Overview
MyBlog.com is a serverless hosted website.
Requirements:
- Scale globally
- Blogs are rarely written (maybe one a day or a week) but often read by hundreds of thousands of people
- Mostly static files, with a little dynamic REST API
- Caching where possible to save cost and latency
- Every new subscriber receives a welcome email, serverless
- Every uploaded photo gets a thumbnail, serverless
Architecture Evolution
Step 1: Global Static Content with S3 + CloudFront
Clients ──▶ CloudFront edge locations ──caches──▶ S3 bucket
An S3 bucket lives in a specific region. To expose it globally, use Amazon CloudFront, a global CDN. Clients talk to edge locations, which cache data from S3. See 12 - CloudFront & AWS Global Accelerator/01-CloudFront-Overview.
Step 2: Secure the Bucket with OAC
Clients ──▶ CloudFront ──Origin Access Control──▶ S3 (bucket policy allows only the distribution)
Add an Origin Access Control (OAC) and a bucket policy that authorizes only the CloudFront distribution. A user going directly to the S3 bucket is not authorized.
CloudFront with OAC in front of S3
Step 3: Public Serverless REST API
Clients ──HTTPS──▶ API Gateway ──▶ Lambda ──▶ DAX ──▶ DynamoDB
- REST HTTPS through API Gateway, invoking Lambda, reading from DynamoDB.
- Many reads, so DAX is a good caching layer.
- Going global: DynamoDB Global Tables reduce latency in parts of the world.
- No Cognito here, because the REST API is public.
Step 4: Welcome Email Flow
DynamoDB (users) ──Stream──▶ Lambda (IAM role for SES) ──AWS SDK──▶ Amazon SES ──▶ email
- Enable a DynamoDB Stream of changes on the users table.
- The stream invokes a Lambda function with an IAM role that allows Amazon SES.
- SES (Simple Email Service) sends emails; Lambda uses the AWS SDK.
- No infrastructure to manage; it scales well.
Serverless welcome email
Step 5: Thumbnail Generation
Clients ──upload──▶ S3 bucket ──trigger──▶ Lambda ──thumbnail──▶ S3 (maybe another bucket)
- Clients upload to S3 directly, or through CloudFront (with OAC), which forwards to S3. That second option is S3 Transfer Acceleration.
- A new file in S3 triggers Lambda, which creates the thumbnail and puts it in an S3 bucket (could be a different one).
- S3 can also trigger SQS and SNS (optional), so you are free to design the flow.
See 14 - Decoupling Applications SQS SNS Kinesis MQ/07-Amazon-SNS and 14 - Decoupling Applications SQS SNS Kinesis MQ/02-SQS-Standard-Queues.
Thumbnail generation
Summary
| Need | Service |
|---|---|
| Global static content | CloudFront + S3 |
| Restrict S3 to CloudFront | OAC + bucket policy |
| Public serverless REST API | API Gateway + Lambda + DynamoDB |
| Read caching | DAX |
| Global data | DynamoDB Global Tables |
| React to user table changes | DynamoDB Streams → Lambda |
| Send email | SES (Lambda IAM role) |
| React to uploads | S3 events → Lambda / SQS / SNS |
Exam Tips
- CloudFront + S3 for static content, OAC plus bucket policy to secure it.
- DynamoDB Global Tables serve data globally and stay serverless. Aurora Global Database could also be used, but it would be provisioned Aurora, not serverless.
- DynamoDB Streams → Lambda → SES is the serverless email flow. The Lambda needs an IAM role for SES.
- S3 can trigger SQS, SNS and Lambda to notify of events.
- No Cognito needed when the REST API is public.
Q&A
Q1: How do you serve S3 content globally and keep the bucket private?
Answer: CloudFront in front of S3 with Origin Access Control and a bucket policy that only authorizes the distribution.
Q2: How do you make the data global and still serverless?
Answer: DynamoDB Global Tables. Aurora Global Database would be provisioned Aurora, not serverless.
Q3: How do you send a welcome email to a new subscriber, serverlessly?
Answer: Enable DynamoDB Streams on the users table, invoke Lambda from the stream, and give it an IAM role to send via SES.
Q4: How do you generate thumbnails for uploaded photos?
Answer: An S3 event triggers Lambda, which writes the thumbnail to S3. S3 can also notify SQS or SNS.
Check yourself
Quiz
Flashcards
Click the card (or focus it), then use ← → to move and Space to flip.