Identity and Access Management (IAM)#

For our team project, only three of us needed explicit access to AWS, following the principle of least privilege, we distributed what was necessary to complete a specific task. I was responsible for the AWS infrastructure so I had admin access to all the services necessary for the project: Lambda, DynamoDB, API Gateway, Amplify, and Bedrock. Other team members were given read access for demonstration recording and write access to Lambda for assistance with writing the function.

We also utilized a role that would allow each of these services to communicate with each other: LambdaRoutines.

Amplify#

AWS Amplify is a cloud-based service provided by Amazon Web Services that allows developers to easily build, deploy, and host full-stack web and mobile applications. It provides frontend hosting, backend support (like APIs and authentication), and smooth integration with GitHub for automated deployments.

Bedrock#

Amazon Bedrock is a fully managed service that allows us to build and scale generative AI applications using foundation models via an API, without needing to manage infrastructure. It supports models from providers like AI21 Labs, Anthropic, Cohere, Meta, Stability AI, and Amazon’s own Titan models. We requested access to on-demand Cohere AI models which are designed for enterprise-level natural language processing tasks such as text classification and summarization with a focus on fast, secure, and customizable language model deployment.

Lambda#

Next, we created our Lambda function that our script.js will call when someone clicks the search button. AWS Lambda is a serverless compute service that lets us run code in response to events (like API calls or file uploads) without managing servers. We uploaded our lamba_function.py code, and Lambda automatically handles the rest.

Essentially, when we do a certain act on the web application, we set up an Invoke API call to API Gateway which sends the user input to Lambda. From there it calls our Cohere Bedrock model and send that information back to the web app to be displayed for the user.

1
import boto3
2
import json
3
from time import gmtime, strftime
4

5
def lambda_handler(event, context):
6
    bedrock = boto3.client(
7
        service_name='bedrock-runtime',
8
        region_name='us-east-1',
9
    )
10
    dynamodb = boto3.resource("dynamodb", region_name='us-east-1')
11
    table = dynamodb.Table("Routines")
12

13
    try:
14
        print(f"Event: {event}")
15
        duration = str(event.get("minutes", ""))
16
        difficulty = str(event.get("difficulty", ""))
17
        focus = str(event.get("muscleGroups", ""))
18

19
        if not duration or not difficulty or not focus:
20
            return {
21
                "statusCode": 400,
22
                "body": json.dumps({"error": "Missing input data"})
23
            }
24

25
        # Construct the prompt
26
        user_prompt = (
27
            f"Create a {duration}-minute {difficulty} workout routine focusing on {focus}. "
28
        )
29

30
        cohere_body = {
31
            "prompt": user_prompt,
32
            "max_tokens": 500,
33
            "temperature": 0.7
34
        }
35

36
        response = bedrock.invoke_model(
37
            modelId="cohere.command-text-v14",
38
            body=json.dumps(cohere_body),
39
            contentType="application/json",
40
            accept="application/json"
41
        )
42

43
        # Read response
44
        result = json.loads(response["body"].read())
45
        workout = result["generations"][0]["text"].strip()
46

47
        # Store in DynamoDB
48
        now = strftime("%a, %d %b %Y %H:%M:%S +0000", gmtime())
49
        routine_id = f"{difficulty}-{duration}min-{focus}"
50

51
        table.put_item(Item={
52
            "ID": routine_id,
53
            "GeneratedAt": now,
54
            "Prompt": user_prompt,
55
            "Workout": workout
56
        })
57

58
        return {
59
            "statusCode": 200,
60
            "headers": {
61
                "Access-Control-Allow-Origin": "https://main.d3iv8nh98y2vwl.amplifyapp.com",
62
                "Access-Control-Allow-Headers": "Content-Type",
63
                "Access-Control-Allow-Methods": "OPTIONS,POST"
64
            },
65
            "body": json.dumps({"workout": workout})
66
        }
67

68
    except Exception as e:
69
        print(f"Error: {e}")
70
        return {
71
            "statusCode": 500,
72
            "headers": {
73
                "Access-Control-Allow-Origin": "https://main.d3iv8nh98y2vwl.amplifyapp.com",
74
                "Access-Control-Allow-Headers": "Content-Type",
75
                "Access-Control-Allow-Methods": "OPTIONS,POST"
76
            },
77
            "body": json.dumps({"error": str(e)})
78
        }

The great thing about lambda was that, we were able to test our function within the service:

DynamoDB#

Amazon DynamoDB is a fully managed NoSQL database that stores data flexibly and at scale. Its schema-less structure was ideal for testing our data setup. We created a “Routines” table using the UI, with the partition key set to ID.

An example data entry would be as follows:

• ID: extra-hard-15 minmin-Glutes
• Time: Wed, 30 Apr 2025 23:09:33 +0000
• Prompt: Create a 15 min-minute extra hard workout routine focusing on Glutes. This should be in bullet points. Less description.
• Workout: Certainly! Below is a 15-minute extra-hard glute workout with minimal descriptions: Glute Bridge - 3 sets of 10 reps, Single-Leg Deadlift - 3 sets of 8 rep

API Gateway#

AWS API Gateway connects the web app to Lambda, handling HTTP requests (like POST) and managing routing, validation, and authorization. This allows secure, serverless interaction between the frontend and backend.

We created a POST API to trigger the Lambda function, using the OPTIONS method to set necessary headers. CORS was enabled to allow secure cross-domain communication between the frontend and AWS services.

CloudWatch#

Dashboards are key in DevSecOps for real-time visibility into system health, security, and performance. We used Amazon CloudWatch to track logs, metrics, and alarms, helping us detect issues quickly.

Our dashboard monitors Lambda requests, latency, errors, database item counts, and key usage to ensure everything runs securely and efficiently.