You delete a todo · Lambda + RDS MySQL

Your browser sends DELETE /todos/42 over HTTPS.

DELETE /todos/42 HTTP/1.1
Host: abc123.execute-api.us-east-1.amazonaws.com
Cookie: session=eyJ1c2VySWQiOiJ1LTEyMyJ9.Zm9v

The request arrives at API Gateway, a managed HTTPS front door. There's no server or firewall for you to look after.

API Gateway invokes your Lambda function and hands it the request as an event.

• 🔑IAM Lambda resource policy: API Gateway may invoke todo-apiAllowed

{
  "Effect": "Allow",
  "Principal": {
    "Service": "apigateway.amazonaws.com"
  },
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:us-east-1:111122223333:function:todo-api",
  "Condition": {
    "ArnLike": {
      "AWS:SourceArn": "arn:aws:execute-api:us-east-1:111122223333:abc123/*"
    }
  }
}

Exam tipThis is a resource-based policy. It lives on the function and says who may call it, the opposite of a policy attached to a role.

The app checks your signed session cookie and finds your user id, u-123. This is the app's own login, not AWS.

The database lives in a private subnet of a VPC, so the function is attached to that VPC. AWS gives it an ENI (a network card) in the private subnet.

Exam tipA Lambda ENI never gets a public IP, so a VPC-attached function can't reach the internet, even from a public subnet. It needs a NAT gateway. Classic exam trap.

The app sends SQL to RDS MySQL in the private subnet on port 3306. It logs in with a database username and password, not with IAM.

• 🛡Security group todo-db-sg: TCP 3306 from todo-lambda-sgAllowed
• 🗄MySQL MySQL user todo_app: DELETE on todoio.todosAllowed

DELETE FROM todos WHERE id = 42 AND user_id = 'u-123';

Exam tipA security group rule can use another security group as its source: "anything wearing todo-lambda-sg may connect". Exam favourite.

MySQL says: 1 row deleted.

Exam tipCloudTrail records AWS API calls like DeleteDBInstance, but it never sees the rows your SQL deletes.

The app looks up your connection id in the database and posts a message to it through the WebSocket API. It's attached to the VPC with no public IP, so it gets out through a NAT gateway and the internet gateway.

• 🔑IAM todo-app-lambda-role: execute-api:ManageConnectionsAllowed

POST /prod/@connections/Ab3xYzEXAMPLE= HTTP/1.1
Host: ws123.execute-api.us-east-1.amazonaws.com

{"type":"todo.deleted","todoId":"42"}

Exam tipA Lambda attached to a VPC needs a NAT gateway (or a VPC endpoint) to reach anything outside the VPC, even AWS services like SQS.

Every Todo.io tab you have open, on any device, shows the change without a refresh.

You get 204 No Content, and the todo disappears.

HTTP/1.1 204 No Content

Lambda sends what the function printed to CloudWatch Logs, so Todo.io's engineers can see what happened.

2026-10-11T18:42:07Z INFO DELETE /todos/42 user=u-123 status=204 14ms

Exam tipLambda sends whatever your function prints to CloudWatch Logs automatically, as long as the execution role allows logs:PutLogEvents.