Cursos en esta ruta
Aws Core Services
Start AWS from zero and build a real end-to-end architecture with your own hands — without ever entering a credit card. The guide follows Andes Cargo, a fictional LATAM logistics company that needs to move its shipment manifests and inventory tracking off a laptop and into the cloud, and uses that thread to build the mental model of "the cloud" (managed services, the shared responsibility model, regions and availability zones) plus the four services that carry 80% of what gets built on AWS: IAM (identity and least privilege), S3 (object storage), EC2 + VPC (compute and the minimal network to run it), and Lambda + DynamoDB (event-driven processing and a managed NoSQL database). Everything runs against LocalStack, the emulator that replicates AWS's real API in Docker, so every command is the same `aws`/`awslocal` you'd run against a real account, with literal, verified JSON output. The thread is cumulative: the VPC from module 2 hosts the EC2 instance from module 5, the IAM roles from module 3 get attached to Lambda and EC2, the S3 bucket from module 4 triggers the Lambda function from module 6, which writes to the DynamoDB table from module 7 — and the module 8 capstone runs that full flow, from file upload to final query, with executed evidence at every step. This is the guide that opens the AWS Cloud ecosystem: it doesn't teach Terraform, containers, Kubernetes, CI/CD, SRE, or multi-account security — it builds the foundation those sibling guides build on.
64 lecciones
Docker Essentials Guide
Master Docker for AI applications: build optimized images, containerize FastAPI + LLM apps, orchestrate multi-service stacks with Docker Compose (API + ChromaDB + Redis), and apply production best practices including multi-stage builds, secrets management, and health checks. Your gateway to production deployment.
64 lecciones
Deployment & Cloud Infrastructure Guide
Master deployment strategies for AI systems: understand when to use Local, Serverless, Managed or Self-hosted; learn AWS (S3, Lambda, SageMaker basics) with LocalStack at zero cost; evaluate modern alternatives (Render, Railway, Fly.io); and build a complete decision matrix to choose the right deployment strategy. From Docker containers to production-deployed AI systems.
64 lecciones
Terraform And Iac
This guide takes the Andes Cargo stack built by hand, command by command, in the AWS Core Services Guide and teaches you to stop creating infrastructure manually and start declaring it. It covers HCL in depth (`resource`, `data`, `variable`, `output`, `locals`, `module`), the `init`/`plan`/`apply`/`destroy` cycle and the idempotency behind it, and dedicates its heaviest module to Terraform's `state`: what it is, why it's the source of truth, how drift gets detected, how to import infrastructure that already exists (the exact real-world problem Andes Cargo has, since it was created by hand in the previous guide), and why a poorly secured state is one of the least-taught security risks in the discipline. It builds two reusable modules (`s3-bucket`, `iam-role`) and uses them to declare the same four canonical Andes Cargo resources — the bucket, both IAM roles, and the Lambda function with its DynamoDB table — proving that a single `terraform apply` recreates what used to require a manual checklist, and a single `terraform destroy` cleans it all up. The capstone runs the same code with OpenTofu, Terraform's open-source fork, and dedicates a lesson to a real March 2026 incident where an AI agent ran `terraform destroy` against production infrastructure without anyone carefully reviewing the plan — installing the rule that no `apply` or `destroy` ever runs without reading the full plan first. Everything runs $0 against the same LocalStack lab from the previous guide.
64 lecciones
Aws Serverless And Containers
This guide continues directly from the AWS Core Services Guide, using the same Andes Cargo case and the same LocalStack lab, to teach the two real ways compute gets designed in production AWS: serverless in depth and containers. The Lambda function that processed shipment manifests becomes a production-grade function with layers, concurrency, and secrets; it gets wrapped in a Step Functions workflow with explicit retries and error handling; the direct S3 trigger gets decoupled with an EventBridge event bus, complete with its own dead-letter queue; and a REST API Gateway unifies HTTP access to everything Andes Cargo exposes. On that same thread, the guide builds `andes-cargo-status-api`, an always-on service (unlike a function that only runs on events), packaged in Docker, pushed to a registry, and run with ECS's cluster/task-definition/service model on Fargate. The guide is upfront about a real limitation: LocalStack's free plan doesn't include ECR or ECS, so those two modules execute the real mechanics with plain Docker and a local registry, and show verified command syntax and output as reference, leaving LocalStack's paid plan as an optional, never-required path. The capstone runs the event-driven flow end to end and documents the container path, closing with the "when Lambda, when a container" criterion installed since the first module.
64 lecciones
Monitoring & Observability Guide
Master the observability of AI systems in production with OpenTelemetry, the industry standard for 2026. Learn to instrument LLM applications with traces for prompts, embeddings, and tool calls, build dashboards for latency and cost, design alerting strategies, implement AI-specific monitoring (prompt quality, token usage, model drift), and debug production issues like hallucinations and cost spikes. Integrates with LangSmith and monitoring backends.
64 lecciones
Kubernetes And Eks In Production
Gives Andes Cargo the orchestrator it was missing: `andes-cargo-status-api`, the containerized component that the Serverless and Containers guide built but left "documented, never executed" on ECS, finally runs for real against a genuine Kubernetes cluster. This guide uses `kind` — real Kubernetes, not a simulator — as its $0 lab, with the strongest executable backbone in the ecosystem so far: nearly everything runs with no paid-plan limit whatsoever. It builds the workload primitives (Pod, Deployment, Service) up to production level with externalized configuration, `liveness`/`readiness`/`startup` probes, and horizontal autoscaling driven by real metrics; the cluster's networking model with `Ingress` and `NetworkPolicy`; real pull-based GitOps with ArgoCD over its own Git repository (Gitea, running inside the same cluster) that converges the system's state without anyone running a manual `kubectl apply`; real admission control with two engines (OPA Gatekeeper and Kyverno) that reject an object before it ever comes into existence; and container image scanning with Trivy. It closes with a module specific to EKS — managed node groups, Fargate profiles, IRSA/EKS Pod Identity, node autoscaling with Karpenter, the AWS Load Balancer Controller — shown and explained in depth but declared representative with exact honesty: EKS is only available on LocalStack's Ultimate plan, and even paying for it doesn't faithfully reproduce the real managed control plane. The capstone runs the full system end to end, with one change that passes the gate and one that the admission webhook stops.
64 lecciones
Cicd And Gitops On Aws
This guide takes the Andes Cargo Terraform project, finished by hand in the Terraform and IaC Guide, and teaches you to stop running `terraform apply` from your laptop and start running it inside a pipeline. It distinguishes continuous integration, continuous delivery, and continuous deployment, defines GitOps (Git as the source of truth for infrastructure, not just code), and dissects the full anatomy of a GitHub Actions workflow. It builds the industry-standard pattern — `fmt`/`validate`/`plan` run on every Pull Request as the artifact reviewed before merging, and `apply` run automatically only when that PR merges to `main` — covers secrets management and why a long-lived AWS credential in a repository is the most-cited security antipattern in the market, shows the federated OIDC pattern in real YAML, and teaches approval environments, concurrency control, and scheduled drift detection. The rollback module teaches the infrastructure-specific pattern (revert the commit, let the same pipeline re-apply) and builds a real guardrail that fails the job if a change tries to destroy Andes Cargo's data table — revisiting the real `terraform destroy` incident from the previous guide by asking whether a pipeline would have prevented it. Everything runs $0 and reproducibly with `act`, the tool that executes real GitHub Actions YAML in local Docker, against the same LocalStack lab from the previous guides — with explicit honesty about what `act` cannot simulate (environment approvals, branch protection, real PR comments), each labeled at the exact point it appears.
64 lecciones
Sre And Incident Response
Operates, with the discipline of SRE, everything the six prior guides in the AWS Cloud ecosystem already built on top of Andes Cargo: a system can pass the security gate and the cost gate and still fail in production, because "reliable" isn't a state — it's a measurement. This guide teaches the real math of SLI/SLO/error budget with a Python calculator that actually runs, first on fixed data and then on real metrics from Andes Cargo's Lambda read through CloudWatch, Prometheus, Grafana, and OpenTelemetry traces in Jaeger — observability treated as the input to that math, not a full instrumentation discipline. It builds alerting based on error-budget burn rate (the multi-window pattern from the real Google SRE book) instead of loose thresholds, and assembles the full incident lifecycle with roles, severity levels, and an on-call rotation designed with honesty about its human cost. At the center of the guide, it operates end to end the real Claude Code `destroy` incident that the three prior guides already used as a warning: here its timeline gets reconstructed, its severity classified, it gets declared and mitigated with the framework just built, and it closes with a blameless postmortem following the real Google SRE template and an operational runbook verified against LocalStack. The capstone runs a new, deterministic synthetic incident through the whole machine.
64 lecciones
Cloud Security And Guardrails
This guide takes the Andes Cargo Terraform project and pipeline left working by the three previous guides and teaches that a green pipeline is not a secure pipeline. It starts with threat modeling using the STRIDE framework applied to Andes Cargo's real infrastructure inventory, producing a threat model document that governs the rest of the guide. It builds real federated OIDC identity infrastructure (the identity provider, a least-privilege trust policy) against LocalStack, honest about the exact limit of what a free lab can validate for a real token, and tightens Andes Cargo's existing IAM roles to least privilege. It migrates secrets from a plain-text file to SSM Parameter Store and Secrets Manager, and scans the repository for leaked credentials. The guide's executed core is preventive policy-as-code: writing Rego policies with `conftest`/OPA that evaluate a Terraform `plan` before it can even be applied, replacing the handmade guardrail built in the CI/CD guide. It adds static IaC scanning with Trivy and Checkov, and real software supply chain work: generating an SBOM and signing/verifying a deployment artifact with `cosign`, fully offline, demonstrating that verification actually catches tampering. It closes by distinguishing preventive from detective guardrails and chaining `conftest` → Trivy → `cosign` into a real security gate inside the inherited pipeline, tested with a change that passes and one that gets stopped before applying.
64 lecciones
Finops And Cost Guardrails
Puts a price and a budget on the Andes Cargo project the four prior AWS Cloud guides already built and secured: same case, same LocalStack at $0, same GitHub Actions pipeline. A clean `plan`, a secure pipeline, and a successful `apply` say nothing about whether a decision is financially sustainable — this guide teaches FinOps as a discipline (Inform, Optimize, Operate) and uses Infracost to produce a real dollar estimate of a `terraform plan` before it's applied, with no AWS account required. From there it builds a hand-rolled cost gate in the PR (two scans, a delta computed with `jq`, a threshold that stops the `apply`) as a third pipeline lane, independent from the existing security gate; cost-allocation tagging policies evaluated with `conftest` in their own directory; budgets and billing alarms taken as far as LocalStack lets you verify them, with the exact technical reason when it doesn't; and rightsizing measured with real Infracost numbers, not rules of thumb, to decide between `PAY_PER_REQUEST` and `PROVISIONED` for DynamoDB. It closes with a capstone that runs the cost gate and the security gate in parallel on the same pipeline, never merging them.
64 lecciones
Genai On Aws Production
Adds Andes Cargo's first generative AI workload: an extractor that kicks in when the inherited deterministic manifest parser can't read free-text input, invoking an Amazon Bedrock model as an escalation path, never as the default. This is the only guide in the ecosystem where no real model invocation runs inside the lab — Bedrock requires a paid account and is only available on LocalStack's Ultimate plan — so it declares the entire infrastructure as real code (`terraform validate`/`plan` genuinely verified, with no LocalStack or AWS account needed), builds Bedrock Guardrails' six policies as HCL, and complements them with its own defense-in-depth layer (a PII scrubber and an output schema validator, both deterministic and tested with `pytest`). It extends the security gate and cost gate the sibling guides already built (least-privilege IAM for `bedrock:InvokeModel`, a new cost policy) and computes per-token cost with its own calculator, since Infracost can't price a volume assumption nobody declared. It applies SLI/SLO vocabulary to AI metrics (escalation rate, guardrail block rate, latency) and closes with a capstone that runs the cheap path end to end and documents, with exact honesty, where the executable stops and the representative begins. It doesn't teach prompt engineering, RAG, agents, or semantic evaluation — that's AI Engineering territory; this guide teaches how to operate, not build, the AI system.
64 lecciones
Aws Saa Certification
Prepares for the AWS Certified Solutions Architect – Associate exam (SAA-C03) with a real edge: instead of explaining services over slides, it rereads Andes Cargo — the infrastructure the nine prior AWS Cloud ecosystem guides already built and operated hands-on — through the lens of the exam's four official domains (Secure 30%, Resilient 26%, High-Performing 24%, Cost-Optimized 20%). Unlike those nine guides, this one deliberately breaks the "every command actually ran" rule: preparing for an exam isn't building new infrastructure, it's consolidating vocabulary and judgment over what was already operated, and learning — honestly conceptually, with reference architecture diagrams, never faking execution that didn't happen — the services the exam requires that no $0 lab could touch (RDS/Aurora, real load balancing, EC2 Auto Scaling, CloudFront, hybrid storage and connectivity, migration services). The heart of the guide is its practice questions: 100% original, never copied or paraphrased from real question banks, with scenarios drawn from Andes Cargo and new fictional businesses, each with a full explanation of why the correct answer is right and why every distractor fails. It closes with a complete practice exam weighted to the exam's real domain proportions, a self-performance analysis, exam-day strategy, and an honest reflection on what a certification is actually worth.
64 lecciones
Technical English and Employability
Learn to work and apply for jobs in English: read documentation without translating, write PRs, bug reports, and design documents in plain English, hold your own in a standup and a demo out loud, and run a job search with market judgment. The seven modules start from your actual target — the role, the market, and the English gap that separates you from it — and move through the fundamentals of reading and listening to technical English, written async communication (chat, issues, PRs, commits), writing technical documents in plain language (design docs, ADRs, READMEs, postmortems), spoken technical English (standups, meetings, pair programming, demos), your professional materials (an ATS-ready résumé, LinkedIn, portfolio), and the full hiring process. The final project is the Employability Kit: a cumulative, interview-defensible dossier with your target-role brief, a portfolio with a design doc and ADR, an async communication package, a tailored résumé, and three unscripted English recordings — a pitch, a demo, and a mock interview.
56 lecciones