AWS Explained: Core Services, Real-World Architecture & When to Use Each

#!/bin/bash
# Prerequisites: AWS CLI installed and configured with `aws configure`
# This script creates the skeleton of a real web app infrastructure:
# an S3 bucket for static assets, checks your IAM identity, and
# lists available EC2 instance types so you can make an informed choice.

# ── Step 1: Confirm who you are (IAM) ────────────────────────────────
# Always run this first. If the wrong profile is active you'll create
# resources in the wrong account — a very expensive mistake.
echo "Current IAM identity:"
aws sts get-caller-identity
# Output shows Account ID, IAM User ARN, and User ID.
# If you see 'Unable to locate credentials', run: aws configure

# ── Step 2: Create an S3 bucket for your app's static assets ─────────
# Bucket names must be globally unique across ALL AWS accounts.
# Using a domain-style name is a common convention to avoid conflicts.
BUCKET_NAME="myapp-static-assets-$(date +%s)"  # timestamp ensures uniqueness
AWS_REGION="us-east-1"

echo "Creating S3 bucket: $BUCKET_NAME"
aws s3api create-bucket \
  --bucket "$BUCKET_NAME" \
  --region "$AWS_REGION"
# Note: us-east-1 does NOT take a LocationConstraint. Other regions do:
# --create-bucket-configuration LocationConstraint=eu-west-1

# ── Step 3: Block all public access (secure by default) ───────────────
# New buckets are private, but explicitly blocking public access
# prevents any future policy change from accidentally exposing data.
aws s3api put-public-access-block \
  --bucket "$BUCKET_NAME" \
  --public-access-block-configuration \
    "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

echo "Bucket $BUCKET_NAME created and locked down."

# ── Step 4: Upload a sample asset ─────────────────────────────────────
echo "<h1>Hello from S3</h1>" > /tmp/index.html
aws s3 cp /tmp/index.html s3://"$BUCKET_NAME"/index.html
echo "File uploaded successfully."

# ── Step 5: Verify the upload ─────────────────────────────────────────
echo "Bucket contents:"
aws s3 ls s3://"$BUCKET_NAME"/

# This is a complete AWS Lambda function that triggers whenever a new image
# is uploaded to an S3 bucket, generates a thumbnail, and saves it to a
# second 'thumbnails' bucket. This is one of the most common Lambda patterns.

import boto3       # AWS SDK for Python — installed in Lambda runtime by default
import json
from PIL import Image   # Requires a Lambda Layer or packaging Pillow with your deploy
import io
import os

# boto3 clients are created outside the handler so they are reused across
# warm invocations — this is a real performance optimisation, not just style.
s3_client = boto3.client('s3')

# The THUMBNAILS_BUCKET env var is set in the Lambda config, not hardcoded.
# Hardcoding bucket names is a common mistake that breaks staging/prod parity.
THUMBNAILS_BUCKET = os.environ['THUMBNAILS_BUCKET']
THUMBNAIL_SIZE = (128, 128)  # width x height in pixels

def lambda_handler(event, context):
    """
    AWS calls this function automatically when a new object is created in
    the source S3 bucket. 'event' contains the bucket name and object key.
    """
    # Extract the source bucket and file key from the S3 event payload
    source_bucket = event['Records'][0]['s3']['bucket']['name']
    source_key = event['Records'][0]['s3']['object']['key']

    # Only process image files — avoid infinite loops if thumbnails land
    # in the same bucket as originals (a classic footgun).
    if source_key.startswith('thumbnails/'):
        print(f"Skipping thumbnail file to prevent recursion: {source_key}")
        return {'statusCode': 200, 'body': 'Skipped thumbnail.'}

    print(f"Processing image: s3://{source_bucket}/{source_key}")

    # Download the original image into memory (no disk — Lambda is stateless)
    response = s3_client.get_object(Bucket=source_bucket, Key=source_key)
    image_data = response['Body'].read()

    # Open, resize, and convert using Pillow
    original_image = Image.open(io.BytesIO(image_data))
    original_image.thumbnail(THUMBNAILS_SIZE)  # modifies in place, preserves ratio

    # Write the thumbnail to an in-memory buffer (no temp files needed)
    thumbnail_buffer = io.BytesIO()
    image_format = original_image.format or 'JPEG'
    original_image.save(thumbnail_buffer, format=image_format)
    thumbnail_buffer.seek(0)  # rewind the buffer to the start before upload

    # Build the destination key — mirrors the original path under 'thumbnails/'
    thumbnail_key = f"thumbnails/{source_key}"

    s3_client.put_object(
        Bucket=THUMBNAILS_BUCKET,
        Key=thumbnail_key,
        Body=thumbnail_buffer,
        ContentType=f"image/{image_format.lower()}"
    )

    print(f"Thumbnail saved to: s3://{THUMBNAILS_BUCKET}/{thumbnail_key}")
    return {
        'statusCode': 200,
        'body': json.dumps({'thumbnail': thumbnail_key})
    }

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadingFromSpecificBucketOnly",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",      
        "s3:ListBucket"      
      ],
      "Resource": [
        "arn:aws:s3:::myapp-static-assets-1718123456",
        "arn:aws:s3:::myapp-static-assets-1718123456/*"
      ]
    },
    {
      "Sid": "AllowCloudWatchLoggingForDebugging",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/thumbnail-processor:*"
    }
  ]
}

# To attach this policy to a Lambda execution role via CLI:
#
# 1. Create the policy in IAM:
# aws iam create-policy \
#   --policy-name LambdaThumbnailS3ReadPolicy \
#   --policy-document file://lambda_s3_readonly_policy.json
#
# 2. Create the role (Lambda needs permission to assume it):
# aws iam create-role \
#   --role-name LambdaThumbnailRole \
#   --assume-role-policy-document '{
#     "Version": "2012-10-17",
#     "Statement": [{
#       "Effect": "Allow",
#       "Principal": {"Service": "lambda.amazonaws.com"},
#       "Action": "sts:AssumeRole"
#     }]
#   }'
#
# 3. Attach the policy to the role:
# aws iam attach-role-policy \
#   --role-name LambdaThumbnailRole \
#   --policy-arn arn:aws:iam::123456789012:policy/LambdaThumbnailS3ReadPolicy

#!/bin/bash
# This script creates a minimal RDS PostgreSQL instance for a web app
# and demonstrates connecting to it securely from an EC2 instance.
# Cost note: even the smallest RDS instance (~$15/month) is NOT free tier
# eligible after the first 12 months. Use RDS Proxy in production for
# connection pooling — Lambda functions can exhaust DB connections instantly.

DB_IDENTIFIER="myapp-postgres-prod"
DB_NAME="myapp"
DB_USER="myapp_admin"
# In real usage, pull this from AWS Secrets Manager — never hardcode passwords
DB_PASSWORD="$(aws secretsmanager get-secret-value \
  --secret-id myapp/db/password \
  --query SecretString \
  --output text)"

# ── Create the RDS instance ───────────────────────────────────────────
echo "Creating RDS PostgreSQL instance..."
aws rds create-db-instance \
  --db-instance-identifier "$DB_IDENTIFIER" \
  --db-instance-class db.t3.micro \
  --engine postgres \
  --engine-version "15.4" \
  --master-username "$DB_USER" \
  --master-user-password "$DB_PASSWORD" \
  --db-name "$DB_NAME" \
  --allocated-storage 20 \
  --storage-type gp3 \
  --no-publicly-accessible \
  --backup-retention-period 7 \
  --deletion-protection \
  --region us-east-1

# --no-publicly-accessible: the DB only accepts connections from within the VPC
# --deletion-protection: prevents accidental deletion with a single CLI call
# --backup-retention-period 7: keeps 7 days of automated backups

echo "Waiting for instance to become available (this takes ~5 minutes)..."
aws rds wait db-instance-available \
  --db-instance-identifier "$DB_IDENTIFIER"

# ── Retrieve the endpoint once the instance is ready ──────────────────
DB_ENDPOINT=$(aws rds describe-db-instances \
  --db-instance-identifier "$DB_IDENTIFIER" \
  --query 'DBInstances[0].Endpoint.Address' \
  --output text)

echo "RDS instance ready at: $DB_ENDPOINT"

# ── Connect (run this from inside your EC2 instance, not your laptop) ─
# psql is available on Amazon Linux 2: sudo yum install -y postgresql15
echo "Connecting to database..."
PGPASSWORD="$DB_PASSWORD" psql \
  --host="$DB_ENDPOINT" \
  --port=5432 \
  --username="$DB_USER" \
  --dbname="$DB_NAME" \
  --command="SELECT version();"