Final Project: Deploy a Serverless API on AWS

Combine IAM, Lambda, API Gateway, and S3 into one real, working serverless API.

Requirements

1. Write at least two Lambda functions (e.g. a GET /items and a POST /items) and expose them through API Gateway with real routes.
2. Give each Lambda function's execution role only the specific permissions it needs (e.g. the write function gets s3:PutObject, the read function only gets s3:GetObject), not broad admin access.
3. Store data in S3 (as JSON objects) or another AWS data store of your choice, read and written through your Lambda functions, not hardcoded.
4. Set up at least one AWS Budget alert on the account you're using, even a small one, as practice for a real project.
5. Document your architecture (which resources you created and how they connect) in a short README.

Stretch goals

• Put your S3 bucket behind a bucket policy that blocks all public access, and confirm your Lambda functions can still read/write it via their IAM role.
• Add a scheduled (EventBridge) Lambda function that runs on a timer, e.g. cleaning up old data.
• Put your whole setup in a VPC with a private subnet, and give your Lambda functions VPC access to reach a resource that isn't publicly exposed.

Submit a link to your finished project (a repo, or a written architecture summary with screenshots of your working API) below, an instructor will review it before you can mark this lesson complete. Good luck! 🚀