AWS Developer cheat sheet

Lambda invocation model drives retries: synchronous callers (API Gateway, ALB) receive the error directly; asynchronous sources (S3, SNS, EventBridge) are retried twice by default.

DynamoDB Query requires the full partition-key value plus an optional sort-key condition; Scan reads every item, so model access patterns with GSIs and use Query where possible.

DynamoDB caps a single item at 400 KB including attribute names, and returns at most 1 MB per Query/Scan page, so paginate using LastEvaluatedKey.

SQS standard queues give at-least-once delivery and best-effort ordering; FIFO queues give exactly-once processing and ordering per message group at 300 msg/s without batching (3,000 with batching).

A received SQS message stays hidden for the visibility timeout (maximum 12 hours); if it is not deleted before the timeout it is redelivered. Retention defaults to 4 days, maximum 14.

SNS fan-out sends one published message to many SQS subscriptions, each receiving its own copy; FIFO topics can only target SQS FIFO queues.

Step Functions: Standard workflows run up to one year with exactly-once execution; Express workflows run at most five minutes with at-least-once execution at high event rates.

API Gateway integration types: AWS_PROXY (Lambda proxy), AWS (service integration with mapping templates), HTTP/HTTP_PROXY, and MOCK.

Lambda limits: 15-minute maximum timeout, 128 MB to 10,240 MB memory, 512 MB to 10,240 MB /tmp storage, and 4 KB total environment variables.

IAM evaluation order is explicit Deny, then Allow, then implicit Deny: a matching deny in any identity or resource policy overrides every allow.

IAM roles are assumed via STS and return temporary credentials with an expiry; use roles for EC2, Lambda, ECS tasks and cross-account access instead of long-term access keys.

KMS envelope encryption uses a data key for the payload and the CMK to encrypt that data key; callers need kms:GenerateDataKey to encrypt and kms:Decrypt to decrypt.

Secrets Manager rotates credentials automatically through a scheduled Lambda rotation function; SSM Parameter Store SecureString encrypts values with KMS but has no native rotation.

Cognito user pools authenticate users and issue JWT tokens; identity pools exchange those tokens for temporary AWS credentials from STS.

S3 default encryption is SSE-S3; SSE-KMS adds CloudTrail key-usage auditing and per-key permissions; SSE-C requires the client to supply and manage the key.

Gateway VPC endpoints exist only for S3 and DynamoDB and work through route-table entries; interface endpoints (PrivateLink) use ENIs and security groups for other services.

Lambda has two permission surfaces: the execution role defines what the function may call, and the resource-based policy defines who may invoke it.

Enforce TLS on an S3 bucket with a bucket policy that denies requests where aws:SecureTransport is false.

SAM templates use the AWS::Serverless-2016-10-31 transform; sam build, sam package and sam deploy generate and upload a CloudFormation template plus a code artifact in S3.

Lambda versions are immutable snapshots of code and configuration; aliases are mutable pointers to versions and support weighted routing for canary releases.

CodeDeploy traffic shifting for Lambda aliases uses Canary, Linear or All-at-once configurations that set the percentage shifted and the interval between steps.

Elastic Beanstalk deployment policies: All at once (downtime), Rolling, Rolling with additional batch, Immutable (launches a new group, safest) and Traffic splitting.

CodePipeline stages run in order; actions within a stage run sequentially or in parallel, and output artifacts pass between stages through an S3 artifact bucket.

CodeBuild buildspec.yml sections are version, env, phases (install, pre_build, build, post_build), artifacts and cache.

CloudFormation DeletionPolicy Retain keeps a resource after stack deletion; Snapshot backs up supported resources; UpdateReplacePolicy governs the same behaviour during replacement.

CloudFormation StackSets deploy one template across many accounts and regions from a stack set administrator account using target accounts and OUs.

AWS CDK apps synthesize to CloudFormation: cdk synth emits the template, cdk diff shows pending changes, and cdk deploy applies the stack.

CloudWatch Lambda metrics include Invocations, Errors, Duration, Throttles, ConcurrentExecutions, IteratorAge (stream sources) and DeadLetterErrors.

Lambda throttling surfaces as 429 TooManyRequestsException; async invocations are retried, sync callers see the error, and reserved concurrency both caps and guarantees capacity for one function.

Provisioned concurrency pre-initializes execution environments and removes cold starts for that capacity, which is billed for as long as it is configured.

API Gateway default account throttling is 10,000 requests per second with a 5,000 burst per region, and the integration timeout is 29 seconds, so long work must move to an asynchronous pattern.

A 502 from API Gateway with a Lambda proxy integration almost always means a malformed response (missing statusCode or a non-serializable body); 504 means the integration timed out.

X-Ray needs xray:PutTraceSegments and xray:PutTelemetryRecords permissions and is enabled on Lambda through TracingConfig set to Active; the X-Ray daemon is required on EC2 and ECS.

DynamoDB ProvisionedThroughputExceededException means a table or partition limit was exceeded; SDK retries use exponential backoff with jitter, and DAX or on-demand capacity removes the ceiling.

CloudWatch Logs metric filters convert log patterns into metrics, and CloudWatch alarms on those metrics can trigger Auto Scaling policies or SNS notifications.

SQS long polling with WaitTimeSeconds up to 20 reduces empty receives; a Lambda event source mapping polls in batches (up to 10 messages) and scales pollers with backlog growth.