The front end now loads from edge locations in milliseconds. But an RSVP is not a static file: it has to be checked, stored, and counted. On the old server that was a route in the Node.js app, running all day for the few minutes a week anyone RSVPed. Now it becomes three managed pieces that cost nothing while idle and scale up when an event goes viral.
\nTwo routes are enough for launch:
\n| Route | \nDoes | \n
|---|---|
POST /events/{eventId}/rsvps | \nStores one RSVP, refuses duplicates | \n
GET /events/{eventId}/rsvps | \nReturns the RSVP count for the event | \n
API Gateway’s HTTP API passes Lambda a JSON event (payload format 2.0) with the path parameters, the method and the body as a string. The function returns a status code, headers and a string body:
\nimport { DynamoDBClient } from \"@aws-sdk/client-dynamodb\";\nimport { DynamoDBDocumentClient, PutCommand, QueryCommand } from \"@aws-sdk/lib-dynamodb\";\n\n// Created once per execution environment and reused across invocations.\n// removeUndefinedValues: an RSVP without a \"name\" is stored without that attribute.\nconst db = DynamoDBDocumentClient.from(new DynamoDBClient({}), {\n marshallOptions: { removeUndefinedValues: true },\n});\nconst TABLE = process.env.TABLE_NAME;\n\nconst reply = (statusCode, data) => ({\n statusCode,\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify(data),\n});\n\nexport const handler = async (event) => {\n const eventId = event.pathParameters?.eventId;\n\n if (event.requestContext.http.method === \"GET\") {\n const res = await db.send(new QueryCommand({\n TableName: TABLE,\n KeyConditionExpression: \"eventId = :e\",\n ExpressionAttributeValues: { \":e\": eventId },\n Select: \"COUNT\",\n }));\n return reply(200, { eventId, count: res.Count });\n }\n\n const { email, name } = JSON.parse(event.body ?? \"{}\");\n if (typeof email !== \"string\" || !email.includes(\"@\")) {\n return reply(400, { error: \"A valid email is required\" });\n }\n\n try {\n await db.send(new PutCommand({\n TableName: TABLE,\n Item: { eventId, email: email.toLowerCase(), name, createdAt: new Date().toISOString() },\n ConditionExpression: \"attribute_not_exists(email)\",\n }));\n } catch (err) {\n if (err.name === \"ConditionalCheckFailedException\") {\n return reply(409, { error: \"You have already RSVPed to this event\" });\n }\n throw err;\n }\n return reply(201, { eventId, email });\n};Notice what is not there: no credentials, no table ARN, no connection pool. The SDK finds the execution role’s credentials, and the table name comes from an environment variable so the same code runs against dev and production tables. The Node.js runtime includes the AWS SDK for JavaScript v3, but bundle the version you tested with your code so a runtime update can’t change it under you.
\nOne honest limit: a single Query reads at most 1 MB, so for an event with an enormous number of RSVPs the count would need pagination, or a separate counter item updated on each write. For Lantern’s events, one call is plenty.
\n\nThe function’s execution role gets exactly what the code calls, on exactly one table, plus the AWS managed AWSLambdaBasicExecutionRole policy so it can write logs:
{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"RsvpTable\",\n \"Effect\": \"Allow\",\n \"Action\": [\"dynamodb:PutItem\", \"dynamodb:Query\"],\n \"Resource\": \"arn:aws:dynamodb:eu-west-1:111122223333:table/lantern-rsvps\"\n }\n ]\n}The other direction is the function’s resource-based policy: API Gateway may invoke it. The console adds this when you connect a route; from the CLI it looks like this, scoped to one API by its ARN:
\naws lambda add-permission --function-name lantern-rsvp \\\n --statement-id allow-lantern-http-api \\\n --action lambda:InvokeFunction \\\n --principal apigateway.amazonaws.com \\\n --source-arn \"arn:aws:execute-api:eu-west-1:111122223333:a1b2c3d4e5/*\"In the API Gateway console, create an HTTP API, add the two routes with a Lambda integration to lantern-rsvp, and use the auto-deployed $default stage. HTTP APIs are the cheaper, simpler type. Choose a REST API instead when you need API keys with usage plans, per-client throttling, request validation, response caching or AWS WAF.
Because the site is served from https://lantern.example and the API lives on another domain, configure CORS on the HTTP API to allow that origin, or add the API as a second origin in the CloudFront distribution under /api/* so the browser sees one domain. Then test:
curl -i -X POST \\\n \"https://a1b2c3d4e5.execute-api.eu-west-1.amazonaws.com/events/evt-2026-street-food/rsvps\" \\\n -H \"content-type: application/json\" \\\n -d '{\"email\":\"rita@example.com\",\"name\":\"Rita\"}'The first call returns 201; send it again and you get 409.
Each piece bills per use: API Gateway per request, Lambda per request and GB-second, DynamoDB on-demand per read and write. A quiet week costs close to nothing, and the festival evening costs a few thousand requests’ worth. To make sure a bot can’t run up the bill or overload anything downstream, set reserved concurrency on the function (a ceiling on simultaneous copies) and a throttling limit on the API’s stage.
\nNext you will watch this API in production: logs, metrics and alarms, and a structured review of the whole design.
\n","toc":[{"id":"sec-1","text":"The shape of it","level":2},{"id":"sec-2","text":"The function","level":2},{"id":"sec-3","text":"The permissions","level":2},{"id":"sec-4","text":"The API","level":2},{"id":"sec-5","text":"What it costs, and how to cap it","level":2}],"takeaways":["An HTTP API in API Gateway receives the request, invokes Lambda with a JSON event, and returns whatever status code and body the function returns.","The Lambda function needs two kinds of permission; its execution role lets it call DynamoDB, and its resource-based policy lets API Gateway invoke it.","A conditional write such as attribute_not_exists stops double-clicks and retries from creating duplicate items.","Choose HTTP APIs for simple, low-cost APIs, and REST APIs when you need API keys, per-client throttling, request validation, caching or AWS WAF.","Every piece bills per request, so an idle API costs close to nothing, and reserved concurrency caps how far a spike can scale."],"further":[{"title":"Choose between REST APIs and HTTP APIs","url":"https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-vs-rest.html"},{"title":"Create AWS Lambda proxy integrations for HTTP APIs","url":"https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-lambda.html"},{"title":"Condition expressions in DynamoDB","url":"https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Expressions.ConditionExpressions.html"},{"title":"Tutorial: Create a CRUD HTTP API with Lambda and DynamoDB","url":"https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-dynamo-db.html"}],"quiz":[{"q":"The function works when tested in the Lambda console, but calls through API Gateway fail because API Gateway is not allowed to invoke it. What is missing?
","options":[{"text":"A statement in the function’s execution role allowingapigateway:*.","why":"The execution role controls what the function may call, not who may call the function."},{"text":"A DynamoDB table policy that names API Gateway.","why":"API Gateway never talks to DynamoDB in this design; it only invokes the function."},{"text":"An IAM user for API Gateway with an access key.","why":"AWS services act through service principals and roles, never through IAM users with keys."},{"text":"A statement in the function’s resource-based policy allowing apigateway.amazonaws.com to call lambda:InvokeFunction for this API.","why":"Correct. Who may invoke a function is set in its resource-based policy, scoped with a source ARN to this API."}],"answer":3},{"q":"An organiser double-clicks Submit and two identical RSVP requests arrive within milliseconds. How does the lesson’s function avoid storing two RSVPs?
","options":[{"text":"ThePutItem uses ConditionExpression attribute_not_exists(email), so the second write fails with ConditionalCheckFailedException and returns 409.","why":"Correct. DynamoDB checks the condition atomically on the item, so exactly one of the two writes succeeds."},{"text":"API Gateway removes duplicate requests automatically.","why":"API Gateway forwards every request it receives. Deduplication is the application’s job."},{"text":"Lambda runs only one copy of the function at a time.","why":"Lambda runs as many copies as there are concurrent requests, so both requests can run at once."}],"answer":0},{"q":"Lantern needs API keys so that two partner websites can submit RSVPs, each with its own usage limit. Which API Gateway type fits?
","options":[{"text":"An HTTP API, because it is cheaper.","why":"HTTP APIs are cheaper because they leave features out, and API keys with usage plans are one of them."},{"text":"A WebSocket API, because partners need a live connection.","why":"WebSocket APIs are for two-way, long-lived connections, and partners submitting forms do not need that."},{"text":"A REST API, which supports API keys with usage plans and per-client throttling.","why":"Correct. When you need those API management features, the REST API type is the one that has them."}],"answer":2}],"exercise":{"kind":"spot-bug","language":"js","code":"import { DynamoDBClient } from \"@aws-sdk/client-dynamodb\";\nimport { DynamoDBDocumentClient, PutCommand, ScanCommand } from \"@aws-sdk/lib-dynamodb\";\n\nconst db = DynamoDBDocumentClient.from(new DynamoDBClient({\n credentials: { accessKeyId: \"AKIAIOSFODNN7EXAMPLE\", secretAccessKey: process.env.SECRET },\n}));\nconst TABLE = process.env.TABLE_NAME;\n\nconst reply = (statusCode, data) => ({\n statusCode,\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify(data),\n});\n\nexport const handler = async (event) => {\n const eventId = event.pathParameters?.eventId;\n\n if (event.requestContext.http.method === \"GET\") {\n const res = await db.send(new ScanCommand({\n TableName: TABLE,\n FilterExpression: \"eventId = :e\",\n ExpressionAttributeValues: { \":e\": eventId },\n }));\n return reply(200, { eventId, count: res.Items.length });\n }\n\n const { email, name } = JSON.parse(event.body ?? \"{}\");\n if (typeof email !== \"string\" || !email.includes(\"@\")) {\n return reply(400, { error: \"A valid email is required\" });\n }\n\n try {\n await db.send(new PutCommand({\n TableName: TABLE,\n Item: { eventId, email: email.toLowerCase(), name },\n ConditionExpression: \"attribute_exists(email)\",\n }));\n } catch (err) {\n if (err.name === \"ConditionalCheckFailedException\") {\n return reply(409, { error: \"You have already RSVPed to this event\" });\n }\n throw err;\n }\n return reply(201, { eventId, email });\n};","bugLines":[5,19,36],"title":"Review the RSVP function","prompt":"This version of lantern-rsvp was opened as a pull request. It looks almost identical to the lesson’s function, but three lines would cause a security incident, a growing bill, or broken RSVPs in production. Select them.
Line 5 hard-codes an access key into the client. The function already has an execution role, and the SDK uses it automatically when you pass no credentials, so delete the credentials option entirely; never put keys in code or environment variables. Line 19 counts RSVPs with a Scan and a filter, which reads and bills every item in the table on every page view; use QueryCommand with KeyConditionExpression: "eventId = :e" and Select: "COUNT". (A Scan also stops after 1 MB, so on a big table this count would be wrong as well as expensive.) Line 36 inverts the duplicate guard: attribute_exists(email) lets a write succeed only when the RSVP already exists, so every new RSVP fails with 409. It must be attribute_not_exists(email).