aws-development

--- name: aws-development description: AWS development best practices for Lambda, SAM, CDK, DynamoDB, IAM, and serverless architecture using Infrastructure as Code. ---

# AWS Development Best Practices

## Overview

This skill provides comprehensive guidelines for developing applications on Amazon Web Services (AWS), focusing on serverless architecture, Infrastructure as Code, and security best practices.

## Core Principles

- Write clean, well-structured code with accurate AWS SDK examples - Use Infrastructure as Code (Terraform, CDK, SAM) for all infrastructure - Follow the principle of least privilege for all IAM policies - Implement comprehensive logging, metrics, and tracing for observability

## AWS Lambda Guidelines

### Configuration Standards - Use TypeScript implementation on ARM64 architecture for better performance and cost - Set appropriate memory and timeout values based on workload requirements - Use environment variables for configuration, never hardcode values - Implement proper error handling and retry logic

### Lambda Best Practices ```typescript // Use ES modules and typed handlers import { APIGatewayProxyHandler } from 'aws-lambda';

export const handler: APIGatewayProxyHandler = async (event) => { try { // Validate input at function start if (!event.body) { return { statusCode: 400, body: JSON.stringify({ error: 'Missing body' }) }; }

// Business logic here

return { statusCode: 200, body: JSON.stringify({ success: true }) }; } catch (error) { console.error('Lambda error:', error); return { statusCode: 500, body: JSON.stringify({ error: 'Internal error' }) }; } }; ```

## AWS CDK Guidelines

### Implementation Standards - Use `aws-cdk-lib` with explicit `aws_*` prefixes - Implement custom constructs for reusable patterns - Separate concerns into distinct CloudFormation stacks - Organize resources by functional groups: storage, compute, authentication, API, access

### Project Structure ``` aws/ ├── constructs/ # CDK custom constructs ├── stacks/ # CloudFormation stack definitions ├── functions/ # Lambda function implementations └── tests/ # Infrastructure tests ```

### CDK Best Practices ```typescript import * as cdk from 'aws-cdk-lib'; import * as lambda from 'aws-cdk-lib/aws_lambda'; import * as dynamodb from 'aws-cdk-lib/aws_dynamodb';

// Use custom constructs for reusable patterns export class ApiConstruct extends Construct { constructor(scope: Construct, id: string, props: ApiProps) { super(scope, id); // Implementation } } ```

## DynamoDB Patterns

### Table Design - Design tables around access patterns, not entity relationships - Use single-table design when appropriate - Implement GSIs for additional access patterns - Use on-demand capacity for variable workloads, provisioned for predictable

### Best Practices - Always use strongly typed item definitions - Implement optimistic locking with version attributes - Use batch operations for multiple items - Enable point-in-time recovery for production tables

## IAM Security Best Practices

### Principles - Apply least privilege: grant only permissions needed - Use IAM roles, not access keys, for AWS service access - Implement resource-based policies where appropriate - Regular audit and rotate credentials

### Policy Example ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem", "dynamodb:Query" ], "Resource": "arn:aws:dynamodb:*:*:table/MyTable" } ] } ```

## SAM Template Configuration

### Template Structure ```yaml AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31

Globals: Function: Timeout: 30 Runtime: nodejs20.x Architectures: - arm64 Tracing: Active

Resources: MyFunction: Type: AWS::Serverless::Function Properties: CodeUri: src/ Handler: index.handler Events: Api: Type: Api Properties: Path: /items Method: GET ```

## API Gateway Configuration

### Best Practices - Use Cognito or IAM for authentication - Implement request validation - Enable CORS only when necessary - Use usage plans and API keys for rate limiting

## Step Functions for Orchestration

- Use Step Functions for complex workflows - Implement error handling with Catch and Retry - Use Express workflows for high-volume, short-duration - Use Standard workflows for long-running processes

## Security Standards

### Encryption - Enable encryption at rest for all storage services - Use AWS KMS for key management - Enable encryption in transit (TLS) - Use custom KMS keys for sensitive data

### Secrets Management - Store secrets in AWS Secrets Manager or Parameter Store - Never commit secrets to version control - Rotate secrets automatically - Use IAM roles to access secrets

## Observability

### Logging - Use structured JSON logging - Include correlation IDs across services - Log at appropriate levels (INFO, WARN, ERROR) - Enable CloudWatch Logs Insights for querying

### Monitoring - Create CloudWatch alarms for critical metrics - Use X-Ray for distributed tracing - Implement custom metrics for business KPIs - Set up dashboards for operational visibility

## Testing

### Unit Testing - Mock AWS SDK calls in unit tests - Use localstack or SAM local for integration testing - Test IAM policies with policy simulator - Validate CloudFormation/CDK with cfn-lint

### Integration Testing ```typescript import { DynamoDBClient } from '@aws-sdk/client-dynamodb'; import { mockClient } from 'aws-sdk-client-mock';

const ddbMock = mockClient(DynamoDBClient);

beforeEach(() => { ddbMock.reset(); });

test('handler returns items', async () => { ddbMock.on(QueryCommand).resolves({ Items: [] }); const result = await handler(event); expect(result.statusCode).toBe(200); }); ```

## CI/CD Integration

- Use AWS CodePipeline or GitHub Actions for CI/CD - Run `cdk diff` or `sam validate` before deployment - Implement staging environments (dev, staging, prod) - Use parameter overrides for environment-specific config

## Common Pitfalls to Avoid

1. Hardcoding AWS credentials or secrets 2. Not setting appropriate Lambda timeouts 3. Ignoring cold start optimization 4. Over-provisioning resources 5. Not implementing proper error handling 6. Missing CloudWatch alarms 7. Inadequate IAM policies (too permissive) 8. Not using VPC when required for compliance