Serverless services: choosing the right one

The services at a glance

The Serverless category of the exam covers two compute services. Both remove server management; they differ in what you deploy and how long it runs. Each service name links to its own tutorial.

Service	You deploy	Best for
AWS Lambda	Functions triggered by events	Short, Event-driven architectureA design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.Glossary entry code (up to 15 minutes), scaling to zero, pay per request and duration
AWS Fargate	Containers, as ECS tasks or EKS pods	Long-running services, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry, and jobs packaged as containers, without managing EC2

Choosing between them

Event-driven and short? Use Lambda. It is triggered directly by S3, SQS, Kinesis, DynamoDB Streams, EventBridge, API Gateway, and many other services, and you pay nothing when idle.
Long-running, or already in containers? Use Fargate, with ECS or EKS. There is no 15-minute limit, and you get full control of the container image.
Needs GPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entry, privileged containers, or host access? Neither: use ECS or EKS on EC2 capacity, or EC2 directly.

The rest of a serverless architecture

Serverless compute usually works with other managed services that also scale on demand:

Need	Service
HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry APIs in front of functions	Amazon API Gateway
Storage for objects and static sites	Amazon S3
NoSQLDatabases that store data in models other than relational tables, such as key-value, document, wide-column, or graph, usually to scale out easily or to handle data whose shape varies. Amazon DynamoDB is a NoSQL database.Glossary entry database	Amazon DynamoDB
Relational database that scales automatically	Aurora Serverless
Queues to decouple and buffer work	Amazon SQS
Fan-outSending one message or event to many receivers at once so that each can process it in parallel, such as an Amazon SNS topic delivering to several SQS queues.Glossary entry notifications	Amazon SNS
Event routing and schedules	Amazon EventBridge
Orchestrate multi-step workflows	AWS Step Functions
User sign-in	Amazon Cognito

Putting an HTTP endpoint in front of functions

A Lambda function URL is a free, dedicated HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry endpoint for one function, with auth type AWS_IAM or NONE. It has no API keys, quotas, or caching.
An API Gateway REST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entry API adds usage plans with API keys to give each client its own ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry limit and request quota, plus stage caching (default TTL (Time to live)How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.Glossary entry 300 seconds, up to 3,600) and Cognito or Lambda authorizers. API keys identify clients; don't use them alone to authorize access.
Code at CloudFront Edge locationAn AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.Glossary entry: CloudFront Functions run lightweight JavaScript on viewer request and viewer response events, in under a millisecond and at millions of requests per second, at a lower cost: URL rewrites, redirects, header changes, cache key normalization. Lambda@Edge (Node.js or Python) is needed for network calls, the request body, file system access, or origin request and origin response events.

A serverless web API. Users sign in with Amazon Cognito, then call API Gateway over HTTPS with their token. API Gateway checks the token with a Cognito authorizer and invokes a Lambda function, which reads and writes a DynamoDB table.

Reverse mindmap: from the question to the service

Serverless: which compute?

Lambda
- Run code when a file lands in S3 leads to Lambda
- Process each SQS message or stream record leads to Lambda event source mapping
- API backend with spiky traffic, pay per request leads to API Gateway with Lambda
- Scheduled task under 15 minutes leads to EventBridge Scheduler with Lambda
Fargate
- Containers without managing servers leads to Fargate with ECS or EKS
- Job runs longer than 15 minutes leads to Fargate task
- Existing containerized web service leads to ECS service on Fargate
- Interruptible container batch work, low cost leads to Fargate Spot
In front of functions
- Per-client API keys, quotas, and caching leads to API Gateway REST API with usage plans
- Simplest HTTPS endpoint for one function leads to Lambda function URL
- Rewrite URLs or add headers at the edge, huge scale leads to CloudFront Functions
- Edge logic with network calls or the request body leads to Lambda@Edge
Neither
- GPUs or privileged containers leads to EC2 or ECS/EKS on EC2
- Many steps with retries and waits leads to Step Functions orchestrating Lambda or Fargate

Commonly confused pairs

If the choice is between	Choose the first when	Choose the second when
Lambda or Fargate	Short, event-driven functions, scale to zero	Long-running or containerized workloads
Fargate or EC2 capacity	No servers to manage	GPUs, privileged containers, DaemonSets, or control of the instances
Lambda or Step Functions	One unit of code per event	Coordinating many steps, branches, retries, and waits
API Gateway REST API or Lambda function URL	API keys, usage plans, per-client throttling, caching, or richer auth	One simple HTTPS endpoint with IAM or no auth
CloudFront Functions or Lambda@Edge	Lightweight viewer request or response logic at the lowest cost and LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry	Network calls, request body access, or origin events
Provisioned concurrency or SnapStart	Environments must be initialized and ready before requests arrive, on any runtime	Java, Python, or .NET functions need faster startup from a snapshot

Key takeaways

Lambda runs event-driven functions for up to 15 minutes, billed per request and GB-second.
Fargate runs containers for ECS and EKS without EC2 management, with no 15-minute limit.
Serverless architectures combine them with API Gateway, S3, DynamoDB, SQS, SNS, EventBridge, Step Functions, and Cognito.
GPUs or host control point away from both, to EC2.
Per-client API keys, quotas, and caching need an API Gateway REST API, not a function URL; lightweight edge header and URL logic fits CloudFront Functions, not Lambda@Edge.