1.2 - Developing with DynamoDB and API Gateway
AWS Certified Developer Associate objective 1.2 covers working with data and APIs. When a Lambda function must read from a DynamoDB table, the correct way to grant access is to attach an execution role with a DynamoDB read permission, so the function uses temporary credentials rather than hard-coded keys. To read only a subset of item attributes and reduce read cost and payload size, a ProjectionExpression names exactly the attributes to return. To build a REST API front end that invokes Lambda functions, Amazon API Gateway handles routing, throttling, authorization and stages. You should also know DynamoDB keys, secondary indexes, query versus scan, and conditional writes. Expect scenario questions that describe granting a function database access, returning only chosen attributes, or fronting Lambda with a managed REST API, and ask which mechanism - execution role, ProjectionExpression or API Gateway - is correct.
Lambda reads DynamoDB = attach an execution role (not keys). Return only chosen attributes = ProjectionExpression. REST front end invoking Lambda = API Gateway.
Practice questions
1. A Lambda function must read from a DynamoDB table. What is the correct way to grant it permission?
- Put access keys in an environment variable
- Make the DynamoDB table public
- Attach an execution role with a DynamoDB read policy (correct answer)
- Call the table from the function's VPC only
A Lambda function assumes its execution role for AWS API calls. Grant least-privilege DynamoDB read permissions on that role; never embed static keys.
2. Which service lets you build a REST API front end that invokes Lambda functions and handles throttling and authorization?
- Amazon Route 53
- AWS Step Functions
- Amazon SNS
- Amazon API Gateway (correct answer)
API Gateway is a managed front door for REST/HTTP/WebSocket APIs: it routes to Lambda or other backends and handles throttling, authorization, caching, and stages.
3. To decouple a producer from consumers with a pull-based queue that retries failed messages, which service should a developer use?
- Amazon Kinesis Data Firehose
- Amazon SNS
- Amazon SQS (correct answer)
- Amazon MQ
SQS is a pull-based message queue: consumers poll messages, and unprocessed messages become visible again after the visibility timeout, with a dead-letter queue for repeated failures.
4. Which capability captures item-level changes in a DynamoDB table so a Lambda can react to inserts and updates?
- DynamoDB TTL
- Global tables
- DynamoDB Streams (correct answer)
- On-demand backups
DynamoDB Streams emit an ordered record of item-level changes; a Lambda trigger can process them for use cases like aggregation, replication, or notifications.
5. An application must write two DynamoDB items so that either both succeed or neither is applied. Which API achieves this atomicity?
- BatchWriteItem across the two items
- A Scan followed by two PutItem calls
- UpdateItem with an increment expression
- TransactWriteItems with both writes (correct answer)
TransactWriteItems groups up to 100 writes into an all-or-nothing ACID transaction. BatchWriteItem is not atomic: individual writes can succeed or fail independently.
6. A developer needs to query a DynamoDB table by an attribute that is not part of the primary key, with its own partition and sort key. Which index type fits?
- A local secondary index created after the table
- A global secondary index with its own keys (correct answer)
- A DynamoDB stream on the base table
- A DAX cluster in front of the table
A global secondary index (GSI) defines a completely different partition and sort key and can be added anytime, with its own provisioned throughput. An LSI shares the base partition key and must be created at table creation.