Serverless REST API with DynamoDB

Level:Intermediate

Time:2-3 hours

Cost:medium

Works locally:No

Cloud creds:Yes

Cleanup:Yes

Reviewed:2026-05-30

Validation:terraform -chdir=terraform fmt -check

Node.js Lambda API Gateway DynamoDB SAM Terraform AWS

Overview

Serverless API provisioned by Terraform/SAM with hardened templates.

What You Will Build

Outcome Plan/apply evidence plus destroy proof

Tools used Node.js, Lambda, API Gateway, DynamoDB, SAM, Terraform, AWS

Best fit Intermediate - 2-3 hours

Architecture Diagram

Student workstation Repository files IaC plan AWS account Validation proof

Prerequisites

• Install or review: Node.js, Lambda, API Gateway, DynamoDB, SAM, Terraform, AWS.
• Use your own cloud account credentials and keep them out of commits.
• This project expects cloud resources, so verify budget alerts and cleanup first.
• Open the safety guide before running commands that create infrastructure.

Credentials And Cost Warning

Cost and credential stance

Cost risk is medium. Cloud target: AWS. Cloud credentials needed: Yes. Always use your own account, never commit secrets, and confirm cleanup before creating paid infrastructure.

Step-By-Step Lab

Use this flow before you run commands:

1. Read the cost and credential warning above.
2. Review the validation, troubleshooting, cleanup, and portfolio proof sections below.
3. Follow the original project guide preserved near the bottom of this page.
4. Return to the validation and cleanup checks before you capture portfolio evidence.

Validation Checks

Run the project validation command before and after meaningful changes:

terraform -chdir=terraform fmt -check

Troubleshooting

• Run terraform -chdir=terraform fmt -check first so local tooling issues are visible early.
• If a command fails, check tool versions, working directory, and required environment variables.
• For cloud failures, confirm account identity, region, quotas, and least-privilege IAM.

Cleanup

Cleanup is available or expected for this lab. Use the cleanup or destroy steps in the guide below, then confirm that local clusters, containers, cloud resources, buckets, state files, and CI secrets are no longer active.

Portfolio Proof

• Validation command output: terraform -chdir=terraform fmt -check
• Screenshot or terminal proof: Plan/apply evidence plus destroy proof
• Notes explaining what changed, what failed, and how you fixed it
• Cleanup evidence, especially for cloud or Kubernetes resources

Original Project Guide

The original README content is preserved here for lab-specific commands and context. Headings are intentionally demoted so the page outline stays focused on the standard lab flow.

Lambda based REST API entirely through code - API Gateway, YAML & Terraform

External image reference 5b454bae-5fd4-405d-a37d-6bafc3fcf889

Serverless Applications with AWS Lambda and API Gateway

🛡️ 2026 DevSecOps Enhancements (What You Will Learn)

Serverless architectures offload OS-level patching to AWS, but they introduce new attack vectors. This project highlights 2026 serverless DevSecOps principles:

1. API Gateway Exploitation Prevention: A public-facing API Gateway must be fronted by AWS WAF (Web Application Firewall) to mitigate OWASP Top 10 API threats (like injection and parameter tampering) before they ever trigger Lambda invocations (preventing DoS billing attacks).
2. Lambda IAM Least Privilege: Each individual Lambda function must be scoped with a granular IAM execution role. A function writing to DynamoDB should only have dynamodb:PutItem on that specific table ARN, not dynamodb:* across the account.

Compilation

sam package —template-file template.yaml —output-template-file deploy.yaml —s3-bucket $SAM_CODE_BUCKET

• terraform init

• terraform plan

• terraform deploy

• terraform destroy

Source Files On GitHub

Use the guide first.

The full learning flow stays on this page. Open GitHub only when a step asks you to inspect code, fork the lab, or download source assets.

Read safety guide Open project source