iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Exercises

By · Reviewed & last updated · Part of AWS Tutorial

Three short AWS drills - private static site, signed Lambda URL, SSM Parameter Store config.

Three short challenges

EXAMPLE
# 1. Private static site behind CloudFront with OAC

# template.yaml - minimal subset, deploy with: aws cloudformation deploy
Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      OwnershipControls:
        Rules: [{ ObjectOwnership: BucketOwnerEnforced }]
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  OAC:
    Type: AWS::CloudFront::OriginAccessControl
    Properties:
      OriginAccessControlConfig:
        Name: site-oac
        OriginAccessControlOriginType: s3
        SigningBehavior: always
        SigningProtocol: sigv4

  Distribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Enabled: true
        DefaultRootObject: index.html
        Origins:
          - Id: s3
            DomainName: !GetAtt Bucket.RegionalDomainName
            OriginAccessControlId: !Ref OAC
            S3OriginConfig: { OriginAccessIdentity: '' }
        DefaultCacheBehavior:
          TargetOriginId: s3
          ViewerProtocolPolicy: redirect-to-https
          CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6


# 2. Lambda Function URL with IAM auth + Node 20 handler

# index.mjs
export const handler = async (event) => ({
  statusCode: 200,
  body: JSON.stringify({ message: 'hello', ts: Date.now() }),
});

# Deploy
aws lambda create-function \
  --function-name hello \
  --runtime nodejs20.x \
  --role arn:aws:iam::111111111111:role/lambda-basic \
  --handler index.handler \
  --zip-file fileb://function.zip

aws lambda create-function-url-config \
  --function-name hello \
  --auth-type AWS_IAM

# Sign a curl with SigV4 (using aws CLI v2)
aws lambda invoke --function-name hello /tmp/out.json && cat /tmp/out.json


# 3. App reads config from SSM Parameter Store

# Put a parameter (encrypted)
aws ssm put-parameter \
  --name /app/prod/db-url \
  --type SecureString \
  --value 'postgres://app:pass@db:5432/myapp' \
  --overwrite

# Lambda env reads at cold start
const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
const client = new SSMClient({});
const dbUrl = (await client.send(new GetParameterCommand({
  Name: '/app/prod/db-url',
  WithDecryption: true,
}))).Parameter.Value;

# Or wire it as an env var via Lambda config
# --environment 'Variables={DB_URL=$(ssm:/app/prod/db-url)}'
# (CloudFormation supports dynamic references; CLI does not)

# Stretch
# - Add CloudFront response headers policy to set security headers
# - Make the Lambda URL signed with IAM auth and call it from another account

Why it matters

These three patterns cover most simple AWS use cases - serve static content privately, run code on demand, configure it from a secret store. None of them need a VPC, an EC2, or a console click. Lean on infrastructure-as-code from day one.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Fill in: aws s3 ____ s3://my-bucket/
Try it Yourself »

Discussion

Loading…