Level 0 · Design Todo.io
What actually happens when you add a todo?
Pick how Todo.io runs and where it keeps its data. Then watch a login, read, create, update or delete travel through AWS, one step at a time.
1. Where does the code run?
EC2A virtual serverYou rent a virtual computer and run the Todo.io web server on it, 24/7.ECS on FargateA containerYou package Todo.io as a container and AWS runs it for you. No server to manage.LambdaA functionYou upload just the code. AWS runs it only when a request arrives, behind API Gateway.
2. Two databases, two ways in
RDS MySQLTables and SQLA classic relational database. Rows and columns, queried with SQL, logged into with a username and password.
DynamoDBItems and API callsA NoSQL database run entirely by AWS. Every read and write is an AWS API call that IAM approves.
You can switch database, compute and action at the top of every journey.
Words you'll meet
- AWS account
- A container for AWS resources, with its own identities and its own bill.
- Root user
- The identity you sign in as with the account's email address. It can do almost anything; only an SCP can limit it.
- MFA (multi-factor authentication)
- A second proof of identity, like a code from an app or a security key, on top of a password.
- AWS Organizations
- Groups many AWS accounts under one management account, with one bill and shared guardrails.
- SCP (service control policy)
- An organization-wide guardrail that sets the most any identity in an account may do.
- IAM Identity Center
- One place for people to sign in and get access to many AWS accounts.
- Permission set
- A reusable bundle of permissions that Identity Center turns into a role in each account you assign it to.
- AWS Control Tower
- Sets up and governs a multi-account AWS environment (a landing zone) for you.
- Landing zone
- A ready-made, well-run multi-account AWS environment that your apps can "land" in.
- Account Factory
- Control Tower's way to create new AWS accounts from a standard template.
- Controls (guardrails)
- Control Tower's rules for every account in an OU. Some block, some report, some check before deploying.
- Region
- A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).
- VPC (Virtual Private Cloud)
- Your own private network inside an AWS Region.
- Subnet
- A slice of a VPC's addresses that lives in one Availability Zone.
- Internet gateway
- The VPC's door to the public internet.
- Public IP address
- An address the whole internet can reach.
- Security group
- A firewall attached to a network card, listing what traffic is allowed in and out.
- ENI (Elastic Network Interface)
- A virtual network card that gives something an address in a subnet.
- NAT gateway
- Lets things in private subnets reach out to the internet, while nothing can reach in.
- EC2 (Elastic Compute Cloud)
- Rent a virtual server by the second.
- ECS and Fargate
- Run containers on AWS. With Fargate, AWS also runs the servers underneath.
- Lambda
- Upload a function; AWS runs it only when something calls it.
- API Gateway
- A managed HTTPS front door that passes requests to your code.
- WebSocket (API Gateway WebSocket API)
- An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.
- IAM (Identity and Access Management)
- Decides who can do what to which AWS resource.
- IAM role
- An identity with permissions that something can "wear" temporarily. No password.
- IAM policy
- A JSON document listing allowed (or denied) actions on resources.
- ARN (Amazon Resource Name)
- The unique full name of an AWS resource.
- Temporary credentials
- Short-lived AWS keys handed out for a role, which expire automatically.
- Service-linked role
- A role an AWS service creates and owns so it can act in your account on its own behalf.
- iam:PassRole
- The permission to hand an existing role to an AWS service.
- RDS (Relational Database Service)
- A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.
- DynamoDB
- A fully managed NoSQL database you use through AWS API calls.
- S3 (Simple Storage Service)
- Unlimited storage for files ("objects") in containers called buckets.
- CloudWatch Logs
- Where applications and AWS services send their log lines.
- CloudTrail
- A record of every AWS API call. Who did what, when, from where.
- AWS Config
- Records how your resources are configured over time and checks them against rules.
- SQS (Simple Queue Service)
- A managed queue. One part of your system drops messages in, another takes them out later.
- Dead-letter queue (DLQ)
- A side queue where messages go after failing too many times.