User need to access his own S3 folder, we can use Cognito to generate temp credentials by using STS, then clients are able to use temp credientials to store/retrieve file in S3
Caching
We can cache on Database layer first, by using DAX
We can then cache on API Layer, by using API Gateway caching
Summary
Using Cognito to generate temp credentials with STS to access S3 bucket with restricted policy. App users can directly access AWS resources this way. Pattern can be applied to DynamoDB , Lambda...
Caching the reads on DynamoDB using DAX
Caching the REST requests at the API Gateway level
Security for authentication and authorization with Cognito, STS
Case 2
For users need to access static content globally, we can use S3 + CloudFront global distribution Edge location, so users in each region can access content in low letency
Using Global DyanmoDB Table to serve data globally
We can add caching for DynamoDB by using DAX
Welcome Email
Once user registered, data was saved to DynamoDB, we can using DynamoDB Stream to invoke a Lambda function which has IAM role to send Email by using SES service.
Thumbnail Generation
Client can upload image by using Pre-signed URL
We can optionally use ClondFront Transfer acceleration to speedup file upload process
Once file was uploaded, S3 notification trigger Lambda function to generate thumbnail and save into S3 bucket
Optionally, S3 can further trigger SQS or SNS
Summary
Static content being distributed using CloudFront with S3
Global DyanmoDB table to serve the data globally
(We could have used Aurora Global Tables)
We enabled DynamoDB Stream to trigger Lambda
Lambda function has IAM role to use SES
S3 can trigger SQS / SNS / Lambda to notify of events
Case 3
Route 53 can create many records redriect to different IP addresses.
Can freely compose Serverless services to do the job
Case 4
One Api Gateway resource can be used for user authoriztion, who can get access to the paid content
One Api Gateway can be used for CRUD content
Choose CloudFront Pre-Signed URL instead of S3 Pre-Sigend URL for better global acceleration
Summary
Cognitor for authentication
DynamoDB for stroing users that are premium
2 serverless apps: 1. permium user registration 2. CloudFront Signed URL generator
Content is stored in S3
Integrated with CloudFront with OAI for security
CloudFront can only be used using Signed URLs to prevent unauthorized users
What about S3 Signed URL? They are not efficient for global access
Case 4
Summary
No change to architecture
Will cache software update files at the edge
Software update files are not dynamic, they are static
Our Ec2 instaces are not serverless
But CloudFront is and will scale for us
Our ASG will scale not as much, and we'll save tremendously in EC2
We'll also save in availability, network bandwidh, cost etc
Easy way to make an existing application more scalable and cheaper!
Case 5
IoT Core allows you to harvest data from IoT devices
Kinesis is great for real-time data collection
Firehose helps with data delivery to S3 in real-time (1 minute)
Lambda can help Firehose with data transformations
S3 can trigger notifications to SQS
Lambda can subscribe to SQS (optional, S3 notification can do as well)
Athena is a serverless SQL service and results are stored in S3
The reporting bucket contains analyzed data and can be used by reporting tool such as AWS QuickSight, Redshift...
