X or Y?
Rarely one better than the other. Each choice says when I'd pick one, when the other, and when I'd run both, with the questions that change the answer.
- 01 Lambda, Web Functions or Workers? Where should this piece of logic run? Classic Lambda, Lambda Web Functions, Workers, or both. Classic Lambda for events and heavy compute. Lambda Web Functions for HTTP business logic, once in your region. Workers at the edge, for waiting, spikes and real-time.
- 02 Lambda, Fargate or EC2? My Lambda is busy all day, or its reserved concurrency keeps going up. When is it time to move to a container, and where is the line? Lambda, Fargate, EC2, or both. High reserved concurrency isn't the red flag: it's free. Concurrency that stays high all day is. An API that waits on Postgres costs several times more on Lambda than in a container once it's busy around the clock; spiky traffic, events and CPU-heavy work stay on Lambda. Usually both: a container for the steady core, Lambda for the rest.
- 03 SQS, EventBridge or SNS? Something happens in my app and other code must act on it. Do I put it in a queue, on an event bus, or on a topic? SQS, EventBridge, SNS, or both. SQS for work between your own services: it buffers, retries and lets Lambda take messages in batches. EventBridge for routing events by their content and for anything on a clock. SNS for simple fan-out, alerts and mobile push. Often all of them: EventBridge or SNS copies the event, and one SQS queue per consumer sits in front of each Lambda.
- 04 SQS retries or Durable Functions? A job calls something flaky (a third-party API, an LLM, a slow Postgres). How do I retry it reliably, and when do I reach for Lambda durable functions instead of tuning SQS? SQS + Lambda retries, Lambda durable functions, Lambda or EventBridge built-in retries, or both. SQS + Lambda for one-step jobs: it buffers, protects the downstream and retries, as long as three settings are right. Lambda durable functions (Watching) for multi-step jobs, where a failure in step 3 mustn't rerun steps 1 and 2: the retries live per step, in code. Both is the shape I'd pilot: SQS in front for back-pressure, a durable function behind it, finishing within 15 minutes or started asynchronously.
- 05 pgvector or S3 Vectors? Where should my embeddings live? pgvector, S3 Vectors, or both. Not competitors. pgvector when a user is waiting and results depend on your data. S3 Vectors when the collection is huge, cold or per client.
- 06 Pulumi or Terraform? We're putting our infrastructure in code. Pulumi or Terraform, and what if we already run one of them? Pulumi, Terraform, or both. Pulumi for new work: real code, state in your own S3 bucket, and every Terraform provider through its bridge, so it costs no coverage. Terraform when the client's team already runs it well; I keep it. Often both: Pulumi already runs on Terraform's providers, and new pieces go in Pulumi next to a client's existing Terraform, each resource with one owner.
- 07 Cloudflare or S3 and CloudFront for a website? Where should a website, SPA or PWA live, Cloudflare static hosting or S3 behind CloudFront, and where do its heavy files go? Cloudflare static hosting, S3 and CloudFront, R2 for the files, or both. Cloudflare static hosting by default: push to main and it's live, with static requests free and unlimited. S3 and CloudFront when the client's policy keeps every component inside their AWS accounts, or the origins must stay private in AWS. Often both: the site on Cloudflare and its API on AWS, or S3 in Sydney as the system of record with R2 serving the public copy.
- 08 CloudWatch and Firehose, side by side How do I keep chatty logs without a CloudWatch-sized bill? CloudWatch, Firehose to S3, or both. Not either-or. WARN and ERROR stay in CloudWatch, where you watch and alarm on them. The chatty bulk goes from your logger to Firehose to S3, at about $75 per TB instead of about $673.
- 09 Athena or DuckDB? How should I query my data lake, and what changed when AWS bought DuckDB's company? Athena, DuckDB, or both. Use both. Athena for big scans and ad-hoc questions with zero code. DuckDB for app queries, writing Parquet and local development, on the same files. Sorting files, or Iceberg, fixes the second-index problem without copying data.
- 10 Neon or Aurora? I need Postgres for an app on AWS. When is Neon the right call, and when does it have to be Aurora? Neon, Aurora, or both. Neon by default: it scales to zero, branches like git, and talks HTTP so a Lambda needs no VPC or proxy. Aurora when the client must stay all-AWS, wants Bedrock Knowledge Bases on SQL, or runs heavy, constant or global load. Both across a portfolio, not inside one app: Neon for new products and previews, Aurora for the all-AWS client's production, and a Postgres-to-Postgres move between them when one outgrows its home.
- 11 Better Auth or Cognito? Which sign-in should my app use, and what do I actually get for free? Cognito, Better Auth, or both. Not better or worse: one or the other, by job. Cognito for small internal apps and admin panels: everything out of the box, free under 10,000 users. Better Auth for serious apps on Postgres: users in your own database, more features, no per-user fee, and some building and patching.
- 12 Why I ended up on AWS Which cloud should my company run on, and is AWS just the one you know? AWS, Hostinger VPS, or both. Not the one I started on. Azure in production first, then AWS, with Google Cloud tried along the way. AWS for SMEs and enterprises that plan to grow, Hostinger for an always-on agent box, and AI to carry AWS's complexity.
- 13 Better Auth, run yourself or managed by Neon? My app is on Neon. Should I run Better Auth myself, or switch on Neon Auth, which is Better Auth managed by Neon? Neon Auth, Better Auth, run yourself, or both. Same library, same tables, two jobs. Neon Auth for a prototype or a simple app: sign-in in minutes, nothing to host or patch, users branching with the database. Better Auth run yourself for a client app that has to grow: every plugin, your own keys and claims, and no lock-in.
- 14 Stripe or PayPal Should we take payments with Stripe or PayPal, and when is PayPal worth the pain? Stripe, PayPal, or both. Stripe by default, for its API, its documentation, its features and, in Australia, its price. PayPal only for what Stripe can't give you, its reach and its payouts to people who already have an account, and never as the only way money moves.
- 15 Tailscale or Cloudflare Tunnel? I need to reach a private box or VPC, or put a service from it online. Is that Tailscale or Cloudflare Tunnel? Tailscale, Cloudflare Tunnel, or both. Not competitors: they point in opposite directions. Tailscale brings your own machines into the private network; Cloudflare Tunnel publishes one service from it to the internet, on your domain, with no open port. Most boxes I run use both.
- 16 Resend or SES? Our app sends email, and maybe a newsletter. Resend, or Amazon SES in our own AWS account? Resend, SES, or both. Resend by default: transactional and marketing on one platform, no sandbox, and the plumbing already built. SES when email data must stay in Australia, or at very high volume, and you accept a few weeks of plumbing. Both when an app on AWS keeps its system mail and inbound mail in SES and sends everything else through Resend.
- 17 WhatsApp or Telegram Our bot should reach users in a messaging app. WhatsApp or Telegram, and why did yours get blocked? WhatsApp, Telegram, or both. Telegram is a pleasure to build on and WhatsApp fights you, not with its technology but with its approvals and its bans. But you go where your users are. What I learned moving a live product from one to the other.
- 18 Which model, at what price Claude, GPT or an open model? Which is the cheapest model that's good enough, tier by tier? Claude, OpenAI, An open model, or both. Anthropic and OpenAI now charge the same per token in most tiers, so the price sheet decides nothing. The bill per task does. Tier by tier, Claude against OpenAI's closest model and the two best open models, and how to test them on your own work.
- 19 Function URL or API Gateway? My Lambda needs an HTTPS endpoint. When is a function URL enough, and when do I start on API Gateway from day one? a function URL, API Gateway, or both. A function URL by default: free, up to 15 minutes, nothing to keep in sync. API Gateway from day one when you sell an API, need a private one, or need what only it does at the door. Often both: the partner API on API Gateway, the app's own endpoints on function URLs, the same code behind them.
The worked examples: one system end to end, with real numbers →
Want this stack in your AWS account?
Cloudless Labs is a Sydney consultancy. We migrate on-premises systems to AWS, build serverless apps on this stack, and coach teams to ship with Claude Code and Codex.