uploads never slows down the rest of the app.


7.8 Email, texts and notifications

What this is. Sending consent emails to parents, sign-in codes, alerts to our staff, and "someone messaged you" notices.

What we'll use.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
End User MessagingSends text messages (SMS, Short Message Service) and pop-up notifications to phone appsabout 1¢ per US text, plus $1 a month for a phone numberIf we add sign-in by text, or a phone app

How bigger companies do it. At large size, notifications become their own system: it decides what's worth sending, bundles messages into daily summaries, and respects quiet hours. The challenge becomes not annoying people, rather than cost.


7.9 Signing in

What this is. Letting students, mentors and teachers sign in safely, and letting our own staff sign in to AWS.

What we'll use.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
CognitoAmazon's ready-made sign-up and sign-in system: login pages, password resets, two-step login, and "sign in with Google or Microsoft"free for 10,000 users a month, then about 1¢ eachMaybe, if schools want "sign in with your school account" at large size

How bigger companies do it. Sign-in becomes a whole security team: spotting stolen passwords, logins from unusual places, and fake accounts.


7.10 Search

What this is. Finding a person by name, even misspelt, filtering by school and interests, and never showing anyone the searcher isn't allowed to see.

What we'll use. Search built into our database. We tested it with a million made-up profiles: names come back in a few thousandths of a second. Free.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
OpenSearchA separate search engine (Amazon's version of Elasticsearch) that keeps its own copy of the data, built for huge collections and finely tuned ranking$350 to $735 a monthLarge: millions of profiles
"Meaning" search (Bedrock plus our database)An AI model turns each post into numbers that describe its meaning, so a search for "building robots" also finds posts about "robotics"pennies a monthWhen we want smarter search of posts

How bigger companies do it. LinkedIn built its own search engine in 2014. In 2025 the grocery app Instacart went the other way: it moved its search off a separate engine and back into its database, because keeping two copies of the data in step caused problems. Databases can do more than people think.


7.11 Background work

What this is. Some work is too slow to make a student wait: converting a video, sending 100 emails, nightly clean-ups. The app puts these jobs on a queue, a to-do list that small background programs (workers) work through.

What we'll use. A free queue that lives inside our database. One less thing to run.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
SQS (Simple Queue Service)Amazon's job queue: holds jobs safely until a worker on any computer picks them up, and retries ones that fail40¢ per million jobs (pennies for us)Growing: when workers move to separate computers
EventBridgeStarts a job on a schedule (every night at 2 am) or when something happens in another Amazon product (a file arrives)$1 per millionWhen we connect Amazon products together
Step FunctionsChains several steps into one process, with waiting and retries, drawn as a flowchart; charged per step2.5¢ per 1,000 stepsLong processes; can get expensive (Lesson 1)
MSK (Managed Streaming for Apache Kafka)A running record of everything that happens in the app (a post, a like, a sign-in), which many systems can readfrom about $87 a monthLarge: many systems need the same information

How bigger companies do it. Around 2010, LinkedIn found every system was building its own pipe to every other system, a growing tangle. So it built Kafka: one central stream of events that every system writes to and reads from. Kafka is now used almost everywhere; Netflix and Uber each pass about a trillion events a day through it.


7.12 Suggestions and "people you may know"

What this is. Suggesting classmates to connect with, mentors to follow, and posts worth seeing.

What we'll use. Simple rules in the database: same school, shared interests, friends of friends. Free.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
PersonalizeLearns from what members click, follow and like, and recommends people or posts; needs a lot of activity to be usefulat least about $389 a monthLarge: millions of users
SageMakerTools for data scientists to train their own AI models on our data and run themfrom about $41 a monthLarge: with a data science team

How bigger companies do it. LinkedIn built its own database for "people you may know", holding about 270 billion connections. After moving to it, LinkedIn could serve 150 times more suggestions a second. The lesson for us: store connections neatly from day one, so they're easy to move later.


7.13 Reports and analytics

What this is. Answering questions like "how many students posted this week, by school?" without slowing down the app, and keeping old records searchable for legal requests.

What we'll use. Simple counts from the database.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
AthenaRuns database-style questions directly on old records saved as files in S3, without loading them back into the database$5 per TB searched (a fraction of a cent for us)Soon, for archived records
QuickSightBuilds charts and dashboards from our data, for people who don't write code$3 a month per viewerWhen the team or schools want dashboards
RedshiftA "data warehouse": a separate database built only for reports over huge amounts of datafrom about $90 a monthLarge: with a data team

How bigger companies do it. LinkedIn built its own reporting database, which powers features like counting who viewed your profile across a billion members.


7.14 Knowing when something breaks

What this is. When something goes wrong we need to know fast, know what broke, and have someone woken up if it's serious.

What we'll use.

CloudWatch costs about $1 to $3 a month, and the health check $1.50. Both are Amazon products, so we also plan a free second check run by a company other than Amazon. That way we'd still hear about it if Amazon itself had problems.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
X-RayTraces one request as it passes through every part of the system, showing where time was spent or where it failed$5 per million requests tracedGrowing: once the app is several programs
SyntheticsA scripted robot that signs in and clicks through key pages on a schedule, and alarms if any step failsabout $10 a monthNot needed while the simple check works

How bigger companies do it. In 2017, an Amazon outage stopped Amazon's own status page from updating, because the page was stored on the very thing that broke. In 2021, Slack's dashboards went down at the same moment as Slack. Your alarm system must not depend on the thing it watches.


7.15 Security

What this is. Blocking attacks, spotting break-ins early, and protecting what we know about children.

What we'll use:

ProtectionWhat it doesPrice
WAF (Web Application Firewall)Checks every incoming request and blocks common attack patterns, such as attempts to break into the database through a formabout $8 a month
Shield StandardAbsorbs floods of fake traffic meant to knock the site overfree
GuardDutyWatches for signs of a break-in and raises an alarmabout $5 to $13 a month
CloudTrailRecords every action anyone takes in our AWS accountfree

GuardDuty spots things like our passwords being used from another country, our computer contacting known criminal addresses, or someone switching off CloudTrail's records. It only warns; a person has to act.

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
InspectorCompares the software installed on our computer against lists of known security holes, and tells us what to updateabout $1.30 a monthSoon: cheap, and schools may ask
Security HubChecks our AWS settings against security best practice and gathers every security warning in one placeabout $4 a monthWhen a school or insurer asks for proof
ConfigKeeps a history of every change to our AWS settings (who changed what, and when) and flags changes that break our rulesa few dollars a monthWhen we need to show auditors our history
MacieScans stored files for personal information (names, ID numbers) and reports where it is$1 per GB checkedNot needed: we know what we store
Shield AdvancedExtra protection and an expert team during big attacks$3,000 a monthVery large, high-profile sites

How bigger companies do it. Large companies run a security team around the clock. The first steps are the same as ours: two-step logins, no shared passwords, a record of every action, and alarms that reach a person.


7.16 Accounts, permissions and passwords

What this is. Deciding who can do what in our AWS account, and keeping passwords and keys safe.

What we'll use:

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
Secrets ManagerStores passwords and changes them automatically40¢ a month per passwordWhen several computers share passwords
KMS (Key Management Service)Encryption keys we create and control: we decide who can use them, and can switch them off$1 a month per keyIf a school requires it
Control TowerSets up several AWS accounts (for example, testing and real use) with safety rules and central record-keeping already in placea few dollars a monthWhen we add a test copy of Thnkrr

7.17 The private network

What this is. Our computer and database sit on a private network, so only the right things can talk to each other. The database accepts only our app. The app accepts visitors only through CloudFront.

What we'll use. Amazon's standard private network (VPC, Virtual Private Cloud), free.

Two costs to watch out for:

How bigger companies do it. When Facebook bought Instagram, the two companies' private networks used clashing addresses, and Instagram had to rebuild its network before it could move. Small choices early can matter years later.


7.18 Backups

What this is. Never losing data: undoing mistakes, surviving a broken database, and even surviving losing our whole AWS account.

What we'll use:

Other AWS options:

OptionIn plain wordsPriceWhen we'd use it
Copies in a second regionBackups also stored in another part of the countrystorage plus copying feesIf a school or law requires it
Elastic Disaster RecoveryKeeps an up-to-date copy of a whole computer in another region, ready to switch on within minutesabout $20 a month per computerWhen recovering in minutes really matters

How bigger companies do it. Netflix runs a tool called Chaos Monkey that switches off its own computers during working hours, to prove the site survives. The rule everyone follows: a backup you've never restored is not a backup.


7.19 Building and releasing new versions

What this is. Testing every change automatically, then putting the new version live without breaking anything.

What we'll use.

Other AWS options: Amazon's own build tools (CodeBuild, CodePipeline) make sense mainly for teams that do everything inside AWS. Three of Amazon's older code tools have closed to new customers since 2024.

How bigger companies do it. LinkedIn tries every new version on a small slice of real users for 30 minutes, and compares it with the old one before everyone gets it. This is called a canary, after the birds miners took underground as an early warning.


7.20 Keeping the bill under control

What this is. Never getting a surprise bill.

What we'll use. Budgets emails us when the month's spending passes $80, and again at $95. Before we reach 1,000 students, we'll raise these to $120 and $140, so they don't go off every month. Cost Anomaly Detection warns about unusual spending. Both are free.

Paying less later: promising to rent for 1 or 3 years (Savings Plans) cuts costs by 30 to 60%. It isn't worth it while free credit pays the bill.

How bigger companies do it. Big companies sign multi-year deals. Pinterest has committed $4 billion to AWS through 2031. Snap committed $2 billion to Google and $1 billion to AWS. The discount comes from the promise.


7.21 Products Amazon is closing

So nobody plans around them:

ProductWhat's happening
App Runner (runs apps for you)No new customers since 30 April 2026
Pinpoint (texts and campaigns)Ends 30 October 2026; its texting continues as End User Messaging (section 7.8)
Kendra (document search)No new customers since 30 July 2026
CodeCommit, Cloud9, CodeCatalyst (code tools)Closed to new customers in 2024 and 2025
Elastic Transcoder (video)Ended November 2025; replaced by MediaConvert

8. Lessons from other companies

Real stories, mostly from the companies' own engineering blogs and outage reports, grouped by what they teach. Some are told in more detail in the job sections above.

Lesson 1: Keep it simple until a real problem forces a change.

For us: one computer and one program is the right choice at launch, not a shortcut.

Lesson 2: One database lasts a long time, and when it doesn't, change it slowly.

For us: if we ever split, the natural unit is the school.

Lesson 3: Outages happen, even at Amazon.

For us: keep a backup at a second company, keep a second alarm check outside Amazon, and accept that a few hours of outage a year is possible at our size.

Lesson 4: Practise for failure.

For us: the practice restore every three months.

Lesson 5: Child safety is shared work, and on by default.

For us: use the shared tools, have a person look at every photo, video and unclear case, and make safety the default.

Lesson 6: Big moves take years, even for giants.

For us: use tools we could leave if we had to (free database software, standard file storage), and don't plan a move we don't need.


9. The whole list of AWS products

Every AWS product in this document. When: Launch (part of the launch plan), Later (when we grow), No (not expected).

JobAWS productWhat it doesWhenPrice
Running the appEC2Rents us a computerLaunch$31 a month
Running the appLightsailSimple fixed-price computerNo$24 a month
Running the appFargateRuns the app in containers on computers Amazon managesLaterabout $58 a month per copy
Running the appAuto ScalingAdds computers when busyLaterfree, plus the computers
Running the appLambdaRuns small code when triggered, charged per runLaterpennies
Running the appEKSAmazon-run Kubernetes for hundreds of programsNo$73 a month, plus computers
Running the appSavings PlansDiscount for renting 1 to 3 yearsLatersaves 30 to 60%
DatabaseRDS (Postgres)Our databaseLaunch$14 a month
DatabaseStandby database (Multi-AZ)Live twin in another data centreLater+$14 a month
DatabaseRead copyHandles look-upsLater+$14 a month
DatabaseAuroraAmazon's faster PostgresLaterfrom $57 a month
DatabaseDynamoDBKey-based database, fast at any sizeNoper use
DatabaseNeptuneGraph database for connections between peopleNofrom $68 a month
CacheElastiCacheShared in-memory copy of popular dataLaterfrom $6 a month
CacheMemoryDBMemory store that survives restartsNofrom $25 a month
FilesS3File storage, with locksLaunchunder $1 to $14 a month
FilesS3 GlacierCheap storage for old filesLater0.1¢ to 0.4¢ per GB a month
Web addressRoute 53Internet address bookLaunchabout $1 a month
MonitoringRoute 53 health checkChecks from outside that the site answersLaunch$1.50 a month
Web addressACMPadlock certificatesLaunchfree
DeliveryCloudFrontSends pages and photos worldwideLaunchfree at our size
DeliveryAmplify HostingBuilds and hosts websitesNo15¢ per GB sent
SafetyBedrockRuns our AI writing checkLaunch$15 a month at 1,000 students
SafetyRekognitionPicture checkLaunch$6 a month at 1,000 students
SafetyBedrock GuardrailsSafety filters for AI featuresLater15¢ per 1,000 messages
SafetyComprehendOlder language checkNo1¢ per 10,000 characters
SafetyTextractReads scanned documentsLater$1.50 per 1,000 pages
VideoMediaConvertConverts videosLater1¢ per minute
VideoTranscribeSpeech to textLater0.6¢ per minute
VideoRekognition VideoChecks every video frameNo10¢ per minute
VideoIVSLive streamingNofrom 20¢ an hour
MessagesSESSends emailLaunchunder $1 a month
MessagesSNSSends staff alarmsLaunchnearly free
MessagesEnd User MessagingTexts and phone-app notificationsLater1¢ per text
Sign-inIAM Identity CenterStaff loginsLaunchfree
Sign-inCognitoReady-made sign-in pagesNofree for 10,000 users
SearchOpenSearchSeparate search engineLaterfrom $350 a month
Background workSQSJob to-do listLater40¢ per million jobs
Background workEventBridgeScheduled and triggered jobsLater$1 per million
Background workStep FunctionsFlowchart jobsNo2.5¢ per 1,000 steps
Background workMSK (Kafka)Shared event streamNofrom $87 a month
SuggestionsPersonalizeReady-made recommendationsNofrom $389 a month
SuggestionsSageMakerBuild our own AI modelsNofrom $41 a month
ReportsAthenaSearches archived filesLater$5 per TB searched
ReportsQuickSightDashboardsLater$3 a month per viewer
ReportsRedshiftData warehouseNofrom $90 a month
MonitoringCloudWatchLogs and alarmsLaunch$1 to $3 a month
MonitoringX-RayFollows one click through the systemLater$5 per million
MonitoringSyntheticsRobot that clicks through the siteNoabout $10 a month
SecurityWAFFirewallLaunchabout $8 a month
SecurityShield StandardAbsorbs fake-traffic floodsLaunchfree
SecurityGuardDutyBreak-in alarmsLaunch$5 to $13 a month
SecurityCloudTrailRecords every actionLaunchfree
SecurityInspectorFinds weak spots in softwareLaterabout $1.30 a month
SecuritySecurity HubSecurity scorecardLaterabout $4 a month
SecurityConfigRecords every setup changeLatera few dollars a month
SecurityMacieFinds personal data in filesNo$1 per GB checked
SecurityShield AdvancedPremium attack protectionNo$3,000 a month
AccountsIAM, OrganizationsWho can do what; account-wide rulesLaunchfree
AccountsParameter StoreStores settings and passwordsLaunchfree
AccountsSession ManagerSafe way into our computerLaunchfree
AccountsSecrets ManagerChanges passwords automaticallyLater40¢ a month per password
AccountsKMSEncryption keys we controlLater$1 a month per key
AccountsControl TowerSeparate test and real accountsLatera few dollars a month
NetworkVPCPrivate networkLaunchfree
NetworkNAT GatewayLets hidden computers reach the internetNoabout $33 a month
BackupsRDS backupsRewinds the database to any minuteLaunchfree
BackupsAWS BackupLocked long-term backupsLauncha few dollars a month
BackupsElastic Disaster RecoveryStandby computer in another regionNoabout $20 a month
ReleasingCloudFormationSets up AWS from written instructionsLaunchfree
ReleasingCodeBuild, CodePipelineAmazon's build toolsNoper minute
BillBudgets, Cost Anomaly DetectionSpending alarmsLaunchfree

10. Sources

All AWS prices are for Amazon's US East (N. Virginia) region, read from Amazon's own pricing pages on 9 and 10 October 2026. More detail is in the production and supplier research notes in the same folder.

AWS prices

Other companies' prices

Company stories

●  Have your own?

// Publish your own markdown.

Write your own