I've written a lot of AWS notes, decks and proof-of-concept write-ups over the years. Most of them sat in folders. So I turned them into Know Your Cloud, a free quiz site with about 800 practical questions across 22 topics, each with an explanation and a link to the AWS docs.
Here's what was interesting to build.
The architecture
One CDK stack, one region, no servers:
Browser ──► CloudFront ──► S3 (static site, private, OAC)
│
└─ /api/* ──► API Gateway (JWT authorizer) ──► Lambda
├─► S3 (question banks, private)
└─► DynamoDB (progress, leaderboard)
Sign-in: Cognito managed login ◄──► Google
The front end is plain HTML, CSS and vanilla JS. No framework, no build step.
1. The browser never gets the answers
Questions live in a private bucket. GET /api/questions/{topic} strips answer and explanation and sends only how many options to pick. When you answer, POST /api/answer grades on the server and only then returns the explanation. Opening DevTools tells you nothing.
2. "First answer counts" with one DynamoDB transaction
The leaderboard gives one point per question, decided by your first answer. Each answer writes a marker item (C#<board>#<user>, sort key = question id) with attribute_not_exists(pk), in the same TransactWriteItems as the ADD points :one. A retake cancels the whole transaction, so retries, parallel requests and guessing every option earn nothing.
Weekly boards use the ISO week as the partition key (W#2026-W42), so a new week is just a new key, and TTL cleans up old ones. Ranking is a GSI on pk + points: top 25 in one query, your own rank with one COUNT.
3. Sign-in: Google through Cognito, with PKCE
The site is a public client, so it uses the authorization code flow with PKCE and no client secret. Cognito brokers Google; the Google secret lives in Secrets Manager and is resolved at deploy time. A custom auth. domain means Google's consent screen shows my domain, not xxxx.auth.us-east-1.amazoncognito.com.
I started with email + password, but Cognito's built-in sender put codes in spam. I went Google-only, then brought email back through SES on my own domain (DKIM, custom MAIL FROM, DMARC). It ships in two deploys, because Cognito needs a verified identity and SES needs production access first. A pre sign-up Lambda links a Google sign-in to an existing email account with the same address, so nobody ends up with two scores.
4. One CloudFront distribution, two sites
kirangunturu.com is my homepage and cloud.kirangunturu.com is the quiz. A 20-line CloudFront Function routes by Host header and 301s everything else, so Google sees one URL per page. Cheaper and simpler than a second distribution.
5. Content: AI drafts, AI fact-check, human review
Questions come from my own decks, notes and AWS docs:
- Bedrock generates drafts using forced tool use, so the output is schema-valid JSON, not text to parse.
- Every question cites the slide it came from, and the generator checks that slide was actually sent.
- Decks are de-branded before rendering, and every question is scanned for account IDs and a deny-list of internal names.
- A second model pass fact-checks without seeing the slides, flagging wrong answers, ambiguity and outdated limits.
- Anything flagged waits for me.
Checking against current docs matters even for my own material: one of my notes still recommended asking AWS Support to pre-warm a load balancer, which is now a self-service LCU reservation.
What it costs
A few dollars a month: domain, hosted zone and one secret. Everything else (CloudFront, Lambda, API Gateway, on-demand DynamoDB, Cognito Essentials) is cents at this scale.
What I'd tell you if you build one
- Grade on the server from day one if there's any scoring. Bolting it on later means rewriting the client.
- Let DynamoDB conditions enforce rules. One condition expression replaced all my "has this user answered?" logic.
- Own your sign-in domain and email domain early. Both affect trust more than any feature.
- Gate rollouts on things AWS must approve (SES, certificates) behind a flag, instead of hoping one deploy does it all.
Try a topic, and if you find a wrong answer, tell me. That's the fastest way the site gets better.
