DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

Project: Serverless Orders + Profiles

#aws #tutorial #serverless #architecture

What you’ll build (final output)

  1. Public API (GET /health) to verify the stack.
  2. Protected API (/profiles/*, /orders/*) fronted by API Gateway + Cognito:
  • POST /profiles – create/update a user profile (DynamoDB)
  • GET /profiles/{id} – fetch profile (DynamoDB)
  • POST /orders – place an order (invokes Step Functions workflow)

  • GET /orders/{id} – fetch order status (DynamoDB)

    1. Background workflows:

  • Step Functions orchestrates “Place Order” (validate → reserve → charge → confirm).

  • EventBridge cron runs a serverless cleanup Lambda hourly to expire “stale orders”.

  • DynamoDB Streams → Lambda sends a “welcome” log when a new profile is created.

    1. Data features:

  • DynamoDB table with On-Demand capacity, TTL for sessions, PITR backups, S3 export demo.

    1. Edge customization:

  • CloudFront + CloudFront Function adds a security header & redirects / → /docs.

    1. Performance knobs:

  • Reserved concurrency on hot endpoints, Provisioned Concurrency on the checkout Lambda, and SnapStart (optional) for a Java “payment” Lambda.

    1. (Optional) DB-triggered Lambda from Aurora MySQL or RDS PostgreSQL (data-level trigger pattern).

You’ll finish with:

  • A working set of HTTPS endpoints
  • A Cognito Hosted UI login
  • State machine executions you can watch run
  • CloudWatch logs & metrics you can show in interviews

Architecture (mental map) 

[User] ──HTTPS──> [CloudFront]* ──> [API Gateway (REST)] │ ├─(Cognito Authorizer)──> [Cognito User Pool] │ └─> [Lambda (proxy)] ──> [DynamoDB: profiles, orders] │ │ ├─> DynamoDB Streams ──┘ (Welcome event -> Lambda) └─> Step Functions (place-order workflow) │ ├─> Lambda: validate ├─> Lambda: reserve ├─> Lambda: charge (SnapStart optional) └─> Lambda: confirm → write order state (DDB) [EventBridge Rule (cron)] ──> Lambda (cleanup stale orders) * CloudFront Function at viewer-request: add headers/redirect.
Enter fullscreen mode Exit fullscreen mode

Prereqs

  • AWS account with admin access
  • Region: us-east-1 (helps with CloudFront/edge defaults)
  • Python 3 locally (for testing JWT decode if needed)
  • Node.js optional (if you prefer Node Lambdas)
  • You can do everything in the AWS Console (no CDK/Terraform required for this lab)

Step-by-Step Build

1) DynamoDB tables

Create two tables (Console → DynamoDB → Create table):

  • profiles

    • Partition key: userId (String)
    • Capacity: On-Demand
    • Streams: NEW_AND_OLD_IMAGES (enable)
    • PITR: enable

  • orders

    • Partition key: orderId (String)
    • Capacity: On-Demand
    • TTL attribute (add later): ttlEpoch (Number)
    • PITR: enable

Later: enable Export to S3 from PITR snapshot to demo analytics export.

2) Cognito (auth)

User Pool (sign-in):

  • Console → Cognito → Create user pool
  • Name: serverless-user-pool
  • Username sign-in + email verification (simple defaults)
  • Create an App client (no secret), enable Hosted UI.
  • Note the User Pool ID and App Client ID.

(Optional) Identity Pool (direct AWS access): skip for now; not needed for this API flow.

3) API Gateway (REST)

Create REST API:

  • API Gateway → Create API → REST API → Build
  • Name: serverless-api
  • Endpoint type: Regional

  • Create Resources/Methods:

    • /health → GET → Lambda proxy (public; no authorizer)
    • /profiles → POST → Lambda proxy (Cognito Authorizer)
    • /profiles/{id} → GET → Lambda proxy (Cognito Authorizer)
    • /orders → POST → Lambda proxy (Cognito Authorizer)
    • /orders/{id} → GET → Lambda proxy (Cognito Authorizer)

Cognito Authorizer:

  • Authorizers → Create → Type: Cognito
  • Select your User Pool
  • Attach to the 4 protected methods.

Stage:

  • Deploy API → Stage dev
  • Save the Invoke URL.

4) Lambda functions (Python 3.11)

Create these functions (Console → Lambda → Create function):

A. health-handler (public)

import json def lambda_handler(event, context): return {"statusCode": 200, "headers": {"Content-Type":"application/json"}, "body": json.dumps({"ok": True, "service": "serverless-api"})}
Enter fullscreen mode Exit fullscreen mode

B. profiles-upsert (Cognito-protected)

import os, json, boto3 dynamodb = boto3.resource('dynamodb') table = dynamodb.Table('profiles') def lambda_handler(event, context): body = json.loads(event.get("body") or "{}") # From JWT (Cognito authorizer), API Gateway puts identity in requestContext  claims = event["requestContext"]["authorizer"]["claims"] user_id = claims.get("sub") # stable unique id  item = { "userId": user_id, "name": body.get("name", ""), "email": claims.get("email", ""), "updatedAt": event["requestContext"]["requestTimeEpoch"] } table.put_item(Item=item) return {"statusCode": 200, "headers":{"Content-Type":"application/json"}, "body": json.dumps({"message":"profile upserted","profile": item})}
Enter fullscreen mode Exit fullscreen mode

C. profiles-get (Cognito-protected)

import json, boto3 dynamodb = boto3.resource('dynamodb') table = dynamodb.Table('profiles') def lambda_handler(event, context): user_id = event["pathParameters"]["id"] resp = table.get_item(Key={"userId": user_id}) item = resp.get("Item") return {"statusCode": 200 if item else 404, "headers":{"Content-Type":"application/json"}, "body": json.dumps(item or {"error":"not found"})}
Enter fullscreen mode Exit fullscreen mode

D. orders-create (starts Step Functions)

import json, os, boto3, uuid, time sf = boto3.client('stepfunctions') STATE_MACHINE_ARN = os.environ["STATE_MACHINE_ARN"] def lambda_handler(event, context): order_id = str(uuid.uuid4()) body = json.loads(event.get("body") or "{}") # Pass through claims for personalization/authorization in workflow if needed  claims = event["requestContext"]["authorizer"]["claims"] start_input = { "orderId": order_id, "userId": claims.get("sub"), "amount": body.get("amount", 0), "items": body.get("items", []) } sf.start_execution(stateMachineArn=STATE_MACHINE_ARN, input=json.dumps(start_input)) return {"statusCode": 202, "headers":{"Content-Type":"application/json"}, "body": json.dumps({"orderId": order_id, "status":"STARTED"})}
Enter fullscreen mode Exit fullscreen mode

E. orders-get (reads DynamoDB)

import json, boto3 dynamodb = boto3.resource('dynamodb') table = dynamodb.Table('orders') def lambda_handler(event, context): order_id = event["pathParameters"]["id"] resp = table.get_item(Key={"orderId": order_id}) item = resp.get("Item") return {"statusCode": 200 if item else 404, "headers":{"Content-Type":"application/json"}, "body": json.dumps(item or {"error":"not found"})}
Enter fullscreen mode Exit fullscreen mode

F. Stream trigger: profiles-stream-welcome

  • Trigger: DynamoDB Streams on profiles 
import json, logging logger = logging.getLogger() logger.setLevel(logging.INFO) def lambda_handler(event, context): for rec in event.get("Records", []): if rec["eventName"] == "INSERT": new = rec["dynamodb"]["NewImage"] logger.info(f"WELCOME: userId={new['userId']['S']} name={new.get('name',{}).get('S','')}") return {"statusCode":200, "body":"ok"}
Enter fullscreen mode Exit fullscreen mode

G. Cron cleanup: orders-cleanup (EventBridge hourly)

import json, time, boto3 dynamodb = boto3.resource('dynamodb') table = dynamodb.Table('orders') def lambda_handler(event, context): # Example: mark old PENDING orders as EXPIRED (toy logic)  # In real life you'd use a GSI on status+timestamp and query instead of scan.  scan = table.scan() now = int(time.time()) updated = 0 for item in scan.get("Items", []): if item.get("status") == "PENDING" and item.get("ttlEpoch", now) < now: item["status"] = "EXPIRED" table.put_item(Item=item) updated += 1 return {"statusCode": 200, "body": json.dumps({"expired": updated})}
Enter fullscreen mode Exit fullscreen mode

Wire methods → functions in API Gateway (Lambda proxy).
For orders-create, set ENV STATE_MACHINE_ARN (after you create it in next step).

Permissions: each Lambda needs minimal IAM (DynamoDB CRUD to the right tables, Step Functions StartExecution for orders-create, CloudWatch logs). You can attach inline policies per function.

5) Step Functions (Standard)

Console → Step Functions → Create state machine → Write your workflow in ASL:

State machine name: PlaceOrder

Definition (paste):

{ "Comment": "Place order workflow", "StartAt": "Validate", "States": { "Validate": { "Type": "Task", "Resource": "arn:aws:states:::lambda:invoke", "Parameters": {"FunctionName": "validate-order", "Payload.$": "$"}, "Next": "Reserve", "Retry": [{"ErrorEquals":["States.ALL"],"IntervalSeconds":2,"MaxAttempts":2,"BackoffRate":2.0}], "Catch": [{"ErrorEquals":["States.ALL"],"ResultPath":"$.error","Next":"Fail"}] }, "Reserve": { "Type": "Task", "Resource": "arn:aws:states:::lambda:invoke", "Parameters": {"FunctionName": "reserve-inventory", "Payload.$": "$"}, "Next": "Charge" }, "Charge": { "Type": "Task", "Resource": "arn:aws:states:::lambda:invoke", "Parameters": {"FunctionName": "charge-payment", "Payload.$": "$"}, "Next": "Confirm" }, "Confirm": { "Type": "Task", "Resource": "arn:aws:states:::lambda:invoke", "Parameters": {"FunctionName": "confirm-order", "Payload.$": "$"}, "End": true }, "Fail": { "Type":"Fail", "Cause":"OrderFailed" } } }
Enter fullscreen mode Exit fullscreen mode

Create four small Lambdas (validate-order, reserve-inventory, charge-payment, confirm-order) that just:

  • Read orderId, userId
  • Update orders table with status: VALIDATED → RESERVED → CHARGED → CONFIRMED

SnapStart (optional): make charge-payment a Java Lambda and enable SnapStart on Published Versions for a cold-start boost. Publish a version and point Step Functions to that version ARN.

6) EventBridge cron

Console → EventBridge → Rules → Create

  • Schedule: rate(1 hour)
  • Target: orders-cleanup Lambda

7) DynamoDB: TTL + Backups + Export

  • orders table → Enable TTL on attribute ttlEpoch
  • PITR already enabled
  • Export: Go to Backups/Exports → Export latest PITR snapshot to S3 (DynamoDB JSON). (For a demo, you can query with Athena after creating a table & schema.)

8) CloudFront + CloudFront Function (edge)

  • Create a small S3 static bucket serverless-docs with an index.html explaining your API.
  • CloudFront distribution → origin = your S3 website or S3 with OAC.
  • CloudFront Function (viewer-request): 
function handler(event) { var req = event.request; if (req.uri === '/') { req.uri = '/docs'; // redirect-like rewrite } // Add a simple security header var headers = req.headers; headers['x-lab'] = {value: 'serverless-beginner-lab'}; return req; }
Enter fullscreen mode Exit fullscreen mode
  • Associate at Viewer Request.

(You’re not calling API Gateway through CloudFront here; this is just to show edge customization. If you want, add another behavior that proxies API to API Gateway.)

9) Concurrency settings

  • For orders-create (front door hot path):

    • Reserved Concurrency = e.g., 50 (protects the account pool)

  • For charge-payment:

    • Provisioned Concurrency = e.g., 5 (low latency & no cold starts)

  • Demonstrate throttling: temporarily set Reserved Concurrency = 0 on health-handler and call it → see 429 ThrottlingException. Restore.

10) (Optional) DB-triggered Lambda (Aurora MySQL / RDS PostgreSQL)

  • Create a tiny table registrations.
  • Add the engine-specific integration/stored proc to invoke Lambda on insert.
  • IAM role on DB cluster allowing lambda:InvokeFunction, and network path to Lambda (public invoke or VPC endpoint/NAT).
  • Insert a row → Lambda logs “WELCOME FROM RDS”.

(This is distinct from RDS **Event Notifications* which are infra-events, not row-level data.)*

How to Test (copy/paste)

A) Health (public) 

curl https://{api_id}.execute-api.{region}.amazonaws.com/dev/health
Enter fullscreen mode Exit fullscreen mode

B) Login (Cognito Hosted UI)

  • Go to your User Pool → App client → Open Hosted UI sign-in.
  • Create a test user, sign in, copy the ID token (JWT).

In calls below, set:

AUTH="Authorization: Bearer <ID_TOKEN>"
Enter fullscreen mode Exit fullscreen mode

C) Create Profile 

curl -X POST \ -H "Content-Type: application/json" \ -H "$AUTH" \ -d '{"name":"Aisalkyn Aidarova"}' \ https://{api_id}.execute-api.{region}.amazonaws.com/dev/profiles
Enter fullscreen mode Exit fullscreen mode

D) Get Profile 

curl -H "$AUTH" \ https://{api_id}.execute-api.{region}.amazonaws.com/dev/profiles/<cognito-sub>
Enter fullscreen mode Exit fullscreen mode

cognito-sub is the user’s sub claim (UUID) from the token.

E) Place Order (triggers Step Functions) 

curl -X POST \ -H "Content-Type: application/json" \ -H "$AUTH" \ -d '{"amount": 42.50, "items":[{"sku":"A-1","qty":2}]}' \ https://{api_id}.execute-api.{region}.amazonaws.com/dev/orders
Enter fullscreen mode Exit fullscreen mode

Note returned orderId. Watch the execution in Step Functions Console.

F) Get Order 

curl -H "$AUTH" \ https://{api_id}.execute-api.{region}.amazonaws.com/dev/orders/<orderId>
Enter fullscreen mode Exit fullscreen mode

You should see status progress to CONFIRMED.

G) Streams & Logs

  • Create profile → check CloudWatch logs of profiles-stream-welcome for the WELCOME line.

H) Cron

  • Manually set an orders item with past ttlEpoch and status=PENDING, then wait for the hourly rule (or run the function manually) → it sets EXPIRED.

What to Show as “Final Output”

  • Screenshots:

    • API Gateway stage URLs responding (health, profiles, orders)
    • Cognito Hosted UI login
    • Step Functions graph view with a Succeeded execution
    • DynamoDB tables with items
    • CloudWatch logs: WELCOME stream log
    • EventBridge rule
    • CloudFront Function associated on viewer-request

  • Talking points (interview):

    • Why On-Demand capacity for unpredictable loads
    • TTL & PITR choices
    • Streams → Lambda vs Kinesis use cases
    • Reserved vs Provisioned Concurrency, SnapStart for cold starts
    • Edge customization vs Lambda@Edge
    • Cognito User Pool (auth) vs Identity Pool (AWS access)

Cleanup (to avoid charges)

  • Delete CloudFront distribution (takes time), S3 bucket(s)
  • Delete API Gateway, Lambdas, Step Functions state machine
  • Delete EventBridge rule, DynamoDB tables (stop export jobs first)
  • Delete Cognito User Pool & App client

Top comments (1)

Collapse
 
gulzat_mursakanova_c9f6a7 profile image
Gulzat Mursakanova •

thank you for good practice))