AWS CDK and Infrastructure with Programming Languages

AWS Cloud & DevOps Engineering · Lesson 33 · DevOps Automation and IaC

Lesson Overview

Terraform speaks HCL. CloudFormation speaks templates. The AWS Cloud Development Kit (CDK) lets TechLearningPro engineers define infrastructure in familiar languages—TypeScript preferred in this course—using object-oriented constructs that synthesize into CloudFormation templates and then deploy as stacks. Under the hood you are still on CloudFormation’s state model: drift, change sets, stack events, and IAM for deployment. CDK is not magic; it is a high-level generator with testing hooks and strong AWS integration.

Infrastructure as Code with CloudFormation and Terraform Fundamentals for AWS remain peers. Pick a primary tool per boundary via ADR. This lesson teaches constructs, stacks, apps, environments, cdk synth, bootstrap concepts, and a secure serverless API sketch for TechLearningPro—without inventing CLI flags. Deployment Strategies will shift traffic; today you provision the platform pieces those strategies need.

Budget alert. Tag Project=tlp-lesson33. No secrets in code. Destroy stacks after lab.

Learning Objectives

1. Explain CDK’s value: real languages, constructs, and CloudFormation under the hood.
2. Distinguish L1 (CFN resources) vs L2 (curated) vs L3 (patterns) constructs conceptually.
3. Structure a CDK app with stacks and environments (account/region).
4. Run synth to inspect generated CloudFormation; read it when debugging.
5. Explain bootstrap: why an environment needs CDK toolkit resources before deploy.
6. Deploy a stack and interpret CloudFormation events through the CDK workflow.
7. Prefer TypeScript for course examples; note Python/Java/etc. exist.
8. Wire a secure serverless API sketch: API Gateway + Lambda + least-privilege, secrets out of source.
9. Compare CDK vs Terraform vs raw CloudFormation for TechLearningPro teams.
10. Test constructs with assertions at a conceptual level (template unit tests).
11. Avoid dual-managing the same resources with Terraform and CDK.
12. Apply tagging, budget, and destroy discipline.
13. Understand assets/bundling awareness for Lambda code without inventing packagers.
14. Connect CDK deploys to CI like any other IaC.
15. Preview policy-as-code checks on synthesized templates (lesson 35).

Prerequisites

• CloudFormation lesson 29; Terraform 30–31 for contrast.
• API Gateway and Serverless APIs, AWS Lambda and Serverless Fundamentals.
• AWS Identity and Access Management.
• Node.js/TypeScript comfort for preferred path; AWS credentials for sandbox.
• Budget alert.

Detailed Core Concepts

What CDK is

An AWS open-source framework: you write an App containing one or more Stacks composed of Constructs. cdk synth produces CloudFormation templates (and assets). cdk deploy uploads assets as needed and creates/updates stacks via CloudFormation.

Constructs levels

• L1: thin wrappers over CloudFormation resources—verbose but complete.
• L2: opinionated helpers (Lambda Function, Bucket) with sensible defaults and helpers for permissions.
• L3: patterns (for example API + Lambda patterns)—powerful; understand what they create before using in regulated environments.

Synth and the template truth

When debugging permissions or surprise resources, open the synthesized template. CDK abstractions that you do not understand still bill you and still expand IAM.

Bootstrap

Each target account/region typically needs a bootstrap stack (CDK toolkit) providing staging buckets and roles for deployments. Bootstrapping is a privileged one-time (per env) operation—treat it like creating a Terraform state bucket: intentional, documented, least privilege over time. Verify current bootstrap procedure in AWS CDK docs; do not invent flags here.

Environments

Stacks can be environment-agnostic or pinned to account/region. Production should pin. Feature-branch stacks need naming strategies and cleanup.

Languages

TypeScript is first-class and matches many web teams. Python is common for data/ML orgs. This course’s snippets prefer TypeScript. Concepts transfer.

CDK vs Terraform

Assets

Lambda code and Docker assets are bundled/published during deploy workflows. Keep secrets out of asset bundles. Prefer CI-built artifacts.

Architecture and Design Diagrams

mermaidCopy
flowchart LR
  TS[TypeScript CDK app]
  Synth[cdk synth]
  CFN[CloudFormation template]
  Boot[Bootstrap toolkit stack]
  Deploy[cdk deploy]
  Stack[App stack resources]

  TS --> Synth --> CFN
  Boot --> Deploy
  CFN --> Deploy --> Stack

Serverless API sketch:

mermaidCopy
flowchart TB
  APIGW[API Gateway]
  FN[Lambda]
  SM[Secrets Manager read]
  APIGW --> FN --> SM

Technical Explanation

App sketch (TypeScript conceptual)

typescriptCopy
#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import { ProgressApiStack } from '../lib/progress-api-stack';

const app = new cdk.App();
new ProgressApiStack(app, 'TlpLesson33ProgressApi', {
  env: {
    account: process.env.CDK_DEFAULT_ACCOUNT,
    region: process.env.CDK_DEFAULT_REGION,
  },
  tags: { Project: 'tlp-lesson33' },
});

Stack sketch

typescriptCopy
import * as cdk from 'aws-cdk-lib';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as apigw from 'aws-cdk-lib/aws-apigateway';
import { Construct } from 'constructs';

export class ProgressApiStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const fn = new lambda.Function(this, 'ProgressHandler', {
      runtime: lambda.Runtime.NODEJS_20_X, // verify current supported runtimes in docs
      handler: 'index.handler',
      code: lambda.Code.fromAsset('lambda/progress'),
      environment: {
        // NON-SECRET config only
        PROJECT: 'tlp-lesson33',
      },
    });

    // API Gateway REST or HTTP API constructs — choose per current API lesson standards
    new apigw.LambdaRestApi(this, 'ProgressApi', {
      handler: fn,
      proxy: true,
    });
  }
}

Verify construct APIs against current aws-cdk-lib docs—runtimes and construct props change.

Synth discipline

Commit or artifact the synth output in CI for review when policies require template inspection. Developers should cdk synth locally before surprising the team with L3 pattern expansions.

IAM grants

L2 grantRead style helpers reduce wild *:* policies—still review the resulting statements in the template.

Performance

Large apps synth slower; split stacks by blast radius like Terraform roots.

Security

Bootstrap roles are powerful—limit who can deploy. Encrypt logs. No secrets in context/env in source control. Use Secrets Manager references.

Practical Implementation or Design Walkthrough

Problem

Provision a disposable secure serverless progress API stub with CDK TypeScript: Lambda + API Gateway, tagged, synthesizable, destroyable.

Steps

1. Budget alert; bootstrap sandbox account/region per current docs if not already.
2. cdk init app typescript (per current CLI).
3. Implement stack; keep Lambda code secret-free.
4. Synth; skim template for IAM and resources.
5. Deploy; invoke API with a test request.
6. Negative: remove invoke permission / break handler; observe 5xx; fix.
7. Destroy stack; confirm resources gone; leave bootstrap only if intentionally shared.

Enterprise Real-World Scenarios

Surprise L3 resources

Pattern creates extra alarms/buckets; cost and compliance surprise. Fix: read synth; prefer L2 until patterns are understood.

Terraform + CDK same VPC

Dual writers. Fix: ADR ownership.

Bootstrap in every developer account unchecked

Sprawl. Fix: platform-managed bootstrap; document.

Secrets in cdk.json context

Leaked. Fix: Secrets Manager; scrub.

No destroy of feature stacks

Bill shock. Fix: expiry tags and janitor jobs.

Best Practices

1. Synth before deploy; read templates.
2. Pin CDK and lib versions.
3. Tag stacks and resources.
4. Split stacks by blast radius.
5. Prefer L2 with understanding; L3 with review.
6. Bootstrap intentionally.
7. CI deploy with OIDC roles.
8. Unit-test templates for critical invariants.
9. Destroy ephemeral stacks.
10. Do not dual-manage with Terraform.
11. TypeScript (or org standard) consistently.
12. Budget alerts.
13. Least-privilege grants.
14. Document escape hatches (custom resources) carefully.
15. Feed synth into policy-as-code (lesson 35).

Common Mistakes and Anti-Patterns

1. Ignoring synthesized template.
2. Secrets in context/code.
3. One mega-stack for all envs without isolation.
4. Unpinned CDK upgrades mid-incident.
5. Using custom resources for everything.
6. Leaving feature stacks forever.
7. AdminDeploy roles forever.
8. Mixing Terraform on same resources.
9. Skipping bootstrap understanding.
10. Copy-pasting patterns without IAM review.

Troubleshooting and Design Review

Interview Questions and Answers

Q1: What is CDK? A: AWS IaC framework using programming languages that synthesizes to CloudFormation.
Q2: Synth? A: Generate CFN templates/assets from constructs.
Q3: Bootstrap? A: Prepare environment toolkit resources for CDK deployments.
Q4: L1 vs L2? A: Raw CFN mapping vs curated constructs.
Q5: State model? A: CloudFormation stacks.
Q6: vs Terraform? A: Language/state/ecosystem trade-offs; ADR choice.
Q7: Why read synth? A: See real IAM and resources.
Q8: Languages? A: TS/Python/Java/etc.; course prefers TS.
Q9: Testing? A: Assert on synthesized templates.
Q10: Assets? A: Packaged Lambda/Docker artifacts published on deploy.
Q11: Dual manage risk? A: Drift and ownership fights.
Q12: Security focus? A: Bootstrap/deploy roles, secrets, grants.
Q13: Stack split? A: Blast radius and ownership.
Q14: CI? A: Synth/diff/deploy with OIDC.
Q15: Policy later? A: Guard/OPA on templates in CI.

Hands-On Exercises

Exercise: CDK app for secure serverless API

Build, synth, deploy, invoke, destroy; evidence templates and tags; no secrets.

Challenge ADR

Choose CDK vs Terraform for the progress API stack given a team strong in TypeScript but platform team strong in Terraform networking. Propose CDK for app stack consuming Terraform network outputs via parameters/SSM—not dual VPC writers.

Lab evidence checklist

Synth snippet, stack ARN, invoke proof, destroy proof, bootstrap note, ADR.

Narrative: the pattern that created public buckets

L3 example enabled public access unintentionally. Synth review would have caught it. Culture: no deploy without template skim for data resources.

Continuity

Deployment strategies next—how to shift traffic once CDK/TF provisioned blue/green machinery.

Why TypeScript is the course default

TechLearningPro’s web and API engineers already read TypeScript. CDK in TypeScript shortens the distance between application PRs and infrastructure PRs, enabling shared interfaces and linting. Python CDK is excellent; the course simply standardizes examples on TypeScript to avoid dual dialects in one module. If your company standardizes on Python, translate constructs—do not treat language as religion.

Reading the synthesized template like an adult

After cdk synth, search the template for AWS::IAM::Policy, AWS::S3::Bucket, and SecurityGroup. Confirm there is no unintended public access block disabled, no Action: * on Resource: * unless you can justify it, and no surprise resources from a pattern construct. If you cannot explain a resource, you do not own the stack yet.

Commit synth diffs for sensitive stacks when policy requires, or store them as CI artifacts. Debugging production IAM from only construct code is slower than reading the template CloudFormation actually applied.

Bootstrap as a platform service

Developers should not casually bootstrap production accounts with admin credentials from laptops. Platform teams bootstrap once per account/region, constrain the deployer roles, and document how CI assumes them via OIDC. Lab sandboxes can bootstrap freely—and must understand what the toolkit stack contains so destroy decisions are intentional.

If bootstrap is outdated relative to CDK version expectations, deploys fail in confusing ways—read the current bootstrap version notes in AWS docs when upgrading major CDK versions.

Stack boundaries for TechLearningPro

Suggested split: NetworkStack (if CDK owns network—often Terraform does instead), DataStack (tables/buckets), ApiStack (API Gateway + Lambda). Cross-stack references exist but create coupling; prefer SSM parameters or well-documented exports. Do not create cyclic references across stacks.

Testing constructs

Use CDK assertions to ensure “bucket has public access blocked” and “function has environment encryption settings you expect.” These tests run without deploying and pair with lesson 35 policy tools. Start with five invariants that match real incidents.

Escape hatches and custom resources

Custom resources run Lambda during deployments to fill gaps. They are powerful and operationally expensive: failures leave stacks in ROLLBACK_FAILED drama. Prefer L2 constructs and native resources. If you need a custom resource, add alarms, idempotency, and ownership docs.

CDK vs SAM vs raw CloudFormation

SAM specializes in serverless apps; CDK is general purpose; raw CFN is universal baseline. TechLearningPro may use SAM in some teams—ADR it. Do not run SAM and CDK transformers on the same app without clarity.

Feature environment hygiene

Named stacks per branch (ProgressApi-pr-123) need janitor Lambda or TTL tags. Forgotten stacks are the CDK equivalent of forgotten NATs.

Permissions during deploy vs runtime

Deploy roles need CloudFormation and IAM passrole capabilities carefully scoped. Runtime roles are what Lambda uses. Confusing them creates either over-broad runtime or broken deploys. Review both in synth.

Hotswap awareness

CDK hotswap can speed certain serverless iterations in sandbox—understand limitations and never treat hotswap as the production change process. Production should go through normal CloudFormation changes with review.

Integrating with Terraform-owned VPC

Pass subnet IDs and security group IDs into CDK via parameters/context from remote state outputs or SSM. CDK should look up with fromSubnetId style APIs rather than creating a second VPC. That is the peaceful multi-tool boundary.

Lab narrative: secure serverless progress stub

Deploy API that returns { ok: true, project: "tlp-lesson33" }, rejects embedding secrets, uses least privilege, tags stack, synth reviewed, destroyed. Optional WAF is out of scope until edge security lessons—do not bolt random services for résumé spice.

Extended practice scenario 1 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 2 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 3 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 4 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 5 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 6 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 7 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 8 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 9 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 10 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 11 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 12 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 13 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 14 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 15 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 16 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 17 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 18 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 19 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 20 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 21 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 22 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 23 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 24 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Extended practice scenario 25 — 33 aws cdk and infrastructure with programming languages

In a timed drill, implement or design the core lab for 33 aws cdk and infrastructure with programming languages with a partner observing. The observer’s job is to stop any step that invents API flags, hardcodes secrets, or skips budget and cleanup. After the drill, rewrite your ADR in ten lines: context, decision, consequences. Attach evidence: commands run, screenshots of tagged resources, policy or plan output, and destroy confirmation.

Discuss how this lesson’s tooling interacts with IAM least privilege, VPC private placement, and CI promotion rules from earlier modules. List two failure modes you personally witnessed or simulated, including detection and fix. Estimate cost drivers you touched and how long resources remained before teardown.

Finally, teach back the lesson overview paragraph from memory, then check against the text. Gaps in the teach-back become your flashcards. Premium courses are not finished when the Markdown ends—they are finished when you can operate the ideas under time pressure without opening the console as a first resort.

Lesson Summary

CDK brings TypeScript (and friends) to AWS IaC by synthesizing constructs into CloudFormation. Bootstrap prepares environments; synth reveals truth; stacks should be tagged, least-privileged, and destroyed in labs. Do not dual-write with Terraform on the same resources; use ADRs for boundaries.

Next: Deployment Strategies: Blue-Green, Canary and Rolling.

Further Reading

• AWS CDK Developer Guide
• CDK API Reference
• Bootstrapping
• Constructs
• CloudFormation User Guide
• API Gateway Developer Guide