You log in · EC2 + DynamoDB

Your browser sends POST /login over HTTPS.

POST /login HTTP/1.1
Host: todo.io
Content-Type: application/json

{"email":"sam@example.com","password":"••••••••"}

todo.io points at the instance's public IP, so the request comes in through the VPC's internet gateway. The public IP changes if the instance is stopped and started (an Elastic IP stays put), so the DNS record has to follow it. In Level 2 todo.io points at a load balancer's DNS name instead, which never changes.

Exam tipA subnet is "public" only because its route table sends 0.0.0.0/0 to an internet gateway. Nothing else makes it public.

The security group around the instance allows HTTPS on port 443, so the request reaches the web server.

• 🛡Security group todo-app-sg: TCP 443 from 0.0.0.0/0Allowed

Type    Protocol  Port  Source
HTTPS   TCP       443   0.0.0.0/0

Exam tipThe classic way to do HTTPS is a free AWS Certificate Manager (ACM) certificate on a load balancer or CloudFront (Level 2). Since 2025 ACM can also sell you an exportable certificate to install on the instance or container itself.

The app reads your email and password. You're a customer of Todo.io, not an IAM user, so AWS has no idea who you are.

Exam tipYour app's customers are never IAM principals. IAM is for the people and software that manage or call AWS itself.

The app gets temporary credentials for its IAM role (the instance profile) from the instance metadata service, which lives on the host itself. No keys are stored in the code.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Exam tipNever store access keys on an instance. Attach a role through an instance profile; the SDK fetches its credentials from 169.254.169.254.

The app calls GetItem on the DynamoDB API over HTTPS, signed with those credentials. It leaves through the internet gateway because DynamoDB is a public AWS service, not something inside your VPC.

{
  "TableName": "Users",
  "Key": {
    "email": {
      "S": "sam@example.com"
    }
  }
}

Exam tipA VPC gateway endpoint (Level 1) keeps this traffic off the internet, and it costs nothing.

DynamoDB checks with IAM: may todo-app-ec2-role do dynamodb:GetItem here? The policy on the role allows it on the table's ARN.

• 🔑IAM todo-app-ec2-role: dynamodb:GetItem on table/UsersAllowed

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem"
      ],
      "Resource": [
        "arn:aws:dynamodb:us-east-1:111122223333:table/Users",
        "arn:aws:dynamodb:us-east-1:111122223333:table/Todos"
      ]
    }
  ]
}

Exam tipIAM starts from deny. A request is only allowed if some policy explicitly allows it and nothing explicitly denies it.

DynamoDB returns your user item, including the stored password hash.

The app hashes the password you typed and compares it with the stored hash. They match, so it starts a session for you.

• ✓App Password hash matchesAllowed

You get 200 OK plus a session cookie, so your next requests prove who you are.

HTTP/1.1 200 OK
Set-Cookie: session=eyJ1c2VySWQiOiJ1LTEyMyJ9.Zm9v; HttpOnly; Secure

Exam tipSecurity groups are stateful: a reply to an allowed request goes back out automatically. No outbound rule needed for it.

The app's log line goes to CloudWatch Logs so Todo.io's engineers can see what happened. Like SQS, it's a public AWS service, so it leaves through the internet gateway.

2026-10-11T18:42:07Z INFO POST /login user=u-123 status=200 14ms

Exam tipEC2 doesn't send logs by itself. You install the CloudWatch agent and give the instance role permission to write logs.