AWS Cloud Bootcamp: Build and Run a Real App on AWS, from First Account to Production
Build one realistic application on AWS from an empty account to production: TrailPost, a fictional outdoor-gear rental marketplace with customers, partner shops and ops staff. Beginner to advanced across 12 modules and 64 lessons: a safe account and budgets, IAM, the CLI and SDK, CDK in TypeScript, S3, DynamoDB and Aurora, Lambda, API Gateway and Cognito, SQS, SNS, EventBridge and Step Functions, containers on Fargate, networking and WAF, security and governance, CI/CD with OIDC, observability, data and analytics, AI with Bedrock, and cost engineering, plus the mistakes real teams made on the way. Designed for one AWS Free-plan account. Bilingual slides and notes (English + 中文).
Premium content
Upgrade to premium to access all lessons, tutorials, and hands-on exercises.
Lesson Overview
The TrailPost Tour and the AWS Mental Model
Meet TrailPost, the gear-rental marketplace you will build on AWS across this bootcamp. Follow one booking through more than 20 AWS services, learn the AWS mental model (Regions and Availability Zones, zonal vs regional vs global, ARNs, shared responsibility, how you pay), see how the course runs on one Free-plan account, and set up your toolchain and a safe account.
A Safe Account: Root Lock-Down, an Everyday Admin, and No Keys on Your Laptop
Make your AWS account safe to work in: lock down the root user with MFA, create an everyday admin user with no access keys, sign the CLI in with aws login so your laptop only ever sees temporary credentials, prove it with a safety-check script, and see how teams scale this with AWS Organizations and IAM Identity Center.
Billing Guardrails First: Budgets, Anomaly Alerts and the Always-On Bill
Set up the alarms that tell you about money before you build anything: check your Free-plan credits, avoid the credits trap that keeps a normal budget at zero, create a usage-before-credits budget, a real-spend budget and a daily anomaly alert with one rerunnable script, and learn the always-on resources behind most surprise bills.
IAM in Depth: How AWS Decides, and How to Write Least Privilege
Learn how IAM answers every AWS request: identity, resource and trust policies, the evaluation logic where an explicit deny always wins, conditions and the confused deputy, roles and iam:PassRole. Then design a least-privilege role for the bookings API, lint it offline, validate it with IAM Access Analyzer and prove what it allows and denies with the policy simulator.
The CLI and SDK v3 for TypeScript: Credentials, Pages, Retries, Waiters and Errors
Move from the console to code: use the AWS CLI well, understand the SDK credential chain (and where it disagrees with the CLI), read every page with paginators, know what retries do, use waiters instead of sleeps and read errors by name. Then build TrailPost's first TypeScript, a read-only inventory tool, tested offline with mocked AWS clients.
CDK Fundamentals: Apps, Stacks, Constructs, Synth and the Diff Someone Reads
Move TrailPost's infrastructure into code with the AWS CDK: apps, stacks and constructs, one typed per-stage config with no silent defaults, a foundation stack holding the least-privilege role and a log group with retention, synth and diff with no AWS account, the IAM table a reviewer must read, assertion tests that run the policy linter, and bootstrap and deploy.
Tagging and Aspects: Rules the Whole App Follows
Write the rules once and let every synth check every resource: cost-allocation tags computed from the stage (and how to activate and backfill them), Aspects that enforce log retention, required tags and production data retention in the right order, cdk-nag 3 with a specific finding acknowledged next to the code, and tests for rules that fail synth.
S3 Done Right: A Private, TLS-Only, Versioned Photo Bucket
Build TrailPost's photo storage the safe way: what S3 now does by default and what the CDK still leaves off, account-level Block Public Access, a private, ACL-free, encrypted, TLS 1.2+ only, versioned and access-logged bucket with lifecycle rules, per-stage removal decisions, and tests that prove every setting.
Presigned Uploads: Phones Upload Straight to S3, and Every Photo Gets Checked
Let phones and browsers upload photos without AWS keys or a trip through your API: presigned POST forms with an exact key, type, size limit and expiry, the presigned PUT checksum trap, bucket CORS for TrailPost's web origin, S3 events through EventBridge to a Lambda upload check that reads the bytes, recursive-trigger safety, and tests for every guard.
DynamoDB Modelling: The Bookings Table and a Double-Booking Guard
Design TrailPost's bookings table from access patterns: single-table keys, sparse GSIs, per-day lock items written in one conditional transaction so double-booking is impossible, 15-minute holds that expire correctly even though TTL deletes late, idempotency keys for safe retries, on-demand with a throughput ceiling, and tests against DynamoDB Local including a 20-customer race.
Aurora Serverless v2: The Payments Ledger, Its Secrets and a Restore Drill
Build TrailPost's payments ledger on Aurora PostgreSQL Serverless v2: double-entry rules enforced in SQL and tested on PGlite and PostgreSQL 17, an internet-free VPC reached through the RDS Data API, scale to zero in dev and a standby in another AZ in prod, RDS-managed and least-privilege secrets with a rotation protocol, transactional migrations, and a scripted restore drill.
ElastiCache Serverless (Valkey): A Search Cache and a Rate Limiter That Cannot Take You Down
Add ElastiCache Serverless with Valkey where it earns its place: deciding when a cache helps, an atomic token-bucket rate limiter in Lua shared by every Lambda container, cache-aside availability with TTL jitter and generational invalidation that falls back to DynamoDB on any cache failure, an internet-free VPC with a DynamoDB gateway endpoint and usage ceilings, and tests against a real engine.
Backup and Disaster Recovery: Locked Vaults, a Copy in Another Region, and Restores Tested Every Week
Close Module B with a recovery strategy in numbers: RPO and RTO per data store as code, a synth rule that makes every data store declare its backup decision (and the silent-skip bug it exposed), AWS Backup plans selected by tag, a locked vault and a cross-Region copy in prod, weekly restore testing validated by Lambda, and drills that record your real recovery time.