Other services (Step Functions and smaller services) — Cheat Sheet (DVA-C02)
Verified against AWS documentation on 2026-10-12 · ⚠️ = changed vs older material: learn the value shown here (older practice material may say otherwise; full list in notes/other-services-guide.md#changed-vs-older-material and notes/current-facts.md) · (volatile) = quota or price that changes often · explanations and examples: notes/other-services-guide.md.
Step Functions state machines and state types
| Topic | Current facts | Memory hook |
|---|---|---|
| ASL basics | JSON with StartAt and States; every non-terminal state has Next or "End": true |
A map of named boxes |
| Execution role | Trusted by states.amazonaws.com; callers need states:StartExecution; creators also need iam:PassRole |
|
| State types | Task, Choice, Parallel, Map, Wait, Pass, Succeed, Fail |
|
| Choice | First matching rule wins; can't be an end state; no match and no Default → the execution fails |
Always leave a Default door |
| Parallel | Output is an array in branch order; one unhandled branch failure fails the state | |
| Inline Map | Default mode; up to 40 concurrent iterations; events land in the parent's history; MaxConcurrency 0 = as parallel as possible |
Inline = inside the parent |
| Distributed Map | Child executions, up to 10,000 in parallel; ItemReader reads S3; ToleratedFailurePercentage/Count; parent must be Standard |
Distributed = many histories |
| Map fields ⚠️ | ItemProcessor and ItemSelector; Iterator and Parameters are deprecated |
|
| Idempotent start | Standard: same name + same input while running → same response; other cases → ExecutionAlreadyExists; name reusable 90 days after close; Express not idempotent |
The name is the idempotency key |
| Versions and aliases | Versions are immutable (…:orders:3); an alias (…:orders:PROD) points to 1 version or splits between 2 by weight |
Alias = traffic dial |
| Redrive ⚠️ | Standard only (runs started since 15 Nov 2023); failed, aborted or timed-out runs; within 14 days; resumes from the failed step with the same ARN | Resume, don't restart |
| Quotas | Definition 1 MB; names ≤ 80 characters; 25,000 history events per Standard run; 1,000,000 open Standard executions |
Step Functions task states and service integrations
| Pattern | Resource suffix |
Works with | Memory hook |
|---|---|---|---|
| Request Response | none | Every integration; the only pattern in Express | Call and move on |
| Run a Job | .sync (.sync:2 returns a nested child's output as JSON) |
Batch, ECS/Fargate, EKS, Glue, Athena, CodeBuild, EMR, SageMaker AI, nested Step Functions; not Lambda, DynamoDB, SNS, SQS | Wait for the job |
| Callback | .waitForTaskToken |
Lambda, SQS, SNS, ECS, EKS, EventBridge, API Gateway, nested Step Functions, SDK integrations; not DynamoDB, Athena, Batch, Glue, CodeBuild | Wait for the token |
| Topic | Current facts | Memory hook |
|---|---|---|
| Lambda (optimized) | arn:aws:states:::lambda:invoke with FunctionName and Payload; result is wrapped → "OutputPath": "$.Payload" |
Unwrap the Payload |
| AWS SDK integrations | arn:aws:states:::aws-sdk:<service>:<apiAction>, more than 200 services; never .sync |
No glue Lambda |
| Task timeouts | TimeoutSeconds defaults to 99,999,999 (set it); HeartbeatSeconds must be lower |
|
| HTTP Task | arn:aws:states:::http:invoke with an EventBridge connection; hard 60 s per call (States.Http.Socket) |
|
| Cross-account task | "Credentials": {"RoleArn": …} makes the execution role assume another role for one task |
|
.sync mechanics |
EventBridge events plus polling (uses API quota); needs extra Describe/Stop and EventBridge rule permissions |
Step Functions error handling with Retry and Catch
| Item | Current facts | Memory hook |
|---|---|---|
| Where | Retry and Catch only on Task, Parallel and Map |
|
IntervalSeconds |
Default 1 | |
MaxAttempts |
Default 3; 0 = never retry |
Zero = never |
BackoffRate |
Default 2.0; wait before retry n = interval × rate^(n−1) | |
MaxDelaySeconds |
Caps each wait (1 to 31,622,400 s); unset = no cap | A ceiling on backoff |
JitterStrategy |
FULL or NONE (default NONE) |
Jitter spreads the herd |
| Evaluation order | Top to bottom, first match wins; States.ALL alone and in the last retrier or catcher; one retrier's MaxAttempts is shared by all errors it matches |
ALL goes last |
Catcher ResultPath |
Default $ replaces the input with {Error, Cause}; "$.error" keeps the input |
|
States.ALL |
Doesn't catch States.DataLimitExceeded or States.Runtime |
ALL isn't all |
States.TaskFailed |
Matches every task error except States.Timeout |
|
States.Timeout |
TimeoutSeconds exceeded or heartbeat missed; a timed-out nested child reaches the parent as States.TaskFailed |
|
| Lambda errors to retry | Lambda.ServiceException, Lambda.AWSLambdaException, Lambda.SdkClientException, Lambda.TooManyRequestsException |
|
| Lambda unhandled errors | Lambda.Unknown; newer runtimes report timeouts as Sandbox.Timedout |
Step Functions input and output processing
| Topic | Current facts | Memory hook |
|---|---|---|
| JSONPath order | InputPath → Parameters → task → ResultSelector → ResultPath → OutputPath |
In, build, pick, place, filter |
ResultPath default $ |
The result replaces the whole input | |
ResultPath: "$.x" |
The result is added under x in the original input |
|
ResultPath: null |
The result is discarded; the input passes through | Null keeps the input |
.$ suffix |
Marks a value as a path or intrinsic ("id.$": "$.orderId"); $$ is the context object ($$.Task.Token) |
Dollar-dot = evaluate |
| JSONata ⚠️ | Since 22 Nov 2024: "QueryLanguage": "JSONata" (top level or per state), Arguments and Output with {% %}, $states.input/result/errorOutput/context |
Two fields instead of five |
| JSONata errors | States.QueryEvaluationError (type error, undefined field, over 1 s) |
|
| Variables ⚠️ | Assign; readable as $name from the next state; 256 KiB per variable and per Assign, 10 MiB per execution |
|
| Payload limit ⚠️ | 256 KiB per task, state or execution input or output, Standard and Express, hard (older material: 32,768 characters) → store in S3 and pass the key |
Step Functions callbacks with task tokens and activities
| Topic | Current facts | Memory hook |
|---|---|---|
| Pass the token | "TaskToken.$": "$$.Task.Token" inside Parameters of a .waitForTaskToken task |
No token, no resume |
| Resume calls | SendTaskSuccess (output ≤ 256 KiB), SendTaskFailure (error, cause), SendTaskHeartbeat |
|
| Avoid stuck runs | Set TimeoutSeconds; for workers also HeartbeatSeconds; a missed heartbeat → States.Timeout |
|
| Expired token | SendTask* with it fails with TaskTimedOut |
|
| Token rules | Up to 2,048 characters; same AWS account only; Standard workflows only | |
| Activity | CreateActivity; Resource arn:aws:states:<region>:<account>:activity:<name>; workers hosted anywhere |
Workers pull |
GetActivityTask |
Long poll up to 60 s, null token when idle → client timeout ≥ 65 s | 60 plus 5 |
| Worker IAM | states:GetActivityTask, states:SendTaskSuccess, states:SendTaskFailure, states:SendTaskHeartbeat |
Step Functions Standard vs Express workflows
| Standard | Express | |
|---|---|---|
| Maximum duration | 1 year | 5 minutes |
| Semantics | Exactly-once | Async at-least-once · sync at-most-once |
| Start | StartExecution, idempotent by name |
StartExecution (async) or StartSyncExecution (sync) |
| History | API and console for 90 days | CloudWatch Logs only (enable logging) |
| Pricing | Per state transition | Per execution, duration and memory |
| Patterns | Request Response, .sync, .waitForTaskToken |
Request Response only |
| Activities, Distributed Map parent, redrive | Yes | No |
StartExecution throttle (volatile) |
Bucket 1,300, refill 300/s (us-east-1, us-west-2, eu-west-1) | Bucket 6,000, refill 6,000/s |
| State transitions (volatile) | 5,000/s in those Regions, 800/s elsewhere | Unlimited |
| Topic | Current facts | Memory hook |
|---|---|---|
| Workflow type | Fixed at creation; can't be changed | |
| Old rate figures ⚠️ | ">2,000/s Standard, >100,000/s Express" replaced by the soft quotas above | |
| Testing ⚠️ | TestState API (INFO, DEBUG, TRACE; mocks since Nov 2025); Step Functions Local is unsupported |
Test one state, mock the rest |
| Sync Express from console | Request expires after 60 s; use SDK or CLI for up to 5 minutes |
AppSync GraphQL APIs and resolvers
| Topic | Current facts | Memory hook |
|---|---|---|
| What it is | Managed GraphQL: schema, resolvers on fields, data sources, caching, real-time subscriptions | One endpoint, exact fields |
| Data sources | DynamoDB, Lambda, OpenSearch, HTTP, EventBridge, Aurora clusters (RDS Data API), NONE |
|
| Resolver types | Unit (one data source) or pipeline (before step, ordered functions, after step, ctx.stash) |
|
| Runtimes | APPSYNC_JS (JavaScript, version 1.0.0) or VTL |
|
| Lambda resolver | operation Invoke or BatchInvoke (fixes N+1); invocationType RequestResponse (default) or Event |
Batch the N+1 |
| Subscriptions | @aws_subscribe(mutations: [...]); fire only for mutations that run through AppSync |
No mutation, no message |
| Protocol ⚠️ | Pure WebSockets only since 1 Jan 2022 (MQTT over WebSockets removed); payloads up to 240 KB | |
| Caching | Full request, per-resolver or operation-level; TTL ≤ 3,600 s; FlushApiCache; extensions.evictFromApiCache |
|
| Data source role | IAM role trusted by appsync.amazonaws.com, scoped to the resource |
AppSync authorization modes
| Mode | Credential | Use when | Memory hook |
|---|---|---|---|
API_KEY |
x-api-key header; default 7 days, 1–365 days |
Development, public read-only data | A key for apps, not users |
AWS_LAMBDA |
Authorization token to your function |
Custom tokens, per-tenant context | Your code decides |
AWS_IAM |
SigV4; appsync:GraphQL on field ARNs |
Back ends, Lambda, identity pool users and guests | |
OPENID_CONNECT |
OIDC JWT; issuer URL, optional clientId regex |
Third-party identity providers | |
AMAZON_COGNITO_USER_POOLS |
User pool JWT; groups in directives | App users with sign-in |
| Topic | Current facts | Memory hook |
|---|---|---|
| Number of modes ⚠️ | Five (older material: four, without AWS_LAMBDA) |
|
| Multiple modes | Default mode plus additional providers; API_KEY, AWS_LAMBDA, AWS_IAM at most once each |
|
| Directives | @aws_api_key, @aws_iam, @aws_oidc, @aws_cognito_user_pools, @aws_lambda; annotate the returned type too |
Tag the field and its type |
| Lambda authorizer response | isAuthorized (required), resolverContext → ctx.identity.resolverContext, deniedFields, ttlOverride (0 = no cache) |
|
| Lambda authorizer limits | 10 s timeout; one per API; AppSync needs lambda:InvokeFunction; no cross-account use |
|
| Failure | UnauthorizedException error (expired API key, bad token, isAuthorized: false) |
|
| Custom domain ⚠️ | Native; ACM certificate in us-east-1; /graphql and /graphql/realtime |
No own CloudFront needed |
Amplify hosting and end to end tests
| Topic | Current facts | Memory hook |
|---|---|---|
| Amplify Hosting | Git-based CI/CD and hosting for SPA, SSR and static sites on the AWS CDN; atomic deployments | Push to deploy |
| Hosting features | An environment per feature branch, a preview URL per pull request, password protection, redirects and rewrites; custom domains get an Amplify-managed certificate by default (own ACM certificate optional) | |
| Git providers | GitHub, Bitbucket, GitLab, CodeCommit | |
| Build spec | amplify.yml: phases (preBuild, build, postBuild), artifacts, cache, optional test |
|
| E2E tests | test phases preTest, test, postTest; Cypress with a mochawesome report; runs between build and deploy |
Test before you ship |
| Skip tests | USER_DISABLE_TESTS = true for all branches; one branch only: false for all plus a true override for that branch; no build spec change |
|
| Gen 2 ⚠️ | GA 6 May 2024: TypeScript backend in amplify/ (defineAuth, defineData); npx ampx sandbox; npx ampx pipeline-deploy |
Code-first Amplify |
| Gen 1 | amplify CLI wizard (amplify push), Amplify Studio, DataStore; not in Gen 2 |
|
| Start a build | aws amplify start-job --app-id … --branch-name … --job-type RELEASE |
AppConfig feature flags validators and deployment strategies
| Topic | Current facts | Memory hook |
|---|---|---|
| Purpose | Validated, gradual, reversible configuration and feature flag changes without a code deployment | Config ships separately |
| Model | Application → environment (alarm monitors) → configuration profile → version → deployment | |
| Sources ⚠️ | Hosted store (recommended), S3, Parameter Store, SSM documents, Secrets Manager, CodePipeline | |
| Hosted store size | 2,048 KB per version by default, adjustable up to 4,000 KB | |
| Feature flags | Profile type AWS.AppConfig.FeatureFlags; validated automatically; multi-variant flags use context rules |
|
| Validators | Up to 2 per profile; JSON Schema (draft 4, structure) and Lambda (semantics, 15 s, base64 content) |
Schema = shape, Lambda = meaning |
| Rollback | Alarm during deployment or bake time → automatic rollback (AppConfig needs a role to read alarms); by hand StopDeployment, AllowRevert within 72 h of completion |
|
| Data plane | StartConfigurationSession → GetLatestConfiguration; empty body = no change; tokens single-use, valid 24 h |
Always use the newest token |
| Deprecated API ⚠️ | GetConfiguration (billed per configuration received) |
|
| Agent | Lambda extension at localhost:2772; poll every 45 s by default; prefetch list cuts cold starts |
|
| Experiments ⚠️ | CloudWatch Evidently discontinued 17 Oct 2025; AppConfig experimentation GA 1 Jul 2026 |
| Predefined strategy | Rollout | Bake time | Use |
|---|---|---|---|
AppConfig.Linear20PercentEvery6Minutes |
+20 % every 6 minutes (30 minutes) | 30 minutes | Production |
AppConfig.Canary10Percent20Minutes |
Exponential, 10 % growth over 20 minutes | 10 minutes | Production |
AppConfig.AllAtOnce |
All targets at once | 10 minutes | Quick changes |
AppConfig.Linear50PercentEvery30Seconds |
50 % every 30 seconds (1 minute) | 1 minute | Testing and demos |
SES for application email
| Topic | Current facts | Memory hook |
|---|---|---|
| Sending interfaces | SES API v2 (sesv2 SendEmail, SendBulkEmail), v1 API, SMTP interface |
|
| Sandbox | Per Region; verified recipients only; 200 messages per 24 h; 1 message per second | Sandbox = small and verified |
| Leave the sandbox | Request production access (console or aws sesv2 put-account-details --production-access-enabled) |
|
| Unverified address error | MessageRejected: "Email address is not verified…" |
|
| Message size | 10 MB with the v1 API; 40 MB with the v2 API or SMTP | |
| Recipients | Up to 50 per message (To, CC, BCC) | |
| SMTP ports | STARTTLS 25, 587, 2587; TLS Wrapper 465, 2465; EC2 throttles port 25 | Use 587 from EC2 |
| SMTP credentials | Per Region, derived for an IAM user; not the secret access key; never from temporary credentials; needs ses:SendRawEmail |
|
| IAM conditions | ses:FromAddress, ses:Recipients (ForAllValues:StringLike), ses:FromDisplayName, ses:FeedbackAddress, ses:ApiVersion |
|
| Cross-account sending | Only through sending authorization policies on the identity | |
| Event publishing | Configuration set (ConfigurationSetName or X-SES-CONFIGURATION-SET) → CloudWatch, Firehose, Pinpoint, SNS, EventBridge |
OpenSearch and Athena for search and analytics
| Topic | Current facts | Memory hook |
|---|---|---|
| OpenSearch role | Full-text and partial-match search, log analytics, vector search next to a primary database | Search sidecar |
| DynamoDB to OpenSearch | Zero-ETL through OpenSearch Ingestion (PITR export + Streams NEW_IMAGE), or Streams → Lambda |
|
| CloudWatch Logs to OpenSearch | Subscription filter (console-created Lambda; Standard log class) or Amazon Data Firehose ⚠️ (formerly Kinesis Data Firehose) | |
| OpenSearch SQL ⚠️ | Built-in SQL plugin, POST _plugins/_sql, OpenSearch or Elasticsearch 6.5+; native language is the JSON DSL |
|
| OpenSearch auth | Domain access policy and IAM (es: actions), fine-grained access control; SigV4 service es (domains) or aoss (Serverless) |
|
| Serverless collections | Search, time series or vector search (fixed at creation); OCUs; data access policies | |
| Athena ⚠️ | Serverless SQL on S3 through the Glue Data Catalog; engine v3 tracks Trino and Presto (older material: Presto) | SQL where the data sits |
| Athena API flow | StartQueryExecution → poll GetQueryExecution → GetQueryResults |
Start, poll, read |
| Athena pricing (volatile) | $5 per TB scanned, 10 MB minimum per query; failed queries not charged, cancelled ones pay for the data scanned so far | Pay for bytes scanned |
| Athena cost cutting | Parquet or ORC, compression, partitions filtered in WHERE, fewer larger files |
|
| Athena results ⚠️ | S3 output location or Athena managed results (no bucket, kept 24 h at no cost) | |
| Federated query ⚠️ | Connectors (traditionally Lambda); since 21 Apr 2026 some Glue Data Catalog connectors run without a Lambda in your account |
MSK vs Kinesis Data Streams
| Topic | Kinesis Data Streams | Amazon MSK |
|---|---|---|
| Model | Shards (1 MB/s in, 2 MB/s out) | Kafka topics and partitions on brokers |
| Scale | Split and merge shards, or on-demand | Add partitions (never remove), add brokers |
| Record size | 1 MiB default, up to 10 MiB ⚠️ (opt-in) | About 1 MB default, raise with a custom configuration; Serverless 8 MiB |
| Retention | 24 h default, up to 365 days | As configured; unlimited with tiered storage or Serverless |
| Authentication | IAM | IAM, SASL/SCRAM, mutual TLS or none; Serverless IAM only |
| In-transit encryption | TLS | TLS-only between clients and brokers by default |
| Topic | Current facts | Memory hook |
|---|---|---|
| Choose MSK when | Existing Kafka clients, Kafka Connect, Kafka APIs or multi-year retention | Kafka in, MSK out |
| KRaft ⚠️ | From Kafka 3.7.x; 3.9 last with ZooKeeper; Kafka 4.x KRaft only; use --bootstrap-server |
No more ZooKeeper |
| Express brokers ⚠️ | Pay-as-you-go storage, up to 3× throughput, 20× faster scaling; 3 AZs only | |
| Standard brokers | EBS 1–16,384 GiB per broker, optional tiered storage, 2 or 3 AZs | |
| MSK Serverless | 200 MBps in, 400 MBps out, 2,400 partitions, 8 MiB messages, IAM access control required | |
| IAM client config | security.protocol=SASL_SSL, sasl.mechanism=AWS_MSK_IAM (or OAUTHBEARER) |
|
| IAM actions | Producer: kafka-cluster:Connect, DescribeTopic, WriteData; consumer adds ReadData, DescribeGroup, AlterGroup |
ACM Private CA and Macie
| Topic | Current facts | Memory hook |
|---|---|---|
| ACM integrated services | ELB, CloudFront, API Gateway, AppSync and Amplify domains, App Runner, Elastic Beanstalk, CloudFormation, Nitro Enclaves | |
| CloudFront certificate | Must be in us-east-1 (also edge-optimized APIs and AppSync domains) | Edge certs live in Virginia |
| Validation | DNS (CNAME, automatic renewal) or email (renewal needs approval) | |
| Validity ⚠️ | Public certificates 198 days; managed renewal from 45 days before expiry | |
| Renewal scope | ACM-issued certificates in use or exported; never imported certificates; ARN unchanged | |
| Expiry events | ACM Certificate Approaching Expiration on EventBridge (30 days public, 45 days private and imported) |
|
| Exportable certificates ⚠️ | $7 per FQDN, $79 per wildcard at issuance and each renewal; standard certificates still not exportable | Exportable costs money |
| AWS Private CA (volatile) | Private root and subordinate CAs; $400 per CA per month (general purpose) or $50 (short-lived mode) | Private trust only |
| Macie | Discovers sensitive data in S3 only (managed and custom data identifiers, allow lists) | Macie reads S3 |
| Macie findings | Policy and sensitive data findings, published to EventBridge automatically; Security Hub CSPM gets policy findings by default; kept 90 days | React with a rule |
Numbers to know
| Value | What |
|---|---|
| 1 year | Standard workflow maximum duration |
| 5 minutes | Express workflow maximum duration |
| 256 KiB | Maximum task, state or execution input or output (hard) |
| 25,000 | Execution history events per Standard execution |
| 40 | Concurrent iterations in an Inline Map |
| 10,000 | Parallel child executions in a Distributed Map |
| 90 days | Standard history retention and execution-name reuse |
| 14 days | Redrive window for Standard executions |
| 3 · 1 s · 2.0 | Retry defaults: MaxAttempts, IntervalSeconds, BackoffRate |
| 99,999,999 s | Default Task TimeoutSeconds |
| 60 s | GetActivityTask long poll (client timeout ≥ 65 s) |
| 60 s | HTTP Task maximum per call |
| 2,048 characters | Maximum task token length |
| 1,000 · 100 | Published versions · aliases per state machine |
| 1,300 · 300/s | Standard StartExecution bucket · refill in the largest Regions (volatile) |
| 6,000/s | Express StartExecution bucket and refill (volatile) |
| 5 | AppSync authorization types |
| 7 days | AppSync API key default expiry |
| 365 days | AppSync API key maximum validity |
| 10 s | AppSync Lambda authorizer timeout |
| 3,600 s | AppSync cache maximum TTL |
| 2 | AppConfig validators per configuration profile |
| 15 s | AppConfig Lambda validator time limit |
| 15–86,400 s | AppConfig RequiredMinimumPollIntervalInSeconds |
| 24 h | AppConfig configuration token validity |
| 45 s · 2772 | AppConfig Agent default poll interval · local port |
| 2,048 KB | AppConfig hosted configuration default size (up to 4,000 KB) |
| 200 · 1/s | SES sandbox messages per 24 h · per second |
| 50 | SES recipients per message |
| 10 MB · 40 MB | SES message size: v1 API · v2 API or SMTP |
| 587 · 2587 | SES SMTP STARTTLS ports to use from EC2 |
| $5 per TB | Athena data scanned price, 10 MB minimum per query (volatile) |
| 10 MiB | Kinesis Data Streams maximum record size (opt-in; default 1 MiB) |
| 8 MiB | MSK Serverless maximum message size |
| 200 · 400 MBps | MSK Serverless ingress · egress per cluster |
| 16,384 GiB | MSK Standard broker maximum storage |
| 198 days | ACM public certificate validity |
| 45 days | ACM managed renewal start before expiry |
| $7 · $79 | ACM exportable certificate per FQDN · wildcard (volatile) |
| $400 · $50 | AWS Private CA per CA per month: general purpose · short-lived (volatile) |
Decision rules
- Orchestrate several services with retries, branching and waits, without orchestration code → Step Functions.
- Client retries must never start a duplicate workflow → Standard workflow with a unique execution
name. - Millions of S3 objects to process in parallel → Distributed Map with
ItemReader. - A Lambda function that only forwards one API call → optimized or AWS SDK integration.
- Wait for a Batch, ECS, Glue, Athena or CodeBuild job →
.sync. - Human approval or a third-party reply →
.waitForTaskTokenwith$$.Task.TokenandTimeoutSeconds. - Workers you host that pull work → activity with a client timeout of at least 65 s and heartbeats.
States.ALLcatcher didn't fire →States.DataLimitExceededorStates.Runtime.- Fallback state lost the input → catcher
"ResultPath": "$.error". - Keep the input, drop the task result →
"ResultPath": null. - State data over 256 KiB → store it in S3 and pass the key.
- Non-idempotent or longer than 5 minutes → Standard; huge rate of short idempotent runs → asynchronous Express.
- API must return the workflow result in the same request → synchronous Express via
StartSyncExecution. - Restart a failed run from the failed step → redrive (Standard, 14 days).
- Unit-test a state without deploying →
TestStatewith mocks. - GraphQL, many sources per request or real-time client updates → AppSync.
- Subscribers not notified → the write bypassed an AppSync mutation.
- N+1 Lambda calls in a GraphQL list →
BatchInvokeor per-resolver caching. - Custom tokens or per-tenant context in AppSync →
AWS_LAMBDAwithresolverContextanddeniedFields. - Public plus signed-in access on one AppSync API → additional mode plus directives on the field and its type.
- Front end in Git needing builds, previews and hosting → Amplify Hosting.
- E2E tests must block an Amplify release → Cypress
testphase; skip one branch withUSER_DISABLE_TESTS. - Change flags or settings without a deploy, with validation and rollback → AppConfig.
- Structure check → JSON Schema validator; business rule → Lambda validator.
- SES messages to customers rejected as unverified → leave the SES sandbox.
- Restrict SES sender and recipients →
ses:FromAddressandses:Recipientsconditions. - Search any word in data stored in DynamoDB → OpenSearch (zero-ETL integration).
- Cut Athena cost → Parquet, compression and partitions.
- Existing Kafka applications to AWS → MSK; no capacity planning → MSK Serverless with IAM.
- Certificate for CloudFront → ACM in us-east-1 with DNS validation; PII in S3 → Macie plus an EventBridge rule.
Memory hooks
- "The name is the idempotency key": Standard
StartExecutionwith the same name and input returns the same run. - "Inline lives in the parent, Distributed gets its own histories": 40 vs 10,000 concurrent.
- "No Default, no exit": a Choice without a match and without
Defaultfails the run. - "Call and move on, wait for the job, wait for the token": no suffix,
.sync,.waitForTaskToken. - "Express only answers the phone": Request Response is its only pattern.
- "Unwrap the Payload": optimized Lambda results arrive inside
Payload. - "ALL goes last and isn't all":
States.ALLalone at the end, blind toDataLimitExceededandRuntime. - "Zero means never":
MaxAttempts: 0disables retries. - "Null keeps the input":
ResultPath: nullpasses the input through. - "Five boxes became two": JSONata replaces the five JSONPath fields with
ArgumentsandOutput. - "No token, no resume": the task token must travel out and come back.
- "60 plus 5": activity long poll 60 s, client timeout at least 65 s.
- "Standard remembers, Express forgets": history via the API vs CloudWatch Logs only.
- "Exactly once costs per step, at least once costs per run": Standard vs Express pricing.
- "No mutation, no message": AppSync subscriptions fire only on AppSync mutations.
- "Batch the N+1":
BatchInvokefor list fields resolved by Lambda. - "A key for apps, not users": AppSync API keys carry no identity and expire after 7 days by default.
- "Tag the field and its type": directives must cover the returned type as well.
- "Test before you ship": Amplify's test phase sits between build and deploy.
- "Config ships separately": AppConfig changes behaviour without a code deployment.
- "Schema checks shape, Lambda checks meaning": the two AppConfig validators.
- "Always use the newest token":
NextPollConfigurationTokenon every AppConfig poll. - "Sandbox = 200 a day, 1 a second, verified only": SES sandbox limits.
- "Pay for bytes scanned": Athena cost drops with Parquet, compression and partitions.
- "Edge certificates live in Virginia": CloudFront, edge-optimized APIs and AppSync domains use us-east-1.