Decision guides.
The worked examples behind the verdicts: one question each, answered end to end with real numbers, side by side, and the code.
- 01 Lambda, Web Functions or Workers? Where should this piece of logic run? Classic Lambda for events and heavy compute. Lambda Web Functions for HTTP business logic, once in your region. Workers at the edge, for waiting, spikes and real-time.
- 02 The LLM streaming proxy How do I add an AI chat feature without leaking my API key or paying for the model's thinking time? Never call an LLM from the browser. A Worker holds the key, checks the user's budget and streams tokens back. Waiting costs nothing on Workers.
- 03 The flash sale What happens when 50,000 people press "Buy" in the same ten seconds? Straight into Lambda, the spike meets scaling limits, 429s and an Aurora connection storm. With a Worker in front, Cloudflare absorbs it and AWS sees only the winners.
- 04 A live auction on Durable Objects How do thousands of bidders share one live auction without races, and what happens when it ends? One Durable Object per lot holds every WebSocket and processes bids one at a time. When the lot closes, it reconciles into AWS and deletes its data. $15–30 a month vs $130–410 on AWS designs.
- 05 IoT ingestion into Postgres 5,000 devices send a reading every minute. Where does the money go? For ingest-and-report, Postgres wins. The expensive part is the front door, not the database. Fix REST and per-message invocations, and the bill drops from about $1,100 to $215–410.
- 06 pgvector or S3 Vectors? Where should my embeddings live? Not competitors. pgvector when a user is waiting and results depend on your data. S3 Vectors when the collection is huge, cold or per client.
- 07 Pulumi everywhere Can I provision every tool on this page from one codebase? Almost. Pulumi uses any Terraform provider, so AWS, Cloudflare, GitHub, Tailscale, Neon, Resend, PostHog, OpenRouter and Stripe are all code.
- 08 CloudWatch and Firehose, side by side How do I keep chatty logs without a CloudWatch-sized bill? Not either-or. WARN and ERROR stay in CloudWatch, where you watch and alarm on them. The chatty bulk goes from your logger to Firehose to S3, at about $75 per TB instead of about $673.
- 09 Athena or DuckDB? How should I query my data lake, and what changed when AWS bought DuckDB's company? Use both. Athena for big scans and ad-hoc questions with zero code. DuckDB for app queries, writing Parquet and local development, on the same files. Sorting files, or Iceberg, fixes the second-index problem without copying data.
- 10 Better Auth or Cognito? Which sign-in should my app use, and what do I actually get for free? Not better or worse: one or the other, by job. Cognito for small internal apps and admin panels: everything out of the box, free under 10,000 users. Better Auth for serious apps on Postgres: users in your own database, more features, no per-user fee, and some building and patching.
Want this stack in your AWS account?
Cloudless Labs is a Sydney consultancy. We migrate on-premises systems to AWS, build serverless apps on this stack, and coach teams to ship with Claude Code and Codex.