Cognito, SES, ElastiCache, Bedrock and service selection

Identity with Cognito

A user pool manages application users and tokens. An identity pool can exchange identities for temporary AWS credentials under configured rules. They are different capabilities. For a server application use a standard authorization flow, validate token issuer/audience/expiry and enforce authorization on the backend. Hiding an upload button is not authorization.

Email with SES

Verify a sender identity, configure DKIM/SPF/DMARC appropriately and inspect sandbox/production restrictions before sending. Process bounces/complaints and send only authorized transactional or opted-in messages. Do not use a classroom lab to email real recipients without permission.

Caching with ElastiCache

Cache repeated expensive reads with a TTL and an invalidation plan. Treat cache loss as recoverable unless you deliberately choose a persistence architecture. Prevent a cache stampede with bounded refresh/coalescing and avoid caching private content under a shared key. Network access, authentication and encryption still matter.

AI with Bedrock and SageMaker

Bedrock supplies managed foundation-model APIs and related capabilities. SageMaker supports broader model development/training/deployment workflows. Model/Region access, invocation price and data handling vary. Never place API credentials in a frontend. A retrieval-augmented application needs document permissions, source attribution and evaluation; retrieval does not guarantee factual output.

Guided extension lab

Choose one extension for a copy of the capstone. Write the problem first, then inputs, outputs, permissions, cost drivers and failure behaviour. For caching, cache the first feed page for a short period and invalidate after a new post. Verify the page remains correct when the cache is unavailable. For identity, replace the lab admin login with an OIDC flow and test both authorized and unauthorized users.

Scope and continued study

This course covers a broad AWS/DevOps engineering path, not every AWS product or every API. Specialized services such as IoT, HPC, game hosting and industry offerings require their own deeper tracks. Use the AWS documentation directory to choose the next service based on an actual requirement.

Official references

Cognito concepts SES guide Bedrock guide AWS documentation directory

Interview and revision check

Why is a cache not automatically the system of record?

Cache entries can expire or be evicted. Decide a durable authoritative store and rebuild behaviour instead of assuming cache survival.