The VPC market has public subnets public-a and public-b and private subnets private-a and private-b. The app server app runs in public-a in the security group app-sg, with an instance profile for Session Manager. On it, /opt/market/catalogue.sql creates the catalogue and /opt/market/db-password holds the password to give the database. In CloudShell, ~/catalogue.json is the same eight monsters as a DynamoDB batch.

1. A PostgreSQL instance market-db (master user market, database market) in a subnet group market-db-subnets on the private subnets, behind a group db-sg that only app-sg can get through, with no public address. It must survive the loss of a zone. Load the catalogue into it from app.
2. A read replica market-db-reports, a manual snapshot market-db-snapshot taken after the catalogue is loaded, and proof that the snapshot works: an instance market-db-check restored from it, holding the catalogue.
3. An on-demand DynamoDB table market-monsters keyed by the string id, holding the catalogue, with an index by-type on type and then price.
4. The fire monsters, read through that index cheapest first, saved to ~/fire.json.