From Homelab to AWS: What Running My Own Infrastructure Taught Me Before Touching the Cloud
Already running a homelab or a few Docker projects? You know more about AWS than you think. Here's what carries over, what doesn't, and why building infrastructure is the first step to securing it.
When I started learning AWS, I expected everything to feel new. It didn't. Most of the concepts already had a name in my head, because I'd spent months breaking and rebuilding my own homelab on Proxmox. The cloud wasn't a new world; it was the same world with managed services and a bill at the end of the month.
This article is for anyone with a homelab, a VPS, or a few Docker projects who wonders whether that experience counts. It does, and here's how it maps.
The mental map
| What I ran at home | What AWS calls it |
|---|---|
| Proxmox virtual machines | EC2 instances |
| Networks and firewall rules | VPCs, subnets, security groups |
| Traefik reverse proxy | Elastic Load Balancing (ALB/NLB) |
| GitHub Container Registry | Amazon ECR |
| GitHub Actions pipelines | GitHub Actions + OIDC, or CodePipeline |
| Prometheus and Grafana | Amazon CloudWatch |
| Manual setup and scripts | Terraform / CloudFormation |
The table hides a lot of detail, but it changed how I studied. Instead of memorizing services, I started asking: what problem does this solve that I've already solved by hand?
What transferred directly
Containers. Writing multi-stage Dockerfiles for my projects taught me to keep images small and builds reproducible. That knowledge goes straight to ECS, Fargate, or EC2.
CI/CD. Building, tagging, and pushing images automatically from GitHub Actions is the same workflow on AWS. The main difference is where the image lands and how the pipeline authenticates.
Reverse proxies and routing. Configuring Traefik forced me to understand ports, TLS termination, and how traffic reaches a container. That made load balancers easy to reason about.
What didn't transfer (and where I'm learning the most)
Identity is everything. At home, I'm root on everything. In AWS, IAM decides who can do what, and a single overly broad policy can expose an entire account. Learning least privilege properly is the biggest shift from homelab thinking.
The network is software. In a homelab, the network is something you plug in. In AWS, it's defined in code, which means it can be reviewed, versioned, and also misconfigured at scale.
Everything costs money. A forgotten VM at home costs electricity. A forgotten NAT Gateway in AWS shows up on the bill. Budgets and alerts are the first thing I'd set up in any new account.
Why this matters for security
My long-term goal is security engineering, and this is what convinced me that learning cloud isn't a detour. Most modern breaches don't start with clever exploits; they start with misconfigurations: a public bucket, a leaked access key, a security group open to the world. You can't spot those mistakes if you've never built the thing yourself.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article