Step 4 — Application Services & Serverless

Modern AWS architectures rarely wire services together directly. Queues, event buses, CDNs, and serverless compute let you build loosely coupled systems that scale independently. This step covers the glue that holds cloud applications together.

AWS Lambda — Serverless Compute

Lambda runs your code without you managing any servers. You upload a function, define what triggers it, and AWS handles everything else — provisioning, scaling, patching, and billing.

How Lambda Works

Trigger ──► Lambda Function ──► Action
  │            (your code)        │
  │            ├── Runtime: Python 3.12, Node 20, Java 21, etc.
  │            ├── Memory: 128 MB – 10,240 MB
  │            ├── Timeout: max 15 minutes
  │            └── Ephemeral storage: /tmp up to 10 GB
  │
Triggers:
  ├── API Gateway (HTTP request)
  ├── S3 event (file uploaded)
  ├── DynamoDB Stream (item changed)
  ├── SQS message
  ├── EventBridge rule
  ├── CloudWatch Events (scheduled)
  └── SNS notification

Lambda Pricing

Pay only for:

• Requests: $0.20 per 1 million (first 1M free)
• Duration: $0.0000166667 per GB-second (first 400,000 GB-seconds/month free)

A function using 512 MB running for 100ms costs $0.0000083334 per invocation. For most workloads, Lambda is dramatically cheaper than keeping an EC2 instance running.

Lambda Concurrency

Concurrency = number of function instances running simultaneously.

Default burst limit: 3,000 concurrent executions (varies by region)
Default account limit: 1,000 concurrent executions

Reserved Concurrency: guarantee minimum, and cap maximum for a function
Provisioned Concurrency: pre-warm instances → eliminates cold starts

Cold start problem: When Lambda needs a new instance, it downloads your code and initializes your runtime. This adds 100ms–2s latency. Use Provisioned Concurrency for latency-sensitive APIs. Lambda SnapStart (Java) reduces cold starts by taking snapshots after initialization.

Lambda with VPC

Lambda functions run outside your VPC by default. To access resources in a private subnet (RDS, ElastiCache), configure Lambda to use a VPC. AWS now uses hyperplane ENIs — VPC Lambda no longer has the slow cold start penalty it had before 2020.

API Gateway

API Gateway is the front door for your Lambda functions and HTTP backends. It handles authentication, rate limiting, HTTPS, request transformation, and versioning.

REST API vs HTTP API vs WebSocket

REST API (v1)          — Full features: usage plans, API keys, request validation,
                         caching, X-Ray. Higher cost.
HTTP API (v2)          — 71% cheaper than REST API. JWT authorizers, AWS services proxy.
                         Missing: API keys, usage plans, caching.
WebSocket API          — Bidirectional persistent connection. Chat apps, real-time feeds.

2026 recommendation: Use HTTP API unless you need REST API’s advanced features (caching, per-method throttling, API keys for third-party monetization).

Deployment Stages and Throttling

Every API Gateway deployment targets a stage (dev, staging, prod). Each stage has its own URL, settings, and can be rolled back independently.

Throttling defaults: 10,000 requests per second (RPS) per region, 5,000 burst. Configure method-level throttling to protect backend Lambda or ECS from overload.

Caching: REST API stages can cache responses (0.5 GB–237 GB). Reduces backend calls and latency. Cache TTL default is 300 seconds.

SQS — Simple Queue Service

SQS is the messaging backbone for decoupled architectures. A producer sends a message to the queue; one or more consumers poll and process it.

Standard vs FIFO Queues

Standard Queue                    FIFO Queue
──────────────────────────────    ──────────────────────────────────
At-least-once delivery            Exactly-once processing
Best-effort ordering              Strict ordering guaranteed
Nearly unlimited TPS              300 TPS (3,000 with batching)
Best for: high-throughput tasks   Best for: financial transactions,
                                   order processing

Key SQS Concepts

Visibility Timeout: After a consumer picks up a message, it becomes invisible to other consumers for this duration (default 30s, max 12h). If the consumer doesn’t delete the message before timeout, it reappears — enabling retry on failure.

Dead Letter Queue (DLQ): Messages that fail processing N times are moved to a DLQ for inspection. Every production SQS queue should have a DLQ.

Long Polling: Instead of polling continuously (and paying per empty request), set WaitTimeSeconds=20. The queue holds the connection open up to 20 seconds until a message arrives. Reduces cost and latency.

Message Retention: 4 days default, up to 14 days.

SNS — Simple Notification Service

SNS is a publish/subscribe service. Publishers send to a topic; all subscribed endpoints receive a copy simultaneously. This fan-out pattern is the primary reason SNS and SQS are used together.

SNS + SQS Fan-Out Pattern

S3 Upload Event ──► SNS Topic "new-uploads"
                          ├──► SQS Queue A ──► Lambda: Generate thumbnail
                          ├──► SQS Queue B ──► Lambda: Virus scan
                          └──► SQS Queue C ──► Lambda: Update database

Result: S3 event triggers three independent processes in parallel.
        Each queue has its own retry/DLQ logic.
        Services are fully decoupled.

SNS Subscription types: SQS, Lambda, HTTP/HTTPS, Email, SMS, Mobile Push (iOS/Android/Windows).

SNS FIFO Topics — Paired with SQS FIFO queues for strict ordering in fan-out. Each subscription gets messages in order.

SNS Message Filtering — Subscribers can set a filter policy so they only receive messages matching specific attributes. Reduces noise and processing cost.

Amazon EventBridge

EventBridge is the next-generation event bus — more powerful than SNS for routing events from AWS services, custom apps, and SaaS providers to targets.

Event Sources:                    EventBridge Bus:        Targets:
─────────────                     ──────────────          ────────────────
AWS services (EC2, S3, etc.)  ──► Default Bus    ──►     Lambda
Custom applications           ──► Custom Bus     ──►     Step Functions
SaaS apps (Salesforce, etc.)  ──► Partner Bus    ──►     SQS / SNS
                                                  ──►     API Gateway
                                                  ──►     ECS Task

EventBridge Rules — Pattern matching on event content. Route “EC2 instance state changed to terminated” to a Lambda that sends a Slack alert. Far more flexible than CloudWatch Events (which EventBridge replaced).

EventBridge Pipes — Point-to-point integrations with filtering, enrichment, and transformation. Connect SQS to Lambda with filtering in between — no custom code for the routing layer.

Scheduled Expressions — Replace cron jobs: rate(5 minutes) or cron(0 12 * * ? *).

CloudFront — Content Delivery Network

CloudFront is AWS’s CDN: it caches content at 450+ edge locations globally, reducing latency for end users and reducing load on your origin.

How CloudFront Works

User (Tokyo) ──► CloudFront Edge (Tokyo)
                      │
                      ├── Cache HIT? ──► Return cached response (fast)
                      │
                      └── Cache MISS ──► Fetch from Origin ──► Cache + Return

Origins:
  ├── S3 Bucket (static content, SPA)
  ├── ALB (dynamic content)
  ├── EC2 instance
  └── Custom HTTP server (on-premises)

CloudFront Key Features

Origin Access Control (OAC) — Restricts S3 bucket access so only CloudFront can read it. Replaces the older Origin Access Identity (OAI). Exam: “serve S3 content only through CloudFront, block direct S3 access” → OAC.

Signed URLs and Signed Cookies — Control who can access content. Signed URL for single file access (e.g., premium video download). Signed Cookies for multiple files (e.g., entire subscriber content library).

CloudFront Functions vs Lambda@Edge — Both run code at edge locations, but differ in capability and latency:

CloudFront Functions — Sub-millisecond. Viewer request/response only.
                        Header manipulation, URL rewrites, A/B testing.
Lambda@Edge         — Milliseconds. All four event types.
                        Dynamic content generation, authentication, complex logic.

HTTPS and SSL/TLS — CloudFront provides free SSL certificates via ACM. Custom domains + HTTPS requires certificate in us-east-1 (this is tested).

Route 53 — DNS and Traffic Routing

Route 53 is AWS’s DNS service and can do sophisticated traffic routing based on health, geography, latency, and weight.

Routing Policies

Simple          — One record, no health checks.
Weighted        — Split traffic by percentage. A/B testing, blue/green.
Latency-Based   — Route to Region with lowest latency to user.
Geolocation     — Route based on user's country or continent.
Geoproximity    — Route based on geographic location + bias factor (requires Traffic Flow).
Failover        — Primary/secondary. Routes to secondary if primary health check fails.
Multi-Value     — Returns multiple healthy IPs. Not a substitute for ELB.
IP-Based        — Route based on client's CIDR block. New in 2023.

Health Checks — Route 53 monitors endpoints and can trigger failover routing. Three types: endpoint, calculated (aggregates other health checks), and CloudWatch alarm.

Alias Records — Like a CNAME but free of charge for AWS resources and works at the zone apex (e.g., example.com without www). Always use Alias over CNAME for AWS resources (ELB, CloudFront, S3 website).

Route 53 Resolver

Inbound Endpoints — Allow on-premises DNS servers to query Route 53 for Private Hosted Zone records.

Outbound Endpoints — Allow VPC resources to query on-premises DNS servers. Essential for hybrid architectures.

Exam Patterns