You tick a todo as done · Lambda + RDS MySQL

Your browser sends PATCH /todos/42 over HTTPS.

PATCH /todos/42 HTTP/1.1
Host: abc123.execute-api.us-east-1.amazonaws.com
Cookie: session=eyJ1c2VySWQiOiJ1LTEyMyJ9.Zm9v
Content-Type: application/json

{"done":true}

The request arrives at API Gateway, a managed HTTPS front door. There's no server or firewall for you to look after.

API Gateway invokes your Lambda function and hands it the request as an event.

• 🔑IAM Lambda resource policy: API Gateway may invoke todo-apiAllowed

{
  "Effect": "Allow",
  "Principal": {
    "Service": "apigateway.amazonaws.com"
  },
  "Action": "lambda:InvokeFunction",
  "Resource": "arn:aws:lambda:us-east-1:111122223333:function:todo-api",
  "Condition": {
    "ArnLike": {
      "AWS:SourceArn": "arn:aws:execute-api:us-east-1:111122223333:abc123/*"
    }
  }
}

Exam tipThis is a resource-based policy. It lives on the function and says who may call it, the opposite of a policy attached to a role.

The app checks your signed session cookie and finds your user id, u-123. This is the app's own login, not AWS.

The database lives in a private subnet of a VPC, so the function is attached to that VPC. AWS gives it an ENI (a network card) in the private subnet.

Exam tipA Lambda ENI never gets a public IP, so a VPC-attached function can't reach the internet, even from a public subnet. It needs a NAT gateway. Classic exam trap.

The app sends SQL to RDS MySQL in the private subnet on port 3306. It logs in with a database username and password, not with IAM.

• 🛡Security group todo-db-sg: TCP 3306 from todo-lambda-sgAllowed
• 🗄MySQL MySQL user todo_app: UPDATE on todoio.todosAllowed

UPDATE todos SET done = true WHERE id = 42 AND user_id = 'u-123';

Exam tipA security group rule can use another security group as its source: "anything wearing todo-lambda-sg may connect". Exam favourite.

MySQL says: 1 row changed.

The app looks up your connection id in the database and posts a message to it through the WebSocket API. It's attached to the VPC with no public IP, so it gets out through a NAT gateway and the internet gateway.

• 🔑IAM todo-app-lambda-role: execute-api:ManageConnectionsAllowed

POST /prod/@connections/Ab3xYzEXAMPLE= HTTP/1.1
Host: ws123.execute-api.us-east-1.amazonaws.com

{"type":"todo.completed","todoId":"42"}

Exam tipA Lambda attached to a VPC needs a NAT gateway (or a VPC endpoint) to reach anything outside the VPC, even AWS services like SQS.

Every Todo.io tab you have open, on any device, shows the change without a refresh.

You get 200 OK, and the todo shows a tick.

HTTP/1.1 200 OK

Lambda sends what the function printed to CloudWatch Logs, so Todo.io's engineers can see what happened.

2026-10-11T18:42:07Z INFO PATCH /todos/42 user=u-123 status=200 14ms

Exam tipLambda sends whatever your function prints to CloudWatch Logs automatically, as long as the execution role allows logs:PutLogEvents.