You add a todo · Lambda + RDS MySQL

10 steps from your browser to the database and back. Then a background job finishes the work.

Runs on

EC2 ECS on Fargate Lambda

Database

RDS MySQL DynamoDB

Action

Add-ons

Background job Live updates

Text version of this diagram.

What sits where:

AWS Region · us-east-1: A Region is a part of the world where AWS has data centers. Most things you build live in one Region. us-east-1 is in northern Virginia. contains:
- VPC: Virtual private cloud: your own private network inside AWS. Nothing gets in or out except the ways you allow. contains:
  - Public subnet · to IGW: A slice of the VPC that can reach the internet directly, through the internet gateway (IGW). contains:
    - NAT gateway (one-way exit): Lets things in a private subnet start connections out to the internet, while nothing outside can start one in.
  - Private subnet · to NAT: A slice of the VPC with no door to the internet. Things here can reach out through the NAT gateway, but nothing outside can reach in. contains:
    - ENI (function's network card): Elastic network interface: a virtual network card. It gives the function an address inside your VPC.
    - RDS MySQL (database: todoio): A MySQL database that AWS runs for you, including the server, patches and backups. todoio is the database's name.
    - ENI (worker's network card): Elastic network interface: a virtual network card. It gives the worker an address inside your VPC.
  - Internet gateway (the VPC's door): The door between a VPC and the internet. Without one, nothing in the VPC can talk to the internet directly.
- API Gateway (HTTP API · front door): The front door for the app's web requests: it receives each one and hands it to your code. An HTTP API is its simple kind for ordinary requests.
- CloudWatch Logs (app log lines): Collects the lines your app writes about what it's doing (its logs), so you can search them later.
- Lambda function (runs once per request): Code that AWS runs only when a request arrives. No server to look after, and you pay per request.
- Worker Lambda (updates monthly stats): A second Lambda function that does slow work in the background, taking jobs off the queue.
- SQS queue (todo-events): Simple Queue Service: a waiting line for messages. One part of the app drops a job in; another picks it up later.
- Dead-letter queue (todo-events-dlq): A dead-letter queue: where a message goes after failing several times, so someone can look at it instead of it being retried forever.
Your browser (on the internet)

Steps, in order:

You add a todo. Path: Your browser. Your browser sends POST /todos over HTTPS.
Into the front door. Path: Your browser → API Gateway. The request arrives at API Gateway, a managed HTTPS front door. There's no server or firewall for you to look after.
Wake up the function. Path: API Gateway → Lambda function. API Gateway invokes your Lambda function and hands it the request as an event. Checks: iam: Lambda resource policy: API Gateway may invoke todo-api → allow.
Who are you?. Path: Lambda function. The app checks your signed session cookie and finds your user id, u-123. This is the app's own login, not AWS.
Step into the VPC. Path: Lambda function → ENI. The database lives in a private subnet of a VPC, so the function is attached to that VPC. AWS gives it an ENI (a network card) in the private subnet.
Ask the database. Path: ENI → RDS MySQL. The app sends SQL to RDS MySQL in the private subnet on port 3306. It logs in with a database username and password, not with IAM. Checks: security-group: todo-db-sg: TCP 3306 from todo-lambda-sg → allow; mysql: MySQL user todo_app: INSERT on todoio.todos → allow.
The database answers. Path: RDS MySQL → ENI → Lambda function. MySQL says: 1 row inserted, new id 42.
Drop a job in the queue. Path: Lambda function → ENI → NAT gateway → Internet gateway → SQS queue. The app sends a message to an SQS queue saying a todo was created, instead of doing the slow work now. It's attached to the VPC with no public IP, so it gets out through a NAT gateway and the internet gateway. Checks: iam: todo-app-lambda-role: sqs:SendMessage on todo-events → allow.
Back to you. Path: Lambda function → API Gateway → Your browser. You get 201 Created, and "Buy milk" appears in your list.
Leave a note. Path: Lambda function → CloudWatch Logs. Lambda sends what the function printed to CloudWatch Logs, so Todo.io's engineers can see what happened.
The worker picks it up. Path: SQS queue → Worker Lambda. Lambda keeps polling the queue for you and runs the worker function with the new message. Checks: iam: todo-worker-role: sqs:ReceiveMessage, sqs:DeleteMessage → allow.
Save the result. Path: Worker Lambda → ENI → RDS MySQL. The worker adds 1 to your monthly stats in RDS MySQL. It's attached to the VPC too, with its own ENI in the private subnet. Checks: security-group: todo-db-sg: TCP 3306 from todo-worker-sg → allow; mysql: MySQL user todo_worker: INSERT, UPDATE on todoio.user_stats → allow.
Job done. Path: Worker Lambda → SQS queue. The worker returns without an error, so the Lambda service deletes the message from the queue. Your code never deletes it.
If the worker keeps failing. Path: SQS queue → Dead-letter queue. If the worker fails on the same message 3 times, SQS moves it to a dead-letter queue. It isn't lost, and it stops being retried forever.

Step 1 of 14

Your browser sends POST /todos over HTTPS.

Show me the real thing

The HTTP request

POST /todos HTTP/1.1
Host: abc123.execute-api.us-east-1.amazonaws.com
Cookie: session=eyJ1c2VySWQiOiJ1LTEyMyJ9.Zm9v
Content-Type: application/json

{"title":"Buy milk"}

The request arrives at API Gateway, a managed HTTPS front door. There's no server or firewall for you to look after.
API Gateway invokes your Lambda function and hands it the request as an event.
- 🔑IAM Lambda resource policy: API Gateway may invoke todo-apiAllowed
Show me the real thing
Resource-based policy on the function: who may call it
```
{
  "Effect": "Allow",
  "Principal": {
    "Service": "apigateway.amazonaws.com"
  },
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:us-east-1:111122223333:function:todo-api",
  "Condition": {
    "ArnLike": {
      "AWS:SourceArn": "arn:aws:execute-api:us-east-1:111122223333:abc123/*"
    }
  }
}
```
Exam tipThis is a resource-based policy. It lives on the function and says who may call it, the opposite of a policy attached to a role.
The app checks your signed session cookie and finds your user id, u-123. This is the app's own login, not AWS.
The database lives in a private subnet of a VPC, so the function is attached to that VPC. AWS gives it an ENI (a network card) in the private subnet.
Exam tipA Lambda ENI never gets a public IP, so a VPC-attached function can't reach the internet, even from a public subnet. It needs a NAT gateway. Classic exam trap.
The app sends SQL to RDS MySQL in the private subnet on port 3306. It logs in with a database username and password, not with IAM.
- 🛡Security group todo-db-sg: TCP 3306 from todo-lambda-sgAllowed
- 🗄MySQL MySQL user todo_app: INSERT on todoio.todosAllowed
Show me the real thing
The SQL (real code sends the values as parameters, never pasted into the string)
```
INSERT INTO todos (user_id, title, done) VALUES ('u-123', 'Buy milk', false);
```
Exam tipA security group rule can use another security group as its source: "anything wearing todo-lambda-sg may connect". Exam favourite.
MySQL says: 1 row inserted, new id 42.
The app sends a message to an SQS queue saying a todo was created, instead of doing the slow work now. It's attached to the VPC with no public IP, so it gets out through a NAT gateway and the internet gateway.
- 🔑IAM todo-app-lambda-role: sqs:SendMessage on todo-eventsAllowed
Show me the real thing
SendMessage request
```
{
  "QueueUrl": "https://sqs.us-east-1.amazonaws.com/111122223333/todo-events",
  "MessageBody": "{\"type\":\"todo.created\",\"userId\":\"u-123\",\"todoId\":\"42\"}"
}
```
Exam tipA Lambda attached to a VPC needs a NAT gateway (or a VPC endpoint) to reach anything outside the VPC, even AWS services like SQS.
You get 201 Created, and "Buy milk" appears in your list.
Show me the real thing
The HTTP response
```
HTTP/1.1 201 Created
```
Lambda sends what the function printed to CloudWatch Logs, so Todo.io's engineers can see what happened.
Show me the real thing
The log line
```
2026-10-11T18:42:07Z INFO POST /todos user=u-123 status=201 14ms
```
Exam tipLambda sends whatever your function prints to CloudWatch Logs automatically, as long as the execution role allows logs:PutLogEvents.
Meanwhile, in the background
Lambda keeps polling the queue for you and runs the worker function with the new message.
- 🔑IAM todo-worker-role: sqs:ReceiveMessage, sqs:DeleteMessageAllowed
Show me the real thing
The event the worker receives (trimmed)
```
{
  "Records": [
    {
      "messageId": "19dd0b57-b21e-4ac1",
      "eventSource": "aws:sqs",
      "eventSourceARN": "arn:aws:sqs:us-east-1:111122223333:todo-events",
      "body": "{\"type\":\"todo.created\",\"userId\":\"u-123\",\"todoId\":\"42\"}"
    }
  ]
}
```
Exam tipSQS never pushes. Lambda polls it for you (an "event source mapping"). Set the queue's visibility timeout to at least 6× the function's timeout.
The worker adds 1 to your monthly stats in RDS MySQL. It's attached to the VPC too, with its own ENI in the private subnet.
- 🛡Security group todo-db-sg: TCP 3306 from todo-worker-sgAllowed
- 🗄MySQL MySQL user todo_worker: INSERT, UPDATE on todoio.user_statsAllowed
Show me the real thing
The SQL
```
INSERT INTO user_stats (user_id, month, created) VALUES ('u-123', '2026-10', 1)
  ON DUPLICATE KEY UPDATE created = created + 1;
```
Exam tipStandard queues deliver at least once, so the same message can arrive twice and count your todo twice. Real workers are idempotent: they record each message id and skip repeats.
The worker returns without an error, so the Lambda service deletes the message from the queue. Your code never deletes it.
Exam tipIf the worker throws, the message isn't deleted. It becomes visible again after the visibility timeout and is retried.
If something goes wrong
If the worker fails on the same message 3 times, SQS moves it to a dead-letter queue. It isn't lost, and it stops being retried forever.
Show me the real thing
Redrive policy on todo-events
```
{
  "deadLetterTargetArn": "arn:aws:sqs:us-east-1:111122223333:todo-events-dlq",
  "maxReceiveCount": 3
}
```
Exam tipA dead-letter queue must be the same type as its source queue: a FIFO queue needs a FIFO DLQ.

What to notice

There is no server at all. API Gateway takes the request and Lambda runs your code only when one arrives.
IAM never checked your SQL. MySQL has its own users; IAM only manages the database server itself.
The database sits in a private subnet with no route to the internet. Only the security groups you allowed can reach it.
The database password lives in the app config here. In production it belongs in Secrets Manager (Level 1).
To reach a database in a VPC, the function had to be attached to that VPC.
Every Lambda copy opens its own MySQL connection, and a traffic spike can exhaust them. RDS Proxy pools connections (Level 2).
You got your answer before the job ran. The queue lets slow work happen later without making you wait.
If the worker breaks, messages wait in the queue, and after 3 failures they land in the DLQ. Nothing is lost.
A Lambda in a VPC can't reach public AWS services by itself, so this VPC needed a NAT gateway.
You, the customer, were never an IAM user. IAM controls the app, not its customers.