Route53 Hosted Zone, Alias Record, and Health Check ☁ AWS ⭐ Beginner Route53 Alias Records Health Checks Failover Routing Scenario Your application is now running behind an Application Load Balancer with a long, autogenerated DNS name. You need to create…

User Authentication: Cognito User Pool + API Gateway JWT Authorizer ☁ AWS 🔥 Advanced Cognito User Pool JWT Authorizer API Gateway v2 CORS OAuth 2.0 Scenario Your React SPA calls a REST API. Currently the API has no authentication —…

Secrets Manager Secret with KMS Encryption ☁ AWS ⭐ Beginner Secrets Manager KMS Sensitive Outputs Secret Versions Scenario A common beginner pattern is to generate an RDS password with random_password and store it directly in Terraform state. While the state…

Production RDS: Multi-AZ, Read Replica, Enhanced Monitoring, and Secrets Manager ☁ AWS 🔥 Advanced RDS Multi-AZ Read Replica Enhanced Monitoring Secrets Manager Deletion Protection Scenario Your MySQL database is a single-AZ instance with no read scaling and the master password…

Global SPA Hosting: S3 + CloudFront + ACM Certificate + WAF ☁ AWS 🔥 Advanced CloudFront ACM WAF v2 Custom Domain OAC Scenario Your React SPA needs to be served globally on a custom domain with a valid TLS certificate,…

Threat Detection: GuardDuty + Security Hub + Automated Response ☁ AWS 🔥 Advanced GuardDuty Security Hub EventBridge Lambda Response SNS Alerting Scenario Your security team is alerted to threats via email but by the time a human investigates, attackers have…

KMS Customer Managed Key with Grants and Aliases ☁ AWS ⭐ Beginner KMS Key Policy Grants Multi-Region Key Scenario Your organisation’s security policy requires that all S3 buckets, EBS volumes, and RDS instances use customer-managed KMS keys (CMKs) — not…