TheArchitect

Serverless REST API (API GW + Lambda + DynamoDB)

AWS architecture template · SAA-C03: API Gateway → Lambda business logic → DynamoDB NoSQL table. IAM execution role, CloudWatch error alarm.

Serverless REST API (API GW + Lambda + DynamoDB) is a free AWS architecture template built with API Gateway, CloudWatch, DynamoDB, IAM and Lambda. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
API GatewayAPI HandlerLambda RoleItems TableError Alarm
Serverless REST API (API GW + Lambda + DynamoDB) architecture diagram

AWS services in this template

  • API Gateway
  • CloudWatch
  • DynamoDB
  • IAM
  • Lambda

Deployment notes

Deploy-ready

  • All resources pre-configured with demo code. DynamoDB table uses PAY_PER_REQUEST billing.
  • Lambda has an IAM role with DynamoDB CRUD permissions attached.

Generated CloudFormation — 5 resources

Logical IDResource type
APIGatewayapigatewayAWS::ApiGateway::RestApi
APIHandlerlambdaAWS::Lambda::Function
LambdaRoleiamAWS::IAM::Role
ItemsTabledynamodbAWS::DynamoDB::Table
ErrorAlarmcloudwatchAWS::CloudWatch::Alarm
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "LambdaRoleiam",
          "To": "APIHandlerlambda",
          "Label": "execution role"
        },
        {
          "From": "APIHandlerlambda",
          "To": "ItemsTabledynamodb",
          "Label": "CRUD"
        },
        {
          "From": "APIHandlerlambda",
          "To": "ErrorAlarmcloudwatch",
          "Label": "metrics"
        }
      ]
    }
  },
  "Resources": {
    "APIGatewayapigateway": {
      "Type": "AWS::ApiGateway::RestApi",
      "Properties": {
        "Name": "saa-serverless-api",
        "Description": "SAA-C03 serverless REST API backed by Lambda",
        "EndpointConfiguration": {
          "Types": [
            "REGIONAL"
          ]
        }
      }
    },
    "APIHandlerlambda": {
      "Type": "AWS::Lambda::Function",
      "DependsOn": [
        "LambdaRoleiam"
      ],
      "Properties": {
        "FunctionName": "saa-serverless-api-handler",
        "Runtime": "nodejs20.x",
        "Handler": "index.handler",
        "MemorySize": 512,
        "Architectures": [
          "arm64"
        ],
        "Timeout": 30,
        "Description": "CRUD handler for the serverless REST API. Reads/writes DynamoDB.",
        "Environment": {
          "Variables": {
            "APP_ENV": "demo",
            "LOG_LEVEL": "info"
          }
        },
        "TracingConfig": {
          "Mode": "Active"
        },
        "Code": {
          "ZipFile": "exports.handler = async (event) => ({ statusCode: 200, body: JSON.stringify({ ok: true, requestId: event.requestContext?.requestId || 'demo' }) });"
        },
        "Role": {
          "Fn::GetAtt": [
            "LambdaRoleiam",
            "Arn"
          ]
        }
      }
    },
    "LambdaRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-serverless-api-role",
        "Description": "Lambda execution role with DynamoDB CRUD and CloudWatch Logs permissions",
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": "lambda.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
            }
          ]
        },
        "ManagedPolicyArns": [
          "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
        ]
      }
    },
    "ItemsTabledynamodb": {
      "Type": "AWS::DynamoDB::Table",
      "Properties": {
        "TableName": "saa-serverless-items",
        "BillingMode": "PAY_PER_REQUEST",
        "AttributeDefinitions": [
          {
            "AttributeName": "id",
            "AttributeType": "S"
          }
        ],
        "KeySchema": [
          {
            "AttributeName": "id",
            "KeyType": "HASH"
          }
        ],
        "PointInTimeRecoverySpecification": {
          "PointInTimeRecoveryEnabled": true
        },
        "SSESpecification": {
          "SSEEnabled": true
        }
      }
    },
    "ErrorAlarmcloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "saa-api-errors",
        "AlarmDescription": "Alert when Lambda error rate exceeds threshold",
        "Namespace": "AWS/Lambda",
        "MetricName": "Errors",
        "Statistic": "Sum",
        "Period": 60,
        "EvaluationPeriods": 3,
        "Threshold": 5,
        "ComparisonOperator": "GreaterThanOrEqualToThreshold",
        "TreatMissingData": "notBreaching"
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates