Template: path chapter

In 1 minute

Write three to five short sentences. Say what this piece is and what job it does in MiniTickets, using its real AWS name. Say why we would be in trouble without it.

Picture it

One small diagram (about 8 boxes at most) that a reader could redraw from memory. Use the real MiniTickets names. The “where it sits” diagram is generated from the book’s data, so it can never disagree with the map:

flowchart LR
  alb["Application Load Balancer"]
  public_subnets["Public subnets"]
  browser["Browser"]
  https_listener["HTTPS listener"]
  cloudfront["CloudFront distribution"]
  cloudfront_listener["HTTP listener with the origin header"]
  alb_sg["ALB security group"]
  alb -->|lives in| public_subnets
  browser -->|TCP 443| alb
  alb -->|TCP 443| https_listener
  cloudfront -->|TCP 80| alb
  alb -->|TCP 80| cloudfront_listener
  alb -->|uses| alb_sg
  more["+1 more: see the table"]
  alb -.- more
  classDef focus stroke-width:3px
  class alb focus
  classDef off stroke-dasharray:5 5
  class alb,cloudfront,cloudfront_listener off

Where Application Load Balancer (ALB) sits: 7 connections, generated from the book's data. A dashed border means the piece is switched off in the committed config (infra/Pulumi.dev.yaml). On small screens, scroll the diagram sideways to read its labels.

Optional, only if it really helps a first-time reader: ONE line that starts with “Think of it like…”, next to the real term, never instead of it.

See this piece on the map →

How it works

1. What happens first, in one or two plain sentences.
2. What happens next. Explain any new word the first time you use it.
3. What happens last, and what the reader gets back.

In MiniTickets

Our real names, ports, values and files. Every fact here is checked against the code, and code is linked like this: apps/api/src/app.ts → buildApp.

Who talks to this piece, and the exact rule that allows each connection, comes from the data:

From → to	What happens	What allows it
Application Load Balancer → Public subnetsonly when entryEnabled = true	one ALB node in each public subnet	config internal: false, subnets = both public subnetscreateAlb
Browser → Application Load Balanceronly when cdnEnabled = false	HTTPS on port 443; plain HTTP on port 80 only gets a redirect	route public route table: 0.0.0.0/0 → minitickets-dev-igw. The task has a public IP; there is no NAT gateway and no VPC endpoint.createNetwork sg-rule alb-sg inbound rule minitickets-dev-alb-in-443-0: TCP 443 from allowedCidrs (default 0.0.0.0/0)createAlbPublicIngress sg-rule alb-sg inbound rule minitickets-dev-alb-in-80-0: TCP 80 from allowedCidrs, for the 301 redirect onlycreateAlbPublicIngress certificate the :443 listener presents the ACM certificate for minitickets.theversehub.increateHttpsListener
Application Load Balancer → HTTPS listeneronly when cdnEnabled = false	the ALB hands each request to the listener for its port	listener-rule listener :443 HTTPS, TLS policy ELBSecurityPolicy-TLS13-1-2-2021-06; listener :80 HTTP answers 301 → https://createHttpsListener
CloudFront distribution → Application Load Balanceronly when cdnEnabled = true	fetches from the origin over plain HTTP on port 80, adding the X-Origin-Verify header	sg-rule alb-sg inbound rule minitickets-dev-alb-in-80: TCP 80 from the AWS managed prefix list com.amazonaws.global.cloudfront.origin-facingcreateSecurityGroups secret origin customHeaders: X-Origin-Verify = the origin secretcreateCdn
Application Load Balancer → HTTP listener with the origin headeronly when cdnEnabled = true	the ALB hands each request to its :80 listener	listener-rule listener :80 HTTP, default action: fixed response 403 ForbiddencreateListener
Application Load Balancer → ALB security grouponly when entryEnabled = true	the ALB's network interfaces use the ALB security group	config securityGroups: [albSgId]createAlb
Application Load Balancer → CloudWatch alarmsonly when entryEnabled = true	target 5xx + ALB 5xx ≥ 5 in 5 minutes → alb-5xx	metric AWS/ApplicationELB FILL(HTTPCode_Target_5XX_Count, 0) + FILL(HTTPCode_ELB_5XX_Count, 0), period 300 salarmSpecs

See it in AWS

Console

The click path, for example: ECS → Clusters → the cluster → Services → the service. Name the field to look at.

CLI

One read-only command (describe, get or list only). book:check rejects commands that change anything.

Code

The file and function that create this piece, as a code link.

Break it

Symptom	Cause	Where to look
What the user or the logs show	What is really wrong	Console page, log group or command
A second symptom	Its cause	Where to look

Say it in an interview

Say it like this (20-30 seconds)

Write 50 to 75 words: about 20 to 30 seconds out loud. Start with what it is, then how MiniTickets uses it, then one trade-off.

Follow-ups

A follow-up question an interviewer would ask next

A short answer. Mention a failure or a trade-off where you can.

A question about what breaks

What fails, what the user sees, and how we would notice.

A question about a different choice

Why we did not pick the other option, and when we would.

Advanced: IAM, config, CLI and code

Extra detail for the curious: IAM policies, configuration values, more CLI, code references. Nothing here is needed to follow the next chapter.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. A question about what this piece is.
2. A question about why MiniTickets needs it.
3. A question about how it works, step by step.
4. A question about what breaks, and where you would look.
5. A question that links this chapter to an earlier one.

Redraw it from memory: the diagram from 'Picture it'

Try this: one small task, on the map or in the local stack

Mark this page as read

The “Next” link at the bottom of the page goes to the next chapter of the path.