How karimrabiee/global-secure-image-processing-pipeline works
The product is a serverless AWS image-processing platform. A client requests a scoped upload URL, uploads directly to S3, and the queued image is processed into variants with optional moderation and metadata storage; processed content is delivered privately through CloudFront. The graph also preserves documented security, monitoring, and multi-region recovery capabilities. Workflow links are supported by the README and handler excerpts; infrastructure for several AWS services is described but not represented by deployable configuration in the sampled tree.
Main entry points: ImageProcessor/handler.py Image Processor · GenerateUploadURL/handler.py Upload URL Lambda · iam-policies KMS and IAM
Components 16
Upload and Ingestion
- HTTP API
- Upload URL Lambda
lambda/GenerateUploadURL/handler.py - Upload Bucket
- SQS and DLQ
Image Processing
- Image Processor
lambda/ImageProcessor/handler.py - Image Variants
- Image Moderation
- Image Metadata
Private Delivery
- Processed Bucket
- CloudFront OAC
Security Controls
- AWS WAF
- KMS and IAM
infrastructure/scripts/iam-policies
Operations and Recovery
- Monitoring and Alerts
- Threat Detection and Audit
- Multi-region Recovery
Other components
- Client
Connections 22
- Client → HTTP API: requests URL
README.md - HTTP API → Upload URL Lambda: invokes
README.md - Upload URL Lambda → Upload Bucket: creates presigned POST
lambda/GenerateUploadURL/handler.py - Upload URL Lambda → Client: returns upload details
lambda/GenerateUploadURL/handler.py - Client → Upload Bucket: uploads directly
README.md - Upload Bucket → SQS and DLQ: sends object events
README.md - SQS and DLQ → Image Processor: triggers
lambda/ImageProcessor/handler.py - Image Processor → Upload Bucket: reads originals
lambda/ImageProcessor/handler.py - Image Processor → Image Variants: resizes and watermarks
lambda/ImageProcessor/handler.py - Image Processor → Processed Bucket: writes variants
lambda/ImageProcessor/handler.py - Image Processor → Image Moderation: checks content
lambda/ImageProcessor/handler.py - Image Processor → Image Metadata: stores status and EXIF
lambda/ImageProcessor/handler.py - CloudFront OAC → Processed Bucket: reads privately
README.md - Client → CloudFront OAC: requests content
README.md - AWS WAF → CloudFront OAC: protects edge
README.md - KMS and IAM → Upload Bucket: restricts and encrypts
infrastructure/scripts/iam-policies/kms-us-east-1-policy.py - KMS and IAM → Processed Bucket: restricts and encrypts
infrastructure/scripts/iam-policies/s3-processed-primary-policy.py - Monitoring and Alerts → Client: alerts operators
README.md - Threat Detection and Audit → Monitoring and Alerts: provides findings and audit
README.md - Processed Bucket → Multi-region Recovery: replicates cross-region
README.md - Image Metadata → Multi-region Recovery: uses global tables
README.md - CloudFront OAC → Multi-region Recovery: fails over origins
README.md