Module 13 · Cloud & System Design · Drills
Reading the AWS docs is not the same as designing on AWS. Write each policy, each snippet, and each architecture sketch yourself before you reveal the solution — that effortful recall is how this becomes real.
Drill 1 IAM
Write a least-privilege IAM policy statement that lets a role read objects (and only read) from the bucket docchat-uploads — nothing else.
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::docchat-uploads/*"
}
Note what's missing: no s3:*, no "Resource": "*". You name the exact action and the exact bucket ARN. The trailing /* means objects inside the bucket, not the bucket itself.
Drill 2 S3 · boto3
Using boto3, generate a presigned URL the browser can use to upload invoice.pdf for user u42 to docchat-uploads, valid for 5 minutes, in the UAE region.
import boto3 s3 = boto3.client("s3", region_name="me-central-1") url = s3.generate_presigned_url( "put_object", Params={"Bucket": "docchat-uploads", "Key": "u42/invoice.pdf"}, ExpiresIn=300, ) print(url)
"put_object" is what makes it an upload URL; "get_object" would make a download URL. ExpiresIn is in seconds, so 300 = 5 minutes.
Drill 3 regions
A Dubai bank says customer data must never leave the UAE. Which AWS Region do you deploy DocChat to, and what's the nearby Gulf alternative?
# Primary — data physically inside the UAE: me-central-1 # UAE Region # Nearby Gulf alternative (Bahrain) — NOT inside the UAE, # so it would fail a strict UAE residency requirement: me-south-1 # Bahrain Region
For a strict UAE-residency rule, only me-central-1 qualifies. Mentioning me-south-1 as the regional neighbour — and why it doesn't satisfy in-country residency — shows you understand the nuance.
Drill 4 compute choice
For each scenario, pick EC2, App Runner/Fargate, or Lambda — and say why in one line. (a) DocChat's always-on FastAPI API. (b) A function that resizes a thumbnail when a PDF lands in S3. (c) A legacy app needing a specific OS and a GPU.
(a) App Runner / Fargate
# Stateless web service, steady traffic, no servers to patch.
(b) Lambda (triggered by the S3 event)
# Spiky, event-driven, short-lived — scales to zero when idle.
(c) EC2
# Needs control of the OS + specific hardware (GPU).
The pattern: event-driven & short → Lambda · normal web service → App Runner/Fargate · special OS/hardware → EC2. Knowing when is the interview skill.
Drill 5 security groups
Read this security-group rule attached to DocChat's RDS instance. In one sentence, what does it allow — and is it safe?
Type: PostgreSQL
Port: 5432
Source: sg-app-runner # the app's security group
# It allows inbound Postgres (port 5432) ONLY from # resources in the app's security group (sg-app-runner). # The database is NOT reachable from the public internet. # Safe. Compare to the DANGEROUS version: Source: 0.0.0.0/0 # = the whole internet. Never do this for RDS.
Sourcing from another security group (not an IP range) is the clean pattern: only the app can reach the database, and you didn't have to hardcode any addresses.
Build · DocChat on AWS
Produce (1) a flow diagram and (2) the IaC resource list.
# ---- 1. Request flow (Region: me-central-1, UAE) ---- Browser ─▶ App Runner (FastAPI) ─▶ presigned URL Browser ─────────────────────────▶ S3 docchat-uploads (private) App Runner ─▶ RDS Postgres + pgvector (private subnet) App Runner ─▶ Secrets Manager (DB password, API keys) App Runner ─▶ CloudWatch (logs, metrics, alarms) # ---- 2. IaC resources (Terraform / CDK) ---- aws_vpc # public + private subnets aws_s3_bucket + public_access_block # private uploads bucket aws_db_instance (RDS Postgres) # pgvector enabled, private aws_security_group (rds) # 5432 only from app SG aws_ecr_repository # holds the FastAPI image aws_apprunner_service # runs the container, HTTPS aws_iam_role + policy # least-privilege S3 + Secrets aws_secretsmanager_secret # DB creds, API keys aws_cloudwatch_log_group # app logs aws_budgets_budget # cost alarm (catch the traps!)
The senior touches: bucket private by default, RDS in a private subnet reachable only via the app's security group, credentials from an IAM role (never baked in), the whole thing in me-central-1 for UAE residency, and a Budgets alarm so the bill never surprises you.
Click a card to flip it. Say the answer out loud before you flip — that's the rep that builds storage strength.
me-central-1 (UAE). Bahrain is me-south-1.RDS (or Aurora) — and pgvector is available on both.App Runner — point it at an image, get HTTPS + autoscaling.Tick each only if you can do it without looking: