The application-facing services at AWS make it easier to expose APIs, authenticate users, and build full-stack experiences. Amazon API Gateway creates, publishes, maintains, monitors, and secures REST, HTTP, and WebSocket APIs, with REST APIs offering the richest features (request validation, usage plans, API keys) and HTTP APIs offering a cheaper, lower-latency fit for Lambda-backed serverless backends. Throttling protects backends with a steady-state limit of ten thousand requests per second per account and a five-thousand-request-per-second burst, returning HTTP 429 when exceeded; per-method rate and burst limits and API-key-based quotas are configured on REST APIs. Amazon Cognito provides authentication, authorization, and user management through User Pools (user directories with sign-in, MFA, and SAML/OIDC federation) and Identity Pools (which exchange IdP tokens for temporary AWS credentials), issuing ID, access, and refresh JWTs and acting as an OIDC identity provider for API Gateway and ALB. AWS Amplify is a set of tools and services for building full-stack web and mobile apps, with Amplify Studio's visual UI builder, the Amplify CLI for backend resources (Auth, Storage, Functions, GraphQL), and Amplify Hosting for Git-based CI/CD with CloudFront, branch previews, and custom domains. AWS AppSync is a managed GraphQL service that delivers a single endpoint to securely query and mutate data from multiple sources such as DynamoDB, Aurora, Lambda, OpenSearch, and HTTP endpoints, including real-time subscriptions over WebSockets and offline data sync.
Observability centers on Amazon CloudWatch, which provides metrics (AWS service metrics retained for fifteen months at no cost, custom metrics via the PutMetricData API, and application metrics through the CloudWatch Agent or SDK) at one-minute resolution by default and one-second resolution for detailed monitoring on supported services. CloudWatch Alarms watch a single metric and trigger actions such as SNS notifications, Auto Scaling, EC2 recovery, or Lambda invocations when thresholds are crossed, with three states (OK, ALARM, INSUFFICIENT_DATA) and composite alarms that combine multiple alarms using AND/OR logic. Anomaly Detection applies machine learning to a metric's history to create expected bands and reduces false positives from static thresholds on spiky or seasonal workloads. CloudWatch Logs centralizes log ingestion from EC2, Lambda, ECS, Route 53, VPC Flow Logs, and on-premises sources; Logs Insights is an interactive query language for searching and aggregating log events; metric filters turn log patterns into metrics; and subscription filters stream logs to Kinesis, Lambda, or OpenSearch. Logs persist indefinitely unless a retention policy is set. CloudWatch Synthetics runs canaries-configurable scripts that follow user paths in an application around the clock, checking availability and latency, capturing screenshots, and writing to Logs. AWS X-Ray provides distributed tracing that captures requests as they travel through services such as Lambda, ECS, EC2, API Gateway, and DynamoDB, showing a service map and surfacing latency breakdown; instrumentation can use the X-Ray SDK or AWS Distro for OpenTelemetry (ADOT), a secure AWS-supported OpenTelemetry distribution with auto-instrumentation for Java, Python, .NET, and Go that exports to CloudWatch, X-Ray, or any OTLP backend. Amazon Managed Service for Prometheus (AMP) provides a serverless Prometheus-compatible metrics backend that integrates with ADOT, EKS, ECS, and EC2 and dashboards through Amazon Managed Grafana, a fully managed Grafana service with SSO via IAM Identity Center, Okta, or Auth0 and fine-grained access controls.
Infrastructure as Code on AWS covers declarative, imperative, and serverless flavors. AWS CloudFormation defines resources in JSON or YAML templates: a Template describes desired resources, a Stack is a running collection of those resources, a Change Set previews updates before applying, and Drift Detection identifies manual changes made outside CloudFormation. AWS CDK is an open-source framework that uses familiar programming languages (TypeScript, Python, Java, Go, .NET) to define infrastructure through reusable constructs, which synthesize into CloudFormation and deploy via the cdk deploy command. AWS SAM (Serverless Application Model) extends CloudFormation with simplified syntax for Lambda, API Gateway, DynamoDB, SQS, and Step Functions; the SAM CLI powers sam local, sam build, sam deploy, and pipeline-driven CI/CD. AWS CodeBuild runs managed continuous integration by compiling, testing, and packaging code in ephemeral Docker containers according to a buildspec.yml with pay-per-build-minute pricing; AWS CodeDeploy automates application deployments to EC2, ECS, Lambda, and on-premises servers with In-place and Blue/Green strategies (the latter enabling traffic shifting via ALB and Route 53 plus fast rollback); AWS CodePipeline orchestrates source, build, test, and deploy stages with parallel execution and manual approvals, integrating source from CodeCommit, S3, ECR, GitHub, or Bitbucket. Note that CodeCommit is being closed to new customers, so most teams now use GitHub, GitLab, or CodeCatalyst. AWS Service Catalog centrally manages and governs approved IT services as CloudFormation-backed products that end users self-service launch within launch constraints; AWS Proton offers template-driven deployment for platform engineers with environment and service templates that developers use to self-serve versioned infrastructure. AWS App Runner is a fully managed way to deploy containerized web apps and APIs from source code or a container image with automatic scaling, load balancing, and TLS, perfect for simple services that do not need complex networking.