Overview
MyTodoList is a mobile app built as a serverless architecture.
Requirements:
- Expose a REST API with HTTPS endpoints
- Serverless architecture
- Users interact directly with their own folder in S3 to manage their data
- Users authenticate through a managed serverless service
- Users write and read to-dos, but mostly read, so performance matters
- The database layer must scale and have very high read throughput
Architecture Evolution
Step 1: Classic Serverless REST API
Mobile client ──HTTPS──▶ API Gateway ──▶ Lambda ──▶ DynamoDB
- Amazon API Gateway gives the REST HTTPS endpoints.
- API Gateway invokes a Lambda function, so compute scales and stays serverless.
- Lambda stores and reads to-dos in DynamoDB, a database that scales well and is serverless.
See 16 - Serverless Overviews/11-Amazon-API-Gateway, 16 - Serverless Overviews/02-AWS-Lambda, 16 - Serverless Overviews/09-Amazon-DynamoDB.
Classic serverless REST API
Step 2: Authentication with Cognito
Mobile client ──authenticate──▶ Cognito
Mobile client ──HTTPS──▶ API Gateway ──verifies with──▶ Cognito
Amazon Cognito is the serverless authentication layer. The mobile client authenticates to Cognito, and API Gateway verifies the authentication with Cognito. This is the very classic serverless API. See 16 - Serverless Overviews/13-Amazon-Cognito.
Step 3: Direct Access to the User's S3 Space
Mobile client ──authenticate──▶ Cognito ──temporary credentials──▶ Mobile client
Mobile client ──store/retrieve files──▶ S3 (own space)
Cognito generates temporary credentials and returns them to the mobile client. With them the client stores and retrieves files in its own space in S3, through a restricted policy.
The wrong answer is storing AWS user credentials on your mobile clients. Use Cognito with temporary credentials.
Cognito authentication and S3 access
Step 4: Scale Reads with DAX
The app grows and the access pattern shows very high read throughput (many RCUs). To-dos rarely change. So how do we improve read throughput and cut cost?
Mobile client ──▶ API Gateway ──▶ Lambda ──▶ DAX ──▶ DynamoDB
- Put DynamoDB DAX in front of DynamoDB as a caching layer.
- Reads are served from the cache, so DynamoDB needs fewer read capacity units.
- Result: better scaling and lower overall cost.
Step 5: Cache at API Gateway
Besides DAX, you can cache responses at the API Gateway level. This works well if answers never really change, and you can cache a few responses for a few API routes.
Caching with DAX and API Gateway
Summary
| Need | Service |
|---|---|
| REST HTTPS API | API Gateway |
| Serverless compute | Lambda |
| Serverless database | DynamoDB |
| Authentication (integrated with API Gateway) | Cognito |
| User access to own S3 space | Cognito temporary credentials + restricted policy |
| Cache DynamoDB reads | DAX |
| Cache REST responses (static answers) | API Gateway caching |
Nothing is managed by you. You pay per usage and do not manage databases. The same Cognito pattern also lets the app reach DynamoDB or Lambda directly.
Exam Tips
- Classic serverless REST API: HTTPS + API Gateway + Lambda + DynamoDB.
- Cognito generates temporary credentials for S3 access. Never put AWS user credentials on the client.
- DAX is an easy way to enable caching: better performance and lower cost.
- REST request caching is done at the API Gateway level when responses are very static.
- Security for the whole stack: Cognito, directly integrated with API Gateway.
Q&A
Q1: How do mobile users get access to their own S3 folder?
Answer: Authenticate with Cognito, which returns temporary credentials that allow storing and retrieving files in S3 under a restricted policy. Never store AWS user credentials on the mobile client.
Q2: The app has a very high read throughput on rarely edited to-dos. What do you change?
Answer: Add DAX before DynamoDB. Reads are cached, so fewer RCUs are needed, which improves scale and reduces cost.
Q3: Is there another place to cache?
Answer: Yes, API Gateway response caching, good when answers rarely change for some API routes.
Q4: How is the API secured?
Answer: Cognito, integrated directly with API Gateway, which verifies the authentication with Cognito.
Check yourself
Quiz
Flashcards
Click the card (or focus it), then use ← → to move and Space to flip.