Functional test matrix
| Test | Expected result | Evidence |
|---|---|---|
| Empty feed | Useful empty message | Browser screenshot |
| Valid admin login | Studio becomes available | Session response, no password echo |
| Small valid video upload | Post ID returned; row and object created | Feed, SQL row, S3 key |
| Caption update | Same post shows new text | Refresh feed and SQL SELECT |
| More than ten posts | Load-more cursor works | No duplicated/skipped IDs in static test |
| Reload after URL expiry | Fresh media link plays | Network response |
Negative tests
Attempt upload while signed out: expect denial and no new object/row. Submit missing CSRF: expect 403. Submit text renamed to .mp4: expect rejection by MIME validation. Try an over-limit upload: expect client/server rejection. Enter <script>alert(1)</script> as caption and confirm it displays as text. Fetch /config/config.example.php or /vendor/: these must not expose project internals because the public directory is the root.
Infrastructure tests
Unsigned private S3 object URL should fail. MySQL should accept connections only from authorized network sources with valid credentials/TLS. The application SQL user should not be able to DROP TABLE. SSH should be limited to the intended management path. Verify there are no long-term AWS keys in project files, user data or browser responses.
Failure drills
Stop PHP-FPM on the lab and observe the failure, then restore it. Remove only the lab S3 write permission and confirm upload fails without exposing secrets. Test RDS connectivity from EC2 and distinguish timeout from SQL authentication errors. Keep changes documented so each drill is reversible.
Production gaps to discuss
The sample is a teaching baseline: single admin, local sessions, no video transcoding, no malware scanning, no public account lifecycle, no moderation, no automated orphan reconciliation and no multi-instance release pipeline. Before public scale, add those controls as required, load-test, review dependencies, harden logging/rate limits and conduct a security review. Do not label a successful classroom upload a production readiness test.
Teardown
Back up any wanted learning data. Remove the lab EC2 instance, role attachment, RDS instance according to final-snapshot policy, S3 versions/delete markers, unused EBS/Elastic IP resources and any load balancer/NAT resources. Remove lab DNS records only after confirming nothing depends on them. Check billing/resource inventory the next day.
Ravindra’s Tip
Project तभी complete मानो जब success और failure दोनों दिखा सको। “Video upload हो गया” के साथ यह भी दिखाओ कि बिना login upload क्यों नहीं होता।
Official reference
Interview and revision check
What evidence makes this more than a successful upload demo?
Verified denied writes, private S3, scoped SQL access, safe caption rendering, recovery checks and a clear teardown record.
Ravindra Bagale · Cloud & DevOps Academy · Handbook and project downloads