The reality involves a bunch of Engineering by Poking[1]. Did you get all the IAM roles and permissions right? How about hooking up logging--more IAM poking. S3, database service, CloudFront? More poking. Certificates, CORS, domain aliases, throttling, etc?

The docs might be clear but you need to already be an expert in how everything fits together to do it right the first time. The problem is an embarrassment of riches in terms of configurability, which makes for longer learning and poking times.

1: http://lambda-the-ultimate.org/node/5335