Hosted Zones

Record Types

Routing Policies

Step 1: Create an S3 bucket for static hosting

Step 2: Create a hosted zone

Step 3: Create an ALIAS record

Step 4: Verify

The Execution Model

Function Configuration

IAM Execution Role

Function URLs – HTTPS Without API Gateway

Response Streaming

Step 1: Write the function

Step 2: Build and package

Step 3: Create the execution role

Step 4: Create the function

Step 5: Invoke and inspect

API Types

Integration Types

Stages and Deployments

Custom Domains

Step 1: Create the HTTP API

Step 2: Create a Lambda integration

Step 3: Create routes

Step 4: Allow API Gateway to invoke Lambda

Step 5: Deploy to the default stage

Step 6: Test

Logs

Metrics

Alarms

Step 1: Create an SNS topic for alerts

Step 2: Create the alarm

Step 3: Trigger an error to verify

State Types

Standard vs Express

Input/Output Processing

Error Handling

The state machine definition

Deploy and test

Equivalent setup: Lambda + HTTP API + DynamoDB

Deploy

Infrastructure testing

serverless.yml Structure

Packaging Go Functions

Plugins

Multi-Stage Config

Project structure

Full serverless.yml

Deploy

Inspect what was created

Tear down

Prerequisites

Remote State

Variables

Lambda + API Gateway + DynamoDB

Build, Deploy, and Tear Down

Multi-Stage with Workspaces

The Split Deployment Pattern

The Identity Landscape in 2026

Policy Anatomy

Policy Evaluation Order

Inline vs Managed Policies

Roles Over Users for Services

ABAC – Attribute-Based Access Control

Permission Boundaries

Step 1: List what your function is actually doing

Step 2: Write a scoped policy for each function

Step 3: Verify with IAM Policy Simulator

Step 4: Check for unused permissions

The Three Load Balancer Types

Target Groups

Health Checks

HTTPS Termination

Routing Rules

Step 1: Create a VPC (if you don’t have one)

Step 2: Create a security group for the ALB

Step 3: Create the ALB

Step 4: Create a Lambda target group

Step 5: Add an HTTPS listener with routing

Step 6: Point Route 53 at the ALB

The Data Model

Storage Classes

Lifecycle Policies

Security Model

Versioning

Event Notifications

Step 1: Create two buckets

Step 2: Lambda function to generate thumbnails

Step 3: Grant Lambda access to both buckets

Step 4: Wire the notification

Step 5: Test

Topics and Subscriptions

Message Structure

Message Filtering

FIFO Topics

Fan-Out Pattern

Step 1: Create the SNS topic

Step 2: Create three SQS queues

Step 3: Subscribe queues to the topic with filters

Step 4: Allow SNS to write to SQS queues

Step 5: Publish a test event

Standard vs FIFO

Message Lifecycle

Dead-Letter Queues

Lambda + SQS Integration

Long Polling vs Short Polling

Architecture

Step 1: Create queue with DLQ

Step 2: Upload API Lambda (enqueue)

Step 3: Wire Lambda consumer with ReportBatchItemFailures

Step 4: DLQ alarm

The Data Model

Key Design

On-Demand vs Provisioned Capacity

Read Consistency

Global Secondary Indexes (GSI)

Local Secondary Indexes (LSI)

DynamoDB Streams

Import from S3

Export to S3

Step 1: Create the table

Step 2: Write an order

Step 3: Fetch all orders for a user

JWT Structure

RS256 vs HS256

Amazon Cognito

Lambda Authorizer

Step 1: Create a test user

Step 2: Sign in and get tokens

Step 3: Call the protected endpoint

Step 4: Read the userId in the order Lambda

Setting Up a User Pool

Using Cognito’s Built-In JWT Authorizer on HTTP API

When to Write a Lambda Authorizer Instead

SSM Parameter Store

AWS Secrets Manager

When to Use Which

Reading Secrets in Lambda

Step 1: Store the parameters

Step 2: Grant Lambda access by path

Step 3: Load all params at cold start with GetParametersByPath

Step 4: Set up automatic rotation for the payment API key

Step 5: Reference SSM in serverless.yml

KMS Key Types

Key Policies

Envelope Encryption

Creating a CMK

Key Format

Implementation

Wire as a Lambda Authorizer

Repository Structure

Tag Immutability

Authentication

Lifecycle Policies

Vulnerability Scanning

Cross-Account Access

Replication

Step 1: Create the repository

Step 2: Build the image

Step 3: Authenticate and push

Step 4: Verify the push and scan results

Step 5: Set the lifecycle policy

Multi-Stage Builds

Base Image Choices

Building for the Right Platform

Layer Ordering for Build Cache

Runtime Configuration

Health Checks

The ECS Primitives

Fargate vs EC2

Task Definitions

Networking: awsvpc Mode

ECS Service Connect

Service Creation

Auto Scaling

Deployments

Step 1: Create the cluster

Step 2: Create the CloudWatch log group

Step 3: Register the task definition

Step 4: Create the service

Step 5: Watch the deployment

Step 6: Deploy a new version

Step 7: Debug a running task

Logs Insights: Production Query Patterns

Composite Alarms

Container Insights

Contributor Insights

Embedded Metric Format (EMF)

Step 1: Create the dashboard

dashboard.json structure

Step 2: Alarm on SQS DLQ depth

Step 3: Logs Insights saved query for post-incident analysis

The On-Call SNS Topic

PagerDuty

OpsGenie

AWS Chatbot (Slack)

Auto-Resolve Incidents with OK Actions

Escalation Policy

Test Before the First Real Incident

Parallel State

Map State

Distributed Map

SDK Integrations — No Lambda Required

HTTPS Endpoints — State Machines as APIs

The Saga Pattern

WaitForTaskToken

The Pipeline Structure

GitHub Actions Fundamentals

IAM Role for GitHub Actions

Security in CI/CD

Step 1: Store AWS account ID as a GitHub secret

Step 2: Create the workflow file

Step 3: Test the pipeline

Lambda-Heavy (Parts 1–3)

With ECS Fargate (Part 4)

Cost Control Levers

Lambda

API Gateway

DynamoDB

SQS

SNS

Step Functions

ECS Fargate

ECR

CloudWatch

Subnets

Route Tables

Internet and NAT Gateways

Creating Security Groups

Security Groups in Terraform

Lambda in a VPC

Common Security Group Mistakes

Lambda

API Gateway

CloudWatch Logs

DynamoDB

S3

Step Functions

ECR

ECS Fargate

AWS Budgets

Cost Explorer

Trusted Advisor

Event Buses

Rules and Targets