Architecture 3: the serverless API

The zero-idle stack

The third reference architecture replaces every always-on component with pay-per-use pieces:

• API Gateway (lesson 7-2) is a managed HTTPS endpoint that accepts each incoming request and turns it into a Lambda event — the front door of the stack. It plays the ALB's role with no fixed hourly fee, billed per million requests instead.
• Lambda functions (unit 7) hold the application logic, one function per route or one for the whole API, your choice.
• DynamoDB stores the data. It is AWS's serverless NoSQL database: no instance, no subnet, per-request billing, and a generous always-free tier (lesson 8-2). It stores items by key, so it trades SQL's flexible queries for effortless scale, a real trade to weigh against RDS.
• S3 + presigned URLs (lesson 4-3) handle file uploads, so big payloads never touch Lambda.

Notice what is missing: no VPC to design, no security groups to chain, no instances to patch. IAM roles (lesson 2-3) are the only security wiring: each function's role allows exactly its own table and bucket, least privilege from lesson 2-1.

Where you are now

You can now read all three of these diagrams cold, and that was the goal of the course:

1. Static site (9-1): S3 + CloudFront + Route 53. Cents per month.
2. Classic web app (9-2): ALB + EC2 + RDS across two AZs. Fixed cost, maximum control.
3. Serverless API (9-3): API Gateway + Lambda + DynamoDB. Zero idle cost, scales itself.

Every real AWS estate is these three patterns mixed. When you meet a new service, place it with the questions this course drilled: which meter does it spin (8-1)? What does its default-deny look like (2-2)? Which subnet does it belong in (5-2)? Who holds its role (2-3)?

Next steps when you are ready for a real account: set the billing alarm first (lesson 8-2), lock root behind MFA (lesson 2-1), tag everything you create (lesson 8-3), then build architecture 1 for your own portfolio. It is the cheapest possible way to practice everything here for real.