AWS for Developers 2026 — EC2, S3, Lambda, RDS, and CloudFront Guide

import { S3Client, PutObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3'
import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
 
const s3 = new S3Client({ region: process.env.AWS_REGION || 'us-east-1' })
const BUCKET = process.env.S3_BUCKET!
 
// Upload a file
export async function uploadFile(
  key: string,
  body: Buffer,
  contentType: string
): Promise<string> {
  await s3.send(new PutObjectCommand({
    Bucket: BUCKET,
    Key: key,
    Body: body,
    ContentType: contentType,
    CacheControl: 'public, max-age=31536000',
  }))
  return `https://${BUCKET}.s3.amazonaws.com/${key}`
}
 
// Generate presigned URL for direct browser upload
export async function getUploadUrl(key: string, contentType: string): Promise<string> {
  return getSignedUrl(
    s3,
    new PutObjectCommand({ Bucket: BUCKET, Key: key, ContentType: contentType }),
    { expiresIn: 3600 }
  )
}
 
// Generate presigned URL for private file download
export async function getDownloadUrl(key: string, expiresIn = 3600): Promise<string> {
  return getSignedUrl(
    s3,
    new GetObjectCommand({ Bucket: BUCKET, Key: key }),
    { expiresIn }
  )
}

// handler.ts — Typed Lambda HTTP handler
import type { APIGatewayProxyHandler } from 'aws-lambda'
 
export const handler: APIGatewayProxyHandler = async (event) => {
  const method = event.httpMethod
  const path = event.path
 
  const headers = {
    'Content-Type': 'application/json',
    'Access-Control-Allow-Origin': '*',
  }
 
  try {
    if (method === 'GET' && path === '/users') {
      const users = await getUsers()
      return { statusCode: 200, headers, body: JSON.stringify(users) }
    }
 
    if (method === 'POST' && path === '/users') {
      const body = event.body ? JSON.parse(event.body) : {}
      const user = await createUser(body)
      return { statusCode: 201, headers, body: JSON.stringify(user) }
    }
 
    return { statusCode: 404, headers, body: JSON.stringify({ error: 'Not found' }) }
  } catch (error) {
    console.error('Handler error:', error)
    return { statusCode: 500, headers, body: JSON.stringify({ error: 'Internal error' }) }
  }
}

# serverless.yml — Deploy with Serverless Framework
service: my-api
 
provider:
  name: aws
  runtime: nodejs20.x
  region: us-east-1
  architecture: arm64
  environment:
    DATABASE_URL: ${ssm:/myapp/database-url}
 
functions:
  api:
    handler: dist/handler.handler
    events:
      - httpApi:
          path: /{proxy+}
          method: ANY
    timeout: 30
    memorySize: 512

import { Pool } from 'pg'
 
const pool = new Pool({
  host: process.env.RDS_ENDPOINT,
  port: 5432,
  database: 'myapp',
  user: process.env.RDS_USERNAME,
  password: process.env.RDS_PASSWORD,
  ssl: { require: true, rejectUnauthorized: false },
  max: 10,
  idleTimeoutMillis: 30000,
  connectionTimeoutMillis: 5000,
})

resource "aws_db_instance" "postgres" {
  identifier        = "myapp-db"
  engine            = "postgres"
  engine_version    = "16.2"
  instance_class    = "db.t3.medium"
  allocated_storage = 20
  storage_encrypted = true
 
  db_name  = "myapp"
  username = "dbadmin"
  password = var.db_password
 
  multi_az               = true
  deletion_protection    = true
  skip_final_snapshot    = false
  backup_retention_period = 7
 
  vpc_security_group_ids = [aws_security_group.rds.id]
  db_subnet_group_name   = aws_db_subnet_group.main.name
}

import { CloudFrontClient, CreateInvalidationCommand } from '@aws-sdk/client-cloudfront'
 
const cf = new CloudFrontClient({ region: 'us-east-1' })
 
async function invalidateCache(paths: string[]): Promise<void> {
  await cf.send(new CreateInvalidationCommand({
    DistributionId: process.env.CLOUDFRONT_DISTRIBUTION_ID!,
    InvalidationBatch: {
      CallerReference: Date.now().toString(),
      Paths: { Quantity: paths.length, Items: paths },
    },
  }))
}
 
// Invalidate everything after a deploy
await invalidateCache(['/*'])

// cdk/stack.ts
import * as cdk from 'aws-cdk-lib'
import * as s3 from 'aws-cdk-lib/aws-s3'
import * as cloudfront from 'aws-cdk-lib/aws-cloudfront'
import * as origins from 'aws-cdk-lib/aws-cloudfront-origins'
import * as rds from 'aws-cdk-lib/aws-rds'
import * as ec2 from 'aws-cdk-lib/aws-ec2'
 
class AppStack extends cdk.Stack {
  constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
    super(scope, id, props)
 
    const vpc = new ec2.Vpc(this, 'AppVPC', { maxAzs: 2 })
 
    const assetsBucket = new s3.Bucket(this, 'Assets', {
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      encryption: s3.BucketEncryption.S3_MANAGED,
      versioned: true,
    })
 
    const distribution = new cloudfront.Distribution(this, 'CDN', {
      defaultBehavior: {
        origin: new origins.S3Origin(assetsBucket),
        viewerProtocolPolicy: cloudfront.ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
        cachePolicy: cloudfront.CachePolicy.CACHING_OPTIMIZED,
      },
    })
 
    const db = new rds.DatabaseInstance(this, 'AppDB', {
      engine: rds.DatabaseInstanceEngine.postgres({
        version: rds.PostgresEngineVersion.VER_16,
      }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MEDIUM),
      vpc,
      multiAz: true,
      storageEncrypted: true,
      deletionProtection: true,
    })
  }
}