Goal and architecture

Build a small visitor counter: API Gateway → Lambda → DynamoDB, with CloudWatch logs, metrics, alarms, and a dashboard. Explore the architecture.

Prerequisites

Terraform 1.5.7 or newer, AWS CLI v2, and an authenticated sandbox identity allowed to manage IAM, Lambda, API Gateway, DynamoDB, and CloudWatch. Use one deployment per account and region because this lab uses fixed resource names. The Python 3.12 handler uses the AWS runtime’s bundled SDK.

Download and deploy

Download the complete lab. Extract it and open its serverless-monitoring folder.

The lab creates a public demo endpoint with throttling and no authentication. Use only synthetic requests; this is not a production API. AWS usage charges may apply to the API, Lambda, DynamoDB, logs, alarms, and dashboard.

aws sts get-caller-identity
terraform init
terraform validate
terraform plan -out=lab.tfplan
terraform apply lab.tfplan
terraform output

The default region is us-east-1; set region in terraform.tfvars if you need another region. Use that same region for the AWS CLI commands below.

Validate the request flow

curl --fail "$(terraform output -raw visit_url)"
curl --fail "$(terraform output -raw visit_url)"
aws logs tail "$(terraform output -raw log_group)" --since 10m --region us-east-1

Both requests should return HTTP 200 with a JSON message and an increasing visits count. Logs contain a structured visit event and request ID. Open the portfolio-monitoring-lab CloudWatch dashboard to inspect invocation counts and duration; metrics can take several minutes to appear.

Exercise error monitoring

Invoke the function directly with the deliberate test flag. The public HTTP endpoint cannot set this top-level Lambda event field.

aws lambda invoke --function-name "$(terraform output -raw function_name)" \
  --cli-binary-format raw-in-base64-out \
  --payload '{"lab_test_error":true}' --region us-east-1 response.json
aws cloudwatch describe-alarms --alarm-name-prefix portfolio-monitoring-lab --region us-east-1

The invocation response should include FunctionError. After metric evaluation, the errors alarm should enter ALARM; it returns to OK after the error period clears. The duration alarm is separately configured for average execution time above three seconds. These alarms change state but intentionally do not send notifications.

Troubleshooting

A 404 usually means the /visit path is missing. For 500 responses, inspect Lambda logs, its DynamoDB permission, and API Gateway invocation permission. A 429 indicates the lab throttle; slow down requests. If metric widgets are empty, verify the console region and time window. A name conflict means a previous lab deployment remains; use its original state to clean it up.

Cleanup

terraform plan -destroy
terraform destroy
terraform state list

Confirm the state list is empty and the demo endpoint no longer responds successfully. Cleanup deletes the counter table, function, API, execution role, log group, dashboard, and alarms. Keep the state file until destruction completes.

References and verification

This lab has not been deployed to AWS as part of the portfolio build. Local code and configuration checks do not establish cloud execution success.