Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)
Apps delete old sessions and logs at night. EventBridge schedule runs your Lambda on a cron; Lambda scans DynamoDB and deletes or archives old rows.
What you'll learn in this chapter
- EventBridge rule schedule
- Cleanup Lambda modes delete/flag
- Seed data and verify
- Disable rule and cleanup
1. Everyday example
Why do we need this?
Leaving lab rows forever costs nothing huge on-demand — but production tables grow. A nightly job keeps them healthy.
What is it?
rate(1 hour) or cron for the lab → Lambda Scan → delete or set status=archived when createdAt older than MAX_AGE_SECONDS.
Download: scheduled-cleanup.zip — handler.py + seed.py
2. Lab
How to do it (step by step)
A. Table + seed
- Table
yourname-cleanup, PKitemId. - Run seed logic (temporary test event or paste seed.py once) so some rows are older than 1 day.
B. Lambda + rule
- Function handler.py. Env TABLE_NAME, MAX_AGE_SECONDS=86400, MODE=delete.
- EventBridge → Rules → Schedule → rate(5 minutes) for the lab (not only nightly). Target = Lambda.
- Wait for an invoke. Check CloudWatch logs and table row count.
Ravindra Bagale's Tip
After the lab, disable or delete the rule immediately so it does not keep running.
Cleanup
- Disable/delete EventBridge rule. Delete Lambda, table, role.
3. Interview
Q. Why EventBridge not a forever while-loop on EC2?
Serverless schedule; no idle server cost.
Q. Scan caution?
Fine for tiny lab tables; production uses TTL or sparse GSIs.
Q. delete vs flag?
Flag keeps audit; delete frees storage.
Q. Idempotency?
Running twice should be safe — already deleted rows simply vanish.
Q. Cleanup?
Rule first, then Lambda/table.
Try at home
- Switch MODE=flag and confirm status archived.
- Add DynamoDB TTL as a second line of defence.
In short
- EventBridge → Lambda → cleanup DynamoDB.
- Disable schedules after labs.
- Prefer TTL for pure expiry.
- Clean up.
Practice Tasks
Maple Leaf Books is a bookselling business in Toronto. Emily Tremblay looks after its IT and cloud work. They count money in CAD and run their AWS resources in the ca-central-1 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 12
Easy List functions
Why: See which functions exist in this Region.
What to do: List the Lambda functions in ca-central-1.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Invoke a function
Why: Invoke runs the function now and saves its answer in a file.
What to do: Invoke mapleleafbooks-orders-fn and save the response to out.json.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Trust policy for a Lambda role
Why: The trust policy says WHO may take the role.
What to do: Write a trust policy that lets lambda.amazonaws.com assume the role.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Put an item
Why: DynamoDB JSON shows the type of each value: S for string, N for number.
What to do: Put an item into mapleleafbooks-orders with orderId "o-101" (string) and amount 2500 (number).
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Change timeout and memory
Why: More memory also gives more CPU; timeout stops runaway runs.
What to do: Set mapleleafbooks-orders-fn to timeout 30 seconds and memory 512 MB.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Let a function write logs
Why: Without these actions, Lambda logs never appear in CloudWatch.
What to do: Allow logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents on arn:aws:logs:*:*:* only.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Create a Lambda function
Why: Lambda needs the code zip, a runtime, a handler name and an execution role.
What to do: Create function mapleleafbooks-orders-fn: runtime python3.12, handler app.handler, role arn:aws:iam::102932412000:role/lambda-basic, code in function.zip.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Set environment variables
Why: Keep settings like table names out of the code.
What to do: Set the environment variable TABLE=mapleleafbooks-orders on mapleleafbooks-orders-fn.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Invoke with a JSON payload
Why: In CLI v2, raw JSON needs --cli-binary-format raw-in-base64-out.
What to do: Invoke mapleleafbooks-orders-fn with payload {"orderId":"o-101"} (raw JSON) and save the reply in out.json.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Lambda GB-seconds
Why: Lambda bills memory × time.
What to do: 1,000,000 invocations, 512 MB memory, 200 ms each. How many GB-seconds?
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Hard Connect an SQS queue to Lambda
Why: An event source mapping makes Lambda poll the queue and process messages in batches.
What to do: Create an event source mapping from queue arn:aws:sqs:ca-central-1:102932412000:mapleleafbooks-orders to mapleleafbooks-orders-fn with batch size 10.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Let S3 call your function
Why: A resource-based permission is needed before S3 can invoke the function.
What to do: Add permission statement s3invoke to mapleleafbooks-orders-fn so s3.amazonaws.com can call lambda:InvokeFunction from bucket arn:aws:s3:::mapleleafbooks-uploads.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Revision, comparison and interview cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.