# karimrabiee/global-secure-image-processing-pipeline architecture

> Architecture diagram of the GitHub repository karimrabiee/global-secure-image-processing-pipeline, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/karimrabiee/global-secure-image-processing-pipeline
- Repository: https://github.com/karimrabiee/global-secure-image-processing-pipeline

## Overview

The product is a serverless AWS image-processing platform. A client requests a scoped upload URL, uploads directly to S3, and the queued image is processed into variants with optional moderation and metadata storage; processed content is delivered privately through CloudFront. The graph also preserves documented security, monitoring, and multi-region recovery capabilities. Workflow links are supported by the README and handler excerpts; infrastructure for several AWS services is described but not represented by deployable configuration in the sampled tree.

Main entry points: [`lambda/ImageProcessor/handler.py`](https://github.com/karimrabiee/global-secure-image-processing-pipeline/blob/main/lambda/ImageProcessor/handler.py) (Image Processor), [`lambda/GenerateUploadURL/handler.py`](https://github.com/karimrabiee/global-secure-image-processing-pipeline/blob/main/lambda/GenerateUploadURL/handler.py) (Upload URL Lambda), [`infrastructure/scripts/iam-policies`](https://github.com/karimrabiee/global-secure-image-processing-pipeline/tree/main/infrastructure/scripts/iam-policies) (KMS and IAM)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingestion["Upload and Ingestion"]
  node_api["HTTP API"]
  node_url_lambda["Upload URL Lambda<br/>[handler.py]"]
  node_upload_bucket[("Upload Bucket")]
  node_queue["SQS and DLQ"]
end

subgraph group_processing["Image Processing"]
  node_processor["Image Processor<br/>[handler.py]"]
  node_variants["Image Variants"]
  node_moderation["Image Moderation"]
  node_metadata[("Image Metadata")]
end

subgraph group_delivery["Private Delivery"]
  node_processed[("Processed Bucket")]
  node_cloudfront["CloudFront OAC"]
end

subgraph group_security["Security Controls"]
  node_waf["AWS WAF"]
  node_kms_iam["KMS and IAM"]
end

subgraph group_operations["Operations and Recovery"]
  node_monitoring["Monitoring and Alerts"]
  node_detection["Threat Detection and Audit"]
  node_dr["Multi-region Recovery"]
end

node_client(("Client"))

node_client -->|"requests URL"| node_api
node_api -->|"invokes"| node_url_lambda
node_url_lambda -->|"creates presigned POST"| node_upload_bucket
node_url_lambda -->|"returns upload details"| node_client
node_client -->|"uploads directly"| node_upload_bucket
node_upload_bucket -->|"sends object events"| node_queue
node_queue -->|"triggers"| node_processor
node_processor -->|"reads originals"| node_upload_bucket
node_processor -->|"resizes and watermarks"| node_variants
node_processor -->|"writes variants"| node_processed
node_processor -->|"checks content"| node_moderation
node_processor -->|"stores status and EXIF"| node_metadata
node_cloudfront -->|"reads privately"| node_processed
node_client -->|"requests content"| node_cloudfront
node_waf -->|"protects edge"| node_cloudfront
node_kms_iam -->|"restricts and encrypts"| node_upload_bucket
node_kms_iam -->|"restricts and encrypts"| node_processed
node_monitoring -->|"alerts operators"| node_client
node_detection -->|"provides findings and audit"| node_monitoring
node_processed -.->|"replicates cross-region"| node_dr
node_metadata -.->|"uses global tables"| node_dr
node_cloudfront -.->|"fails over origins"| node_dr

click node_url_lambda "https://github.com/karimrabiee/global-secure-image-processing-pipeline/blob/main/lambda/GenerateUploadURL/handler.py"
click node_processor "https://github.com/karimrabiee/global-secure-image-processing-pipeline/blob/main/lambda/ImageProcessor/handler.py"
click node_kms_iam "https://github.com/karimrabiee/global-secure-image-processing-pipeline/tree/main/infrastructure/scripts/iam-policies"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_api,node_url_lambda,node_upload_bucket,node_queue,node_client toneBlue
class node_processor,node_variants,node_moderation,node_metadata toneAmber
class node_processed,node_cloudfront toneMint
class node_waf,node_kms_iam toneRose
class node_monitoring,node_detection,node_dr toneIndigo
```

## Components

### Upload and Ingestion

- **HTTP API**
- [Upload URL Lambda](https://github.com/karimrabiee/global-secure-image-processing-pipeline/blob/main/lambda/GenerateUploadURL/handler.py): `lambda/GenerateUploadURL/handler.py`
- **Upload Bucket**
- **SQS and DLQ**

### Image Processing

- [Image Processor](https://github.com/karimrabiee/global-secure-image-processing-pipeline/blob/main/lambda/ImageProcessor/handler.py): `lambda/ImageProcessor/handler.py`
- **Image Variants**
- **Image Moderation**
- **Image Metadata**

### Private Delivery

- **Processed Bucket**
- **CloudFront OAC**

### Security Controls

- **AWS WAF**
- [KMS and IAM](https://github.com/karimrabiee/global-secure-image-processing-pipeline/tree/main/infrastructure/scripts/iam-policies): `infrastructure/scripts/iam-policies`

### Operations and Recovery

- **Monitoring and Alerts**
- **Threat Detection and Audit**
- **Multi-region Recovery**

### Other components

- **Client**

## Connections

- Client → HTTP API: requests URL (evidence: `README.md`)
- HTTP API → Upload URL Lambda: invokes (evidence: `README.md`)
- Upload URL Lambda → Upload Bucket: creates presigned POST (evidence: `lambda/GenerateUploadURL/handler.py`)
- Upload URL Lambda → Client: returns upload details (evidence: `lambda/GenerateUploadURL/handler.py`)
- Client → Upload Bucket: uploads directly (evidence: `README.md`)
- Upload Bucket → SQS and DLQ: sends object events (evidence: `README.md`)
- SQS and DLQ → Image Processor: triggers (evidence: `lambda/ImageProcessor/handler.py`)
- Image Processor → Upload Bucket: reads originals (evidence: `lambda/ImageProcessor/handler.py`)
- Image Processor → Image Variants: resizes and watermarks (evidence: `lambda/ImageProcessor/handler.py`)
- Image Processor → Processed Bucket: writes variants (evidence: `lambda/ImageProcessor/handler.py`)
- Image Processor → Image Moderation: checks content (evidence: `lambda/ImageProcessor/handler.py`)
- Image Processor → Image Metadata: stores status and EXIF (evidence: `lambda/ImageProcessor/handler.py`)
- CloudFront OAC → Processed Bucket: reads privately (evidence: `README.md`)
- Client → CloudFront OAC: requests content (evidence: `README.md`)
- AWS WAF → CloudFront OAC: protects edge (evidence: `README.md`)
- KMS and IAM → Upload Bucket: restricts and encrypts (evidence: `infrastructure/scripts/iam-policies/kms-us-east-1-policy.py`)
- KMS and IAM → Processed Bucket: restricts and encrypts (evidence: `infrastructure/scripts/iam-policies/s3-processed-primary-policy.py`)
- Monitoring and Alerts → Client: alerts operators (evidence: `README.md`)
- Threat Detection and Audit → Monitoring and Alerts: provides findings and audit (evidence: `README.md`)
- Processed Bucket → Multi-region Recovery: replicates cross-region (evidence: `README.md`)
- Image Metadata → Multi-region Recovery: uses global tables (evidence: `README.md`)
- CloudFront OAC → Multi-region Recovery: fails over origins (evidence: `README.md`)