After this lesson, you will be able to: Deploy a full application on AWS using S3 for static assets, RDS for the database, EC2 or Lambda for the backend, and CloudFront for the CDN. Document the architecture.
Passion project for the AWS sub-track per Curriculum-Upgrade.md. Spend a weekend; build the deploy you'll point at in every cloud job interview.
Two valid paths; pick one.
Path A (Classic 3-tier): CloudFront → S3 (static) + ALB → EC2 (backend) → RDS Postgres
Path B (Serverless): CloudFront → S3 (static) + API Gateway → Lambda → RDS Proxy → RDS Postgres
Path B is cheaper if traffic is bursty; Path A is simpler if you've done EC2 before
Click-ops is the practice run; IaC is the deliverable.
Bootstrap a Terraform module: provider, VPC, public/private subnets in 2 AZs
Resources: VPC, IGW, NAT, security groups, RDS Postgres (Multi-AZ for bonus), S3 bucket, CloudFront distribution
IAM roles: instance profile (EC2) or execution role (Lambda); least-privilege policies
Secrets: AWS Secrets Manager for DB password; data source in Terraform
Apply incrementally, networking first, then storage, then compute
Keep the Terraform state in S3 + DynamoDB lock (or Terraform Cloud free tier)
Wire your real app code into the provisioned infra.
Pick your app (a Next.js + Express, or the one from do-docker-passion)
Backend (Path A): build, scp to EC2, install + systemd unit (from do-linux-04)
Backend (Path B): build, zip / push container image, deploy Lambda via SAM or via Terraform
Frontend: build static assets, aws s3 sync ./dist s3://my-static-bucket
Wire DNS: Route 53 → CloudFront
Get TLS via ACM (AWS Certificate Manager, free, auto-renewing)
First end-to-end browse: home page loads, API returns data, DB write persists
Production isn't 'works once'; it's 'survives a Tuesday'.
Set CloudWatch alarms: API 5xx rate, DB CPU > 80%, NAT bandwidth
Enable CloudTrail (audit log)
Set up a billing alarm at $20
Backup: RDS automated daily; manual snapshot before any schema change
Document the runbook: how to deploy, how to rollback, who to page
The diagram is the deliverable hiring managers will skim.
Use AWS architecture icons (https://aws.amazon.com/architecture/icons/) in Excalidraw or draw.io
Show: CloudFront, S3, ALB / API Gateway, EC2 / Lambda, RDS, NAT, all in their VPC subnets
README: live URL, what's deployed, the architecture diagram, the Terraform repo link, the monthly cost estimate
Bonus: a brief 'what I'd do differently at 10x scale' section
NAT Gateway: ~$30/mo idle. The biggest 'wait what' line. Use S3 VPC Endpoint to avoid NAT for S3 traffic. RDS Multi-AZ: doubles RDS cost. Justified for prod; expensive for learning. Start single-AZ. CloudFront: free tier is generous (1TB egress, 10M requests/mo). Forgotten Elastic IPs: $5/mo each. Release after the EC2 is terminated. Realistic monthly bill for this project as configured: $30-60. Tear down within a few days when done learning.
Sign in and purchase access to unlock this lesson.