Throughout this guide, you will learn how to use Terraform to build a Serverless application that is used to generate greeting cards for employees working in a fictitious enterprise named AcmeCorp. In the final chapter you can download the sample code used in this guide, as well as get a collection of actionable resources to continue your learning journey.

Each chapter of this guide builds on the previously created solution, adds a new concept, and explains how to wire it with existing components. Note that this guide is not intended to be consumed as a step-by-step workshop or tutorial, its purpose is to illustrate and provide guidance through the concepts you can use to create your own Serverless applications.

• Chapter 3 illustrates configuring Terraform and using it to create Amazon S3 buckets - one for storing employee photos (source bucket), the other for storing generated greeting cards (target bucket).
• Chapter 4 shows how to create an AWS Lambda function that receives an array of employee IDs and generates greeting cards. The function will retrieve photos from the source bucket, generate greeting cards, and store them in the target bucket. Initially you'll invoke that function manually using the AWS CLI.
• Chapter 5 explains how to make the application more consumable by other parts of the business by exposing the functionality via Amazon API Gateway.
• Chapter 6 introduces additional resiliency and scalability into the architecture by adding an Amazon SQS queue to generate greeting cards asynchronously. This would help during the holiday season, when the app needs to generate greeting cards for thousands of employees.
• Chapter 7 and 8 focus on operational aspects of the application, such as observability, deploying to multiple environments and more.

Identity and Access Management

When building applications on AWS, it is important you take care of IAM permissions in order to only allow resources you permit to communicate with each other. For example, you will need to grant your Lambda function permissions to poll (but not push) messages from the SQS queue, as well as read from and write to S3 buckets.

As a general practice, the guide follows the principle of least privileged access. Each step demonstrates how to grant the minimal required set of permissions. The guide will demonstrate how to use a combination of execution roles and resource policies. For example, the Lambda function will have an execution role allowing it to poll messages from the SQS Queue, and SQS Queue will have a resource policy allowing API Gateway to send messages. Read more about using AWS IAM.

Tools

Below tools are used throughout the guide. Install them on your machine if you want to replicate steps described in this guide.

• AWS CLI - installed and configured to work with an AWS Region of your choice
• Terraform CLI
• Text editor or IDE of your choice, such as Visual Studio Code.

Let's get started!