Home / AWS

AWSChecklistIntermediate

Serverless API baseline: API Gateway + Lambda + DynamoDB ready for production

Concurrency, timeouts, retries, DLQs, throttling, versions and aliases, observability and backups for a serverless API that runs in one region.

Deepak Bhardwaj2 min read

Applies toAmazon API Gateway (REST/HTTP APIs), AWS Lambda, Amazon DynamoDB

Serverless services are multi-AZ by default, so a single-region serverless stack is already AZ-resilient. Most production problems come from limits and configuration, not hardware.

Lambda

  • Timeout set to what the function needs (and below the API Gateway integration timeout, 29 s by default for REST APIs).
  • Memory tuned (more memory = more CPU; use Lambda Power Tuning).
  • Reserved concurrency for critical functions so a noisy function can't take the whole account's concurrency; request a regional concurrency quota increase before launch.
  • Provisioned concurrency on the alias for latency-sensitive paths (cold starts).
  • Deploy with versions and aliases (live), and gradual deployment (CodeDeploy canary) with alarms for rollback.
  • Async invocations: on-failure destination or DLQ (SQS), maximum retry attempts and event age set.
aws lambda put-function-concurrency --function-name orders-api --reserved-concurrent-executions 200
aws lambda put-function-event-invoke-config --function-name orders-worker \
  --maximum-retry-attempts 2 --maximum-event-age-in-seconds 3600 \
  --destination-config '{"OnFailure":{"Destination":"arn:aws:sqs:ap-south-1:111122223333:orders-dlq"}}'

API Gateway

  • Stage-level throttling (rate and burst) and usage plans per client.
  • Request validation, WAF for public APIs.
  • Custom domain with ACM certificate; access logs to CloudWatch in JSON.

DynamoDB

  • On-demand capacity for unpredictable traffic, or provisioned with auto scaling.
  • Point-in-time recovery enabled (restore to any second in the last 35 days, into a new table).
  • Deletion protection on.
  • Partition key with high cardinality (avoid hot partitions).
aws dynamodb update-continuous-backups --table-name Orders --point-in-time-recovery-specification PointInTimeRecoveryEnabled=true
aws dynamodb update-table --table-name Orders --deletion-protection-enabled

Observability

  • Structured JSON logs with request IDs; log retention set.
  • AWS X-Ray or OpenTelemetry tracing.
  • Alarms: Lambda Errors, Throttles, Duration p99, ConcurrentExecutions; API 5XXError, Latency; DynamoDB ThrottledRequests, SystemErrors.

Idempotency

Retries happen (client, API Gateway, Lambda async, SQS). Make writes idempotent with an idempotency key (for example Powertools for AWS Lambda idempotency utility backed by DynamoDB).

DR

For region resilience: infrastructure as code (SAM/CDK/Terraform) deployable to the DR region, DynamoDB global tables for data, and Route 53 failover or latency routing in front of two API Gateway regional endpoints.

Related fixes