React
React Native
Node.js
Python
Rust
PostgreSQL
Solana
Claude
AI Agents
Go
Containers
AWS SDKs

AWS SDKs SME Cookbook

Sections

AWS SDK Fundamentals

What an AWS SDK Actually Does AWS SDK Fundamentals Basics AWS SDK vs Console vs CLI vs IaC How AWS Bills SDK Calls Anatomy of an AWS API Request Service Endpoints, Partitions & Dual-Stack/FIPS Variants Reading AWS API Reference Docs Like an SDK Developer AWS SDK Fundamentals Best Practices

Clients, Sessions & Configuration Credentials, Profiles & AssumeRole Amazon S3 Amazon DynamoDB AWS Lambda Amazon SQS & SNS Messaging Pagination, Waiters & Retries Error Handling & Exceptions Amazon EC2 & VPC IAM & STS Amazon Bedrock (Generative AI)CloudWatch, Logs & Observability

The AWS CLI as the SDK's Shared Credential Backbone AWS CLI Setup Basics Named Profiles & Multi-Account Config AWS SSO / IAM Identity Center CLI Login Environment Variables vs Config File Precedence CLI Output Formats & `--query`/JMESPath AWS CLI Setup Best Practices

IAM's Role in Every SDK Call IAM Basics for SDK Auth IAM Users, Access Keys & When to Avoid Them IAM Roles for Applications & Services Writing a Least-Privilege Policy for a New SDK Integration IAM Policy Simulator & Access Analyzer for SDK Debugging IAM Basics for SDK Auth Best Practices

Regions, Endpoints & Client Construction Core SDK Mechanics Basics Multi-Region Client Strategy Custom Endpoints & VPC Endpoints (PrivateLink)Request/Response Lifecycle & Middleware Hooks Timeouts & Connection Configuration Core SDK Mechanics Best Practices

Why AWS SDKs Need Paginators, Waiters & Retry Logic Pagination & Retries Basics Paginators in boto3 & SDK v3 Waiters: Polling for Resource State Changes Exponential Backoff & Jitter Configuration Structured Error Handling: ClientError vs SDK v3 Exceptions Idempotency Tokens & Safe Retries Pagination, Waiters & Retries Best Practices

The Credential Provider Chain, End to End Production SDK Configuration Basics STS AssumeRole & Cross-Account Access Web Identity Federation & IRSA (EKS)Instance Metadata Service (IMDSv2) for EC2 Credentials SDK Config Precedence: Env, Profile, Code & Defaults Custom Credential Providers Production Configuration Best Practices

The AWS SDK Family: One Team, Many Languages Choosing an AWS SDK Basics boto3 vs AWS SDK for JavaScript v3: Design Philosophy Bundle Size & Cold Start: Why SDK v3's Modularity Matters Other Language SDKs at a Glance Mixing SDKs in One Organization Choosing an AWS SDK Best Practices

boto3's Session, Client & Resource Model boto3 Fundamentals Basics Sessions: Default, Named Profile & Explicit Low-Level Clients vs the Resources API Typed boto3 with boto3-stubs & mypy-boto3-<service>botocore Under the Hood Async boto3 with aioboto3 / aiobotocore boto3 Fundamentals Best Practices

SDK v3's Command Pattern SDK v3 Fundamentals Basics Installing Only the Clients You Need Credential Providers: `fromEnv`, `fromIni`, `fromNodeProviderChain`The Smithy Middleware Stack SDK v3 in the Browser vs Node.js Using SDK v3 from Deno & Bun SDK v3 Fundamentals Best Practices

Why AWS SDK Rules Exist AWS SDK Rules Quickstart Authentication & Credential Rules Checklist Error Handling & Retry Rules Checklist Cost-Aware SDK Usage Rules Resource Cleanup & Teardown Rules Security Rules for SDK-Calling Services AWS SDK Rules & Best Practices Summary

Core AWS Services

Why These 10 Services Come First Core Services Basics Amazon EC2 via SDK: Your First Instance AWS Lambda via SDK: Your First Function Amazon S3 via SDK: Buckets & Objects Amazon RDS & Aurora via SDK: Your First Database Amazon DynamoDB via SDK: Your First Table AWS IAM via SDK: Users, Roles & Policies Amazon VPC via SDK: Your First Network Amazon CloudWatch via SDK: Metrics & Alarms Amazon SNS via SDK: Your First Topic Amazon SQS via SDK: Your First Queue Core AWS Services Best Practices

Networking & Compute

EC2's Instance Lifecycle Model EC2 Deep Dive Basics AMIs: Finding, Creating & Sharing Launch Templates & Instance Configuration Spot Instances & Interruption Handling Auto Scaling Groups via SDK EC2 Instance Metadata & User Data EC2 via SDK Best Practices

Lambda's Execution Model for SDK Callers Lambda Deep Dive Basics Layers & Shared Dependencies Versions, Aliases & Traffic Shifting Event Source Mappings: SQS, DynamoDB Streams & Kinesis Provisioned Concurrency & Cold-Start Management Lambda Function URLs & Direct Invocation Lambda via SDK Best Practices

ECS & Fargate: Containers Without Managing Kubernetes ECS & Fargate Basics Task Definitions & Container Definitions ECS Services, Deployments & Health Checks Fargate Capacity Providers & Spot Service Discovery & Load Balancer Integration ECS Exec for Debugging Running Tasks ECS & Fargate via SDK Best Practices

What the EKS SDK Actually Manages EKS via SDK Basics Managed Node Groups & Fargate Profiles IAM Roles for Service Accounts (IRSA)EKS Access Entries & aws-auth Migration Add-ons Management via SDK EKS via SDK Best Practices

VPC's Building Blocks, Programmatically VPC via SDK Basics Subnets, Route Tables & Internet Gateways Security Groups vs Network ACLs NAT Gateways & Egress-Only Routing VPC Peering & PrivateLink VPC Flow Logs for Traffic Visibility VPC via SDK Best Practices

ALB vs NLB: Choosing a Load Balancer Type Load Balancing Basics Listeners & Routing Rules Target Groups & Health Check Tuning NLB for TCP/UDP & Static IPs TLS Termination & ACM Integration Load Balancing via SDK Best Practices

CloudFront's Edge Caching Model CloudFront via SDK Basics Cache Behaviors & Origin Groups Invalidations & Cache-Control Strategy Signed URLs & Signed Cookies CloudFront Functions & Lambda@Edge CloudFront via SDK Best Practices

Route 53's DNS & Traffic-Shaping Model Route 53 via SDK Basics Record Types & Alias Records Routing Policies: Weighted, Latency & Failover Health Checks & DNS Failover Private Hosted Zones for VPC-Internal DNS Route 53 via SDK Best Practices

Hybrid Networking: Direct Connect & Transit Gateway Together Hybrid Networking Basics Direct Connect Connections & Virtual Interfaces Transit Gateway Attachments & Route Tables Transit Gateway Peering Across Regions Site-to-Site VPN as a Direct Connect Backup Hybrid & Global Networking Best Practices

Storage & Databases

S3 Beyond Put/Get: The Operations That Matter at Scale S3 Advanced Basics Multipart Upload & the Transfer Manager Presigned URLs for Uploads & Downloads Lifecycle Rules & Storage Class Transitions S3 Event Notifications & EventBridge Integration S3 Select & Batch Operations S3 via SDK Best Practices

EBS vs EFS: Block vs Shared File Storage Block & File Storage Basics EBS Volumes, Snapshots & Encryption EBS Volume Modification & Elastic Volumes EFS Mount Targets & Access Points EFS Lifecycle Management & Performance Modes Block & File Storage Best Practices

Archival Storage's Retrieval-Time Trade-off Archival Storage Basics S3 Glacier Storage Classes via S3 API Legacy Glacier Vaults & Archive Retrieval Jobs Retrieval Tiers: Expedited, Standard & Bulk Automating Archive Lifecycle Transitions Archival Storage Best Practices

S3 Vectors: Object Storage Economics for Vector Search S3 Vectors Basics Vector Indexes & Similarity Search Queries Integrating S3 Vectors with Bedrock Knowledge Bases S3 Vectors vs Self-Hosted Vector Databases Batch-Loading Embeddings at Scale S3 Vectors via SDK Best Practices

RDS & Aurora's Managed-Database Model RDS & Aurora Deep Dive Basics Provisioning Instances & Aurora Clusters Automated & Manual Snapshots Failover, Read Replicas & Aurora Global Database The Aurora Data API for Serverless Access RDS Proxy for Connection Pooling RDS & Aurora via SDK Best Practices

DynamoDB's Access-Pattern-First Design Model DynamoDB Deep Dive Basics Single-Table Design Patterns Queries, Scans & Filter Expressions Transactions & Conditional Writes DynamoDB Streams & Change Data Capture On-Demand vs Provisioned Capacity DynamoDB Local & Testing Strategies DynamoDB via SDK Best Practices

ElastiCache's Role Between App and Database ElastiCache Basics Redis vs Memcached: Choosing an Engine Cluster Mode & Endpoint Discovery Serverless ElastiCache for Variable Workloads Cache-Aside & Write-Through Patterns with Redis ElastiCache via SDK Best Practices

Redshift's Columnar Warehouse Model Redshift Basics Provisioned Clusters vs Redshift Serverless The Redshift Data API for Query Orchestration Loading Data: COPY from S3 & Redshift Spectrum Snapshots & Cross-Region Backup Redshift via SDK Best Practices

DocumentDB's MongoDB-Compatible Model DocumentDB Basics Cluster & Instance Provisioning via SDK DocumentDB Serverless for Variable Workloads TLS & IAM Database Authentication Backup, Restore & Global Clusters DocumentDB via SDK Best Practices

AI & Generative AI

Mapping AWS's AI Surface: Bedrock, SageMaker & Purpose-Built Services AI on AWS Basics Foundation Models vs Purpose-Built AI Services The 2026 Generative AI Growth Curve on AWS AWS AI/ML Pricing Models Compared AI on AWS Best Practices

Bedrock's Unified Model-Invocation API Bedrock Basics The Converse API vs InvokeModel Streaming Responses with ConverseStream Model Selection: Claude, Llama, Nova & Titan Trade-offs Multimodal Inputs: Images & Documents Tool Use / Function Calling via Bedrock Provisioned Throughput & On-Demand Inference Bedrock via SDK Best Practices

Managed RAG on Bedrock: What the Knowledge Base Owns Bedrock Knowledge Bases Basics Data Sources & Smart Parsing Ingestion Sync Jobs & Incremental Ingestion The Agentic Retriever for Multi-Step Queries RetrieveAndGenerate vs Retrieve-Then-Prompt Choosing S3 Vectors vs OpenSearch as a Knowledge Base Store Bedrock Knowledge Bases Best Practices

AgentCore's Managed Agent Runtime AgentCore Basics The AgentCore Managed Harness: Model + Prompt + Tools AgentCore Gateway & Tool Registration The Managed Web Search Tool Agent Memory & Session State Observability & Guardrails for Production Agents AgentCore CLI & Skills for Coding Assistants AgentCore via SDK Best Practices

SageMaker's End-to-End ML Lifecycle Model SageMaker Training Basics Training Jobs: Built-in Algorithms vs Custom Containers Distributed & Spot Training Hyperparameter Tuning Jobs Experiment Tracking with SageMaker Experiments Bring-Your-Own Training Containers SageMaker Training via SDK Best Practices

SageMaker's Inference Deployment Options SageMaker Deployment Basics Real-Time Endpoints & Auto Scaling Serverless Inference for Bursty Workloads Multi-Model & Multi-Container Endpoints Asynchronous Inference for Large Payloads SageMaker Model Monitor for Drift Detection SageMaker Deployment via SDK Best Practices

Rekognition's Pretrained Vision Model Surface Rekognition Basics Object, Scene & Label Detection Face Detection, Comparison & Analysis Content Moderation for Images & Video Video Analysis with Asynchronous Operations Custom Labels for Domain-Specific Detection Rekognition via SDK Best Practices

Comprehend's Managed NLP Model Surface Comprehend Basics Entity & Key Phrase Extraction Sentiment & Language Detection PII Detection & Redaction Custom Classification & Custom Entity Recognition Batch vs Real-Time Comprehend Jobs Comprehend via SDK Best Practices

Transcribe & Polly: Speech In, Speech Out Speech Services Basics Transcription Jobs & Streaming Transcription Speaker Diarization & Custom Vocabulary Medical & Call Analytics Transcription Variants Polly Voices, SSML & Speech Marks Speech Services via SDK Best Practices

Textract's Structured-Extraction Model Textract Basics Form & Table Extraction Textract Queries for Targeted Extraction Asynchronous Document Analysis for Multi-Page Files Human Review with Augmented AI (A2I)Textract via SDK Best Practices

Lex's Intent-and-Slot Conversation Model Lex Basics Intents, Slots & Slot Types Lambda Fulfillment & Dialog Hooks Runtime Conversation Handling Lex vs Bedrock for Conversational Interfaces Lex via SDK Best Practices

Amazon Q's Two Products: Business vs Developer Amazon Q Basics Q Business: Data Sources & Indexing Q Business Chat & Plugin Integrations Q Developer in CI/CD & IDE Workflows Access Control & Guardrails for Q Business Amazon Q via SDK Best Practices

Choosing AI Compute: GPUs vs Trainium/Inferentia AI Infrastructure Basics P5/P6 GPU Instances for Large-Scale Training Trainium for Cost-Efficient Training Inferentia for High-Throughput Inference Capacity Reservations & Capacity Blocks for ML AI Infrastructure via SDK Best Practices

Security & Management

IAM's Policy Evaluation Logic IAM Advanced Basics Policy Document Structure & Conditions Permission Boundaries for Delegated Admin Cross-Account Roles & Resource-Based Policies IAM Access Analyzer for Unused Access Service Control Policies (SCPs) via Organizations IAM Advanced via SDK Best Practices

Cognito's User Pool vs Identity Pool Split Cognito Basics User Pools: Sign-Up, Sign-In & MFA Identity Pools & Temporary AWS Credentials Federated & Social Sign-In (SAML, OIDC, Google/Apple)Custom Authentication Flows & Lambda Triggers Cognito via SDK Best Practices

KMS's Envelope-Encryption Model KMS Basics Symmetric vs Asymmetric Keys Envelope Encryption with Data Key Generation Grants & Key Policies for Delegated Access Automatic Key Rotation & Multi-Region Keys KMS via SDK Best Practices

WAF & Shield's Layered Protection Model WAF & Shield Basics Web ACLs, Rules & Rule Groups Rate-Based Rules & Bot Control WAF Logging & Sampled Requests Shield Advanced & DDoS Response Team Access WAF & Shield via SDK Best Practices

GuardDuty & Security Hub Together Threat Detection Basics GuardDuty Detectors & Finding Types Automated Response to GuardDuty Findings Security Hub Standards & Compliance Scores Multi-Account Security Aggregation via Organizations Threat Detection via SDK Best Practices

CloudWatch's Metrics/Logs/Alarms/Events Model CloudWatch Deep Dive Basics Custom Metrics & Embedded Metric Format (EMF)CloudWatch Logs Insights Queries via SDK Composite Alarms & Anomaly Detection Dashboards as Code via SDK CloudWatch via SDK Best Practices

Deploying Infrastructure From Application Code CloudFormation & CDK Basics Stack Creation, Updates & Change Sets Drift Detection via SDK CDK App Synthesis & Programmatic Deploy Nested Stacks & Cross-Stack References IaC via SDK Best Practices

CloudTrail as the API-Call Audit Log CloudTrail Basics Trails, S3 Delivery & Log File Validation Event History Queries via SDK CloudTrail Lake for SQL-Based Audit Queries Detecting Suspicious Activity from CloudTrail CloudTrail via SDK Best Practices

SNS & SQS Together: Fan-Out Messaging Messaging Deep Dive Basics FIFO Topics & Queues Dead-Letter Queues & Redrive Policies Batching, Long Polling & Visibility Timeouts Message Filtering with SNS Subscription Filters SNS & SQS via SDK Best Practices

EventBridge & Step Functions: Events and Orchestration Event-Driven AWS Basics Event Buses, Rules & Pattern Matching Cross-Account & Cross-Region Event Routing Step Functions State Machines: Standard vs Express Step Functions SDK Integrations (Including AgentCore & S3 Vectors)Error Handling & Retries in State Machines Event-Driven AWS via SDK Best Practices

Systems Manager as the Fleet Operations Toolkit Systems Manager Basics Parameter Store: Standard vs Advanced Parameters Run Command for Fleet-Wide Execution Automation Documents & Runbooks Session Manager for Shell Access Without SSH Systems Manager via SDK Best Practices

Craft, Architecture & Production Operations

Why AWS SDK Code Needs Its Own Testing Strategy AWS SDK Testing Basics moto for Python: Mocking boto3 in Tests aws-sdk-client-mock for TypeScript LocalStack for Local AWS Emulation Contract Tests Against Real AWS in CI AWS SDK Testing Best Practices

Designing for AWS's Failure Modes Architecture Basics Circuit Breakers & Bulkheads Around AWS Calls Idempotent Service Design Around SDK Calls Multi-Account Architecture for AWS SDK Applications Architecture Decision Records for AWS Integrations Well-Architected Framework Through an SDK Lens Architecture & Resilience Best Practices

Where AWS SDK Code Actually Spends Time and Money Performance Basics Connection Pooling & Client Reuse Batching APIs to Cut Request Counts Concurrency Limits & Backpressure Cost-Aware SDK Usage Patterns Load Testing SDK-Backed Services Performance & Cost Best Practices

Security for AWS SDK Code: Defaults and Gaps Security Basics Secrets Handling: Never in Code, Never in Logs Input Validation for AWS-Bound Data Dependency Scanning for boto3 & @aws-sdk Packages Least-Privilege Verification in CI Data Residency & Encryption-in-Transit/At-Rest Checklist Security Best Practices Summary

Observability for AWS SDK Applications Observability Basics Structured Logging Around SDK Calls AWS X-Ray Tracing for SDK-Calling Services OpenTelemetry Instrumentation for AWS SDKs CloudWatch Application Signals & Service Maps Observability Best Practices

Categories of AWS SDK Failures Debugging Basics Throttling & Rate-Limit Defect Walkthrough Credential Expiry & Silent Auth Failures Retry Storms & Cascading Failure Eventual Consistency Surprises Production Incident Response for AWS-Backed Services Debugging & Incident Response Best Practices

Delivery, Leadership & Ecosystem

Leading AWS SDK Technical Work Technical Leadership Basics Design Reviews for New AWS Integrations Release Strategy & Feature Flags for AWS-Backed Features DORA Metrics for AWS SDK Teams Mentoring Engineers New to AWS SDKs Working with Product on AWS-Cost-Sensitive Features Technical Leadership & Delivery Best Practices

What Makes a Good AWS SDK Reference Build Case Studies Basics Building a Serverless REST API: Lambda + DynamoDB + API Gateway Building a RAG Chatbot: Bedrock + Knowledge Bases + S3 Vectors Building a Data Pipeline: S3 + Lambda + Step Functions + Redshift Before/After: Refactoring a Monolithic SDK Integration Case Studies & Reference Builds Best Practices

Why AWS SDK Code Needs Governance Standards & Governance Basics Coding Standards for boto3 & SDK v3 Codebases Dependency Governance for AWS SDK Packages Tracking AWS Deprecations & SDK Major Versions Staying Current: AWS What's New & SDK Release Notes Standards & Governance Best Practices

What an "Agent Skill" Means for AWS SDK Work Agent Skills Basics A Credential-Setup Skill for New Projects A Cost-Review Skill for SDK-Heavy PRs A Service-Client Scaffolding Skill Agent Skills Best Practices

Git Workflows for AWS SDK Teams Git & GitHub Basics Preventing Leaked AWS Credentials in Commits Protected Branches & Review Requirements for Infra-Touching PRs Git & GitHub Best Practices

The Shell as an AWS SDK Developer's Companion Linux CLI Basics jq & Parsing AWS CLI/SDK JSON Output Managing AWS Env Vars & Credentials Safely in Shell Sessions Linux CLI Best Practices

Onboarding an AWS SDK Specialist Team & Onboarding Basics Sandbox Accounts & Safe Experimentation A 30/60/90 Ramp-Up Path for AWS SDK Engineers Team & Onboarding Best Practices

/

/

© 2026 @csjcode|SystemsArchitect.io: Cloud Systems Tools|Terms

An independent, unofficial educational resource. Not affiliated with, endorsed, or sponsored by the brand/trademark maintainers/owners.

Search Documentation

Search across all documentation pages

AWS SDKs SME/Tags/Security Best Practices

#Security Best Practices8 pages

Pages tagged Security Best Practices across 1 section.

Data Residency & Encryption-in-Transit/At-Rest Checklist Dependency Scanning for boto3 & @aws-sdk Packages Input Validation for AWS-Bound Data Least-Privilege Verification in CI Secrets Handling: Never in Code, Never in Logs Security Basics Security Best Practices Summary Security for AWS SDK Code: Defaults and Gaps

Related tags

Aws Aws Sdk Boto3