Every project in this course is deployed on AWS, taught in three tracks. Track A deploys your ingestion pipeline on AWS Batch; Track B deploys your Module 01 FastAPI app as the vs-NLQ back end; Track C is the agent platform. By the end you can create least-privilege IAM roles, run heavy jobs on EC2 Spot, deploy an S3-triggered pipeline that alerts through SNS, run a containerised app on Fargate behind an ALB and API Gateway, deploy an agent on AgentCore Runtime whose tools sit behind AgentCore Gateway — and tear it all down with nothing left billing.
IAMA least-privilege role for every component.
AWS BudgetsA cost alarm set before anything is deployed.
Amazon S3Raw PDFs, parsed documents, caches; an upload starts ingestion.
Secrets ManagerPinecone, Neo4j and API credentials.
CloudWatchLogs, metrics, dashboards and alarms.
Amazon SNSOne alert topic — failures and budget alarms arrive by email.
AWS LambdaPipeline triggers, error handling and agent tools.
DynamoDB + StreamsAn audit row per document per stage; the stream starts the next stage.
Amazon VPCSubnets, security groups, NAT gateway, Transit Gateway.
Amazon ECRContainer images for batch workers and agents.
AWS Batch on EC2 SpotHeavy parsing too long for Lambda; job queues per size lane; scales to zero.
ECS on FargateRuns the FastAPI + React application.
Application Load BalancerSpreads traffic across tasks, with health checks.
API GatewayA public API with throttling and auth.
RDS PostgreSQLvs-NLQ data, agent checkpoints, MLflow backend.
Amazon BedrockModels for the deployed agents, and what a call costs.
AgentCore RuntimeHosts agents as ARM64 containers from ECR.
AgentCore GatewayTools over MCP, reachable only with IAM-signed calls.
Checkpoint — P1 milestone: one PDF uploaded to S3 runs as a Batch job, reaches Pinecone and Neo4j, the DynamoDB audit shows every stage, a broken PDF triggers the SNS email, and your account is clean after teardown.