Building, deploying and operating applications on AWS. CI/CD pipelines are in CI-CD Pipelines.

Services at a glance

Using AWS from Code

SDKs (Boto3 for Python, AWS SDK for JS/Java/.NET/Go). Credentials resolve through the default provider chain: environment variables → shared credentials/config file (~/.aws) → container role → instance profile / execution role. In AWS, attach a role instead of embedding keys.

import boto3

s3 = boto3.client("s3")
s3.put_object(Bucket="my-unique-bucket-12345", Key="hello.txt", Body=b"hello")

table = boto3.resource("dynamodb").Table("Orders")
table.put_item(Item={"OrderId": "1001", "Total": 99})

• Retries with exponential backoff and jitter for throttling (429, ThrottlingException); SDKs do this by default
• Pagination: use paginators or NextToken / LastEvaluatedKey
• Pre-signed URLs for direct browser uploads to S3

Serverless

Lambda (recap and deeper)

Basics in 3. AWS Compute.

• Event source mappings poll SQS, Kinesis, DynamoDB Streams, then invoke Lambda with a batch; use ReportBatchItemFailures for partial failures
• Invocation types: synchronous (API Gateway), asynchronous (S3, SNS; retries twice then DLQ / destinations), polling
• Environment variables, encrypted with KMS; fetch real secrets from Secrets Manager
• Versions and aliases with weighted routing for canary deploys (CodeDeploy automates this)
• /tmp ephemeral storage up to 10 GB; connect to a VPC only if needed
• Reuse SDK clients outside the handler to exploit warm containers
• Idempotency: handlers may run more than once, design for duplicates

Step Functions

Visual state machines orchestrating Lambda and 200+ services in Amazon States Language (JSON). Standard (up to 1 year, exactly-once) vs Express (high volume, up to 5 min, at-least-once). Handles retry, catch, parallel, map, wait.

API Gateway / AppSync

5. AWS Networking for API Gateway. AppSync is managed GraphQL with real-time subscriptions and resolvers to DynamoDB / Lambda.

Messaging and Events

SQS details

• Visibility timeout: message hidden while a consumer processes; delete after success or it reappears
• Long polling (WaitTimeSeconds up to 20) reduces empty responses and cost
• Dead-letter queue after maxReceiveCount failures
• Delay queues, message retention up to 14 days, size up to 256 KB (larger via S3)

Fan-out pattern: SNS topic → many SQS queues, each consumer independent.

$ aws sqs create-queue --queue-name orders
$ aws sqs send-message --queue-url <url> --message-body '{"id":1}'
$ aws sqs receive-message --queue-url <url> --wait-time-seconds 10

Infrastructure as Code

CloudFormation

Declarative templates (YAML / JSON) create stacks.

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  UploadBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration:
        Status: Enabled
Outputs:
  BucketName:
    Value: !Ref UploadBucket

• Change sets preview changes, drift detection, rollback on failure, StackSets for multi-account/region
• Intrinsic functions: !Ref, !GetAtt, !Sub, !ImportValue

SAM (Serverless Application Model)

CloudFormation extension with short resource types (AWS::Serverless::Function, Api, SimpleTable).

$ sam init
$ sam build
$ sam local invoke HelloFunction
$ sam deploy --guided

CDK

Define infrastructure in TypeScript, Python, Java, C# or Go; synthesises to CloudFormation.

$ cdk init app --language typescript
$ cdk synth
$ cdk deploy

Developer Tools (AWS-native CI/CD)

Security for Developers

• Cognito user pools issue JWTs, pair with API Gateway authorizer
• IAM roles for every compute service; STS for temporary credentials
• KMS: GenerateDataKey for envelope encryption, caching data keys to reduce calls
• Secrets Manager with rotation; Parameter Store SecureString
• ACM for TLS certificates
• Details in 2. AWS IAM and Security

Observability

• CloudWatch Metrics: namespaces, dimensions, custom metrics (PutMetricData), standard resolution (1 min) and high resolution (1 s)
• CloudWatch Logs: log groups / streams, Insights queries, metric filters, retention, subscription filters
• CloudWatch Alarms drive SNS notifications or Auto Scaling
• EventBridge scheduled rules (cron)
• X-Ray: distributed tracing, service map; annotations (indexed, searchable) vs metadata
• CloudTrail: API audit

fields @timestamp, @message
| filter @message like /ERROR/
| sort @timestamp desc
| limit 20