Skip to content
LinuxUnity
Back to projects
AWS · Lab

Serverless API on AWS

An event-driven API lab focused on access control, repeatable deployment, and structured logging.

Placeholder content
AWSLambdaAPI GatewayDynamoDBTerraform
Role
Cloud Engineer
Timeline
May 2026
Type
Lab
Status
In progress
Infrastructure
AWS · Lambda · API Gateway
Repository
Not published

Problem

Create an API that requires no server administration and provides enough telemetry for troubleshooting.

Sample content for layout validation. Replace it with verified implementation evidence before presenting this as a completed case study.

Constraints

  • No personal data
  • No secrets in logs
  • Performance claims require real tests

Success criteria

  • Repeatable deployment
  • Traceable failures
  • Authorization and validation tests

Architecture

The architecture separates clear responsibilities so each component can be tested, operated, and changed independently.

API Gateway

Provides the HTTP entry point and request controls.

Lambda

Runs business logic with scoped permissions.

DynamoDB + CloudWatch

Persists data and captures operational logs.

Implementation

The work is organized into phases with explicit tools and verifiable outputs.

  1. Design

    Define the API contract

    Describe resources, errors, and data boundaries.

    Tools: OpenAPI · Output: API contract draft
  2. Provision

    Model resources

    Declare API Gateway, Lambda, and DynamoDB.

    Tools: Terraform · Output: Infrastructure draft
  3. Build

    Build handlers

    Implement validation and structured errors.

    Tools: AWS Lambda · Output: Handler draft
  4. Secure

    Scope access

    Design per-function IAM and input controls.

    Tools: IAM · Output: Control checklist
  5. Observe

    Standardize logging

    Define fields and alarm candidates.

    Tools: CloudWatch · Output: Telemetry specification
  6. Optimize

    Plan measurements

    Define tests before tuning memory and concurrency.

    Tools: Lambda Power Tuning · Output: Test plan

Security

These items describe concrete controls or work that still requires verification.

  • Per-function IAM and input validation remain under design.

Observability

  • Structured logs are included in the test plan.

Results

  • The API contract and test plan are drafts.
  • No load-test or cost results are published yet.

Challenges and lessons learned

Challenge

There is no traffic baseline for tuning.

Approach

Keep configuration provisional until tests are available.

Lesson

Default settings are not performance evidence.