Amazon DynamoDB

VPC endpoints let resources in your VPC connect to supported AWS services privately using the AWS network backbone without the traffic ever going over the public internet.

For S3 and DynamoDB specifically, use a gateway endpoint and the gateway endpoints are free.

That matches both requirements exactly here.

Private connectivity with no internet traversal and no additional cost for the connection.

Which service should they use? Here are your options.

Option A, Amazon RDS.

Option B, Amazon DynamoDB.

Option C, Amazon Redshift.

We just block get object and object version on S3.

We block get secret value, SSM parameter, query on DynamoDB.

So technically, like you can even ask LLM, it will come up you with a list, like in a few loops, like going through that, reading the docs, you will arrive to the decent list.

But there are still places that are hard to fight.

Which combination achieves this? And here are your options.

Option A, DynamoDB Streams triggering a Lambda function.

Option B, a scheduled Lambda function that scans the table every minute.

Option C, Amazon Athena querying the table.

And option D, a CloudWatch alarm on the table.

Let's pause here.

The correct answer here is option A, DynamoDB Streams triggering a Lambda function, and here's why it's right.

DynamoDB Streams capture a time-ordered sequence of every item-level change in the table that's creates, updates, and deletes.

So Cirrus is really quite lightweight.

The core components are two Lambda functions that manage state and a DynamoDB table here.

Around them, we just put a handful of things.

We've got an input SQS queue where users put payloads to be processed, and output messages like published items or workflow events flow to output SNS topics.

This is me on reflection getting to go a little bit wild and try to experiment with some new concepts, some new things, but continuing on the basic ideas of Cirrus.

And reimagining it as something that's cloud agnostic instead of tied to AWS.

So instead of DynamoDB, we used a Postgres database for the core state.

We had an API implemented around the OGC processes API.

And so like, that's what we're working on.

Um, and so for us, yeah, like we, we run it in a DynamoDB, um, in a Postgres, uh, database, but yeah, essentially once you have those API connections, like, which are basically APIs or fancy words for like a backend login username and password essentially.

Uh, and so, which I think this is why I think this is why a lot of people like want me to come and speak.

Cause I can break it down in this way.

Let's make this a thing.

I don't want my agents to just go in there and just build an S3 bucket and a DynamoDB table for me.

I want my agents to be building my infrastructure as code so it's repeatable, it's deployable.

I own the configuration of that.

Here's why this matters so much.

Throughout the series, we have learned individual services: EC2, S3, DynamoDB, VPC, Lambda, and dozens more.

But being a solutions architect isn't just knowing services.

It's knowing how to combine them into architectures that are secure, reliable, efficient, and cost-effective.