#100drillexercises

Evolve S3 static website hosting into CloudFront + OAC + WAF. Implement a fully private bucket, security headers including CSP, SPA-friendly error mapping, and how to handle the constraint that CLOUDFRONT-scoped WAFv2 is pinned to us-east-1 with crossRegionReferences in CDK.

Implement S3 static website hosting with Block Public Access fully enabled the whole time. See how the aws:SourceIp condition exempts a policy from S3's "public" determination, and why HTTPS is off the table without CloudFront, verified in CDK.

Build a CodeCommit → CodeBuild → CodePipeline deployment pipeline for a CloudFront/S3 static site, with an S3 sync Lambda, an async CloudFront invalidation Lambda using the CodePipeline continuation-token pattern, and an opt-in manual approval gate — plus a real CloudFormation self-reference bug this pattern uncovered.

Implement AWS Budgets threshold alerts, ML-based Cost Anomaly Detection, a unified Slack delivery combining both, a classic CloudWatch billing alarm, and a Step Functions scheduled cost digest to Slack/Teams — five FinOps alerting patterns as five CDK stacks.

Implement three ways to archive CloudWatch Logs to S3 (Kinesis Data Firehose, the Export Task API, and a Lambda subscription) as five CDK stacks, and compare their latency, cost, and operational trade-offs in code.

Combine a private S3 static site and a private ALB behind a single CloudFront distribution using VPC Origins. Covers automatic Origin Group failover, edge IP allow-listing, and an incident-response escape hatch modeled on a real AWS outage — all in CDK.

Implement three ways to archive CloudWatch Logs to S3 (Kinesis Data Firehose, the Export Task API, and a Lambda subscription) as five CDK stacks, and compare their latency, cost, and operational trade-offs in code.

Learn how to build an event-driven data pipeline combining SQS, Lambda, and Firehose. Covers AWS Lambda Powertools ReportBatchItemFailures implementation, Dead Letter Queue design, and 8 essential CloudWatch Alarms for production operations.

Learn to automate cross-account VPC Peering with AWS CDK using Parameter Store and Custom Resources. Master CDK's cross-account limitations and implement secure network integration across AWS accounts.

Learn two approaches to manage CDK parameters: TypeScript files for type-safety and IDE support, or cdk.json for flexibility. Compare pros and cons, implement environment-specific configurations, and choose the right approach for your project.

Replace NAT Gateway with NAT Instance for 90% cost savings. Learn automated start/stop scheduling with EventBridge, patch management with Systems Manager, and trade-offs for production readiness.

Master VPC fundamentals with AWS CDK: learn subnet design, CIDR calculations, VPC endpoints, flow logs, and secure SSH access using Instance Connect Endpoint