From Boto3 to Bedrock: The AWS Services I Actually Used

A working tour of the AWS services I reached for building and running real apps - EC2, S3, IAM, RDS, Secrets Manager, EKS, Bedrock, CloudFront - and the gotcha for each.
Author

Benedict Thekkel

Published

October 20, 2025

AWS has ~200 services. You use maybe a dozen. This is the dozen I actually reached for, in the order I met them, from the WEB_doc repo’s Cloud/AWS series - each with the one gotcha that cost me time.

The services, and the gotcha for each

Service What I used it for Gotcha Notebook
Boto3 The Python entry point to everything Config/creds resolution order bites Boto3
IAM Roles, policies, least privilege Deny always wins; scope tightly IAM
EC2 Compute, the old reliable Right-size + stop; on-demand adds up EC2
S3 Object storage / static assets Block public access by default S3
SES / SNS Email + notifications Sandbox limits until you verify SES / SNS
RDS Managed Postgres Backups + param groups matter RDS
Secrets Manager No secrets in code Rotation + per-call cost Secrets
EKS Kubernetes when you need it Heavy; only past a real scale EKS
Bedrock Managed LLMs, no infra Model access is region-gated Bedrock
CloudFront CDN in front of S3/app Cache invalidation is the hard part CloudFront
VPC / ECS Networking + containers Subnets/SGs before anything runs VPC / ECS

How they wire together

A representative small-app architecture using most of the above:

flowchart TB
  U[Users] --> CF[CloudFront]
  CF --> S3[(S3 static)]
  CF --> ECS[ECS / app]
  ECS --> RDS[(RDS Postgres)]
  ECS --> SM[Secrets Manager]
  ECS --> BR[Bedrock LLM]
  ECS --> SES[SES email]
  IAM[IAM roles] -.governs.- ECS
  IAM -.governs.- S3

Adoption timeline

Roughly the order I picked each up - foundational storage/compute first, managed data and LLMs later.

Rough monthly cost share

For a small production app, where the money tends to go. RDS and compute dominate; Bedrock scales with usage, not idle.

Takeaway

Start with IAM + Boto3 discipline, lean on managed services (RDS, Secrets, Bedrock) to avoid running infra you don’t have to, and add EKS only when scale forces it. The whole tour, service by service, is in Cloud/AWS.

Back to top