AWS Deployment Essentials

The mental models

Start with identity, not code

1. Choose one Region
2. Give people temporary access
3. Give workloads IAM roles
4. Grant only required actions
5. Add project tags and a budget

Never place an AWS access key in source code.

S3 stores the frontend

npm run build
aws s3 sync dist/ s3://YOUR_BUCKET --delete

• Upload the generated site, not its source
• index.html changes often
• Hashed CSS/JS can be cached for a long time
• Frontend code can never contain secrets

Production static hosting

Viewer → HTTPS → CloudFront → OAC → Private S3

• Keep Block Public Access enabled
• Let only CloudFront read objects
• Add HTTPS, caching, and a custom domain
• Invalidate changed HTML after release

Bedrock provides model inference

result = bedrock.converse(
    modelId=os.environ["BEDROCK_MODEL_ID"],
    messages=[{
        "role": "user",
        "content": [{"text": prompt}],
    }],
)

You manage prompts, evaluation, safety, latency, and cost — not the model server.

EC2 gives you a whole server

Choose EC2 for:

• Long-running processes
• Custom OS packages or GPUs
• Persistent connections
• Predictable, sustained compute

You own patching, networking, processes, scaling, logs, and recovery.

Lock down the EC2 network

• Prefer Session Manager for administration
• If SSH is required: port 22 from your IP only
• Expose only required application ports
• Never expose databases or model servers publicly
• Attach a role; do not copy credentials onto disk

Lambda runs on demand

Event arrives → runtime starts/reuses → handler runs → response

Good fits:

• Small HTTP APIs
• Queue and file events
• Scheduled jobs
• Bursty, stateless work

One invocation is time-limited; it is not an always-on server.

Lambda or EC2?

Capstone architecture

Browser → CloudFront → private S3
       → API Gateway → Lambda → Bedrock
                              ↘ CloudWatch

Add authentication, input limits, rate limits, model token caps, structured logs, alarms, and a budget.

Deploy, verify, clean up

1. Verify HTTPS and private storage
2. Reject invalid and unauthenticated requests
3. Test timeouts and throttling
4. Confirm least-privilege roles
5. Check logs without storing sensitive prompts
6. Delete lab resources in every used Region

A deployment is complete only when failure and cleanup are designed.