The core four · 1 of 4
Compute
Where does the code run?
Todo.io's code has to run somewhere. Level 0 gives you three answers to the same question; each trades how much you manage against how you pay.
The answers at Level 0
EC2Rent a virtual server by the second.Renting a computer you have to look after yourself.ECS + FargateRun containers on AWS. With Fargate, AWS also runs the servers underneath.Handing over a packed lunchbox and letting someone else heat it up.LambdaUpload a function; AWS runs it only when something calls it.A taxi. You pay for the ride, not for owning the car.
Side by side
| EC2 | ECS + Fargate | Lambda | |
|---|---|---|---|
| Who patches the servers | You: the operating system and everything on itwhy | AWS (with Fargate)why | AWSwhy |
| How long it runs | Until you stop itwhy | As long as it needswhy | At most 15 minutes per callwhy |
| How you pay | Per second while running (one-minute minimum)why | Per second for the vCPU and memory a task asks forwhy | Per request and per millisecond; idle costs nothingwhy |
| Its AWS permissions | A role, through an instance profilewhy | A task role (and a task execution role for ECS itself)why | One execution rolewhy |
| In your VPC? | Yes, in a subnet | Yes: each task gets its own network cardwhy | Not by default; attach it only to reach private things like RDSwhy |
| Its logs | Only with the CloudWatch agent installedwhy | Through the awslogs driverwhy | Sent automaticallywhy |
Also in this pillar
Work that can wait
Not everything has to happen while you wait. An SQS queue holds jobs until a worker function picks them up, and a dead-letter queue catches the ones that keep failing.
See it in a request
- Add a todo: EC2 + RDS MySQL4. Who are you?
- Add a todo: ECS on Fargate + RDS MySQL4. Who are you?
- Add a todo: Lambda + DynamoDB3. Wake up the function4. Who are you?
- Add a todo with a background job4. Who are you?7. Drop a job in the queue10. The worker picks it up12. Job done13. If the worker keeps failing
What you need to know
Every Level 0 fact about this pillar's words. The exam and quizzes only ask about these.
EC2 (Elastic Compute Cloud) Rent a virtual server by the second.
- With EC2 you get a server: patching the operating system and everything on it is your job. AWS runs the hardware.
- The AMI decides what a server starts with (operating system and software); the instance type decides its size (CPU and memory).
- On-Demand Linux instances are billed per second while running, with a one-minute minimum. A stopped instance only pays for its disk.
- An app on EC2 gets AWS permissions from a role attached through an instance profile, never from access keys in files or user data.
- EC2 doesn't send logs by itself: install the CloudWatch agent and let the instance's role write logs.
ECS and Fargate Run containers on AWS. With Fargate, AWS also runs the servers underneath.
- A running container (or group of containers) is a task. An ECS service keeps the number of tasks you ask for, replacing any that stop.
- With the Fargate launch type, AWS runs and patches the servers; you choose CPU and memory per task. Tasks can run as long as they need.
- With Fargate you pay for the vCPU and memory a task asks for, by the second, from when its image starts downloading until the task stops (one-minute minimum for Linux).
- ECS has two roles: the task role is what your code may do; the task execution role is what ECS needs to start the task (pull the image, send logs).
- Each Fargate task gets its own ENI, with a private IP and its own security groups.
- Container output reaches CloudWatch Logs through the
awslogslog driver, using the task execution role.
Lambda Upload a function; AWS runs it only when something calls it.
- A function runs for at most 15 minutes. Longer jobs belong on Fargate, or need splitting up.
- You pay per request and per millisecond of run time (scaled by memory size). An idle function costs nothing.
- By default a function runs outside your VPC and can reach public AWS services. Attach it to a VPC only to reach private things like RDS; then it needs a NAT gateway to reach public services.
- Each function has exactly one execution role: everything its code can do in AWS.
- Lambda sends whatever a function prints to CloudWatch Logs automatically, as long as the execution role allows writing logs.
- Lambda polls an SQS queue for you (an event source mapping). Set the queue's visibility timeout to at least six times the function's timeout, or messages get processed twice.
- AWS runs the servers, the operating system and the scaling. Your code, and what its role allows, stay yours.
SQS (Simple Queue Service) A managed queue. One part of your system drops messages in, another takes them out later.
- A queue decouples sender and receiver: the sender drops a message and moves on. Bursts wait safely instead of overloading the database, and slow work happens in the background.
- Messages wait 4 days by default, up to 14, so a worker can be down for a while without anything being lost.
- A received message is hidden for the visibility timeout, not deleted. If the worker doesn't delete it in time, it reappears and is retried.
- Standard queues deliver at least once (occasionally twice) and not always in order, so workers must be idempotent. FIFO queues keep strict order and process each message exactly once.
- Sending and receiving are AWS API calls approved by IAM, for example
sqs:SendMessageon the queue's ARN.
Dead-letter queue (DLQ) A side queue where messages go after failing too many times.
- A redrive policy moves a message to the dead-letter queue after
maxReceiveCountfailed receives, so one bad message doesn't retry forever. - A DLQ must be the same type as its source: a FIFO queue needs a FIFO DLQ.