How kunwardivyrajs/image-resizing-project-on-aws works
Purpose and Entry Point
This is Terraform-managed AWS infrastructure for an event-driven image thumbnail pipeline. Deployment begins with the root Terraform configuration (providers.tf, backend.tf) and packages Lambda code from CreateThumbnail.zip; there is no checked-in unzipped application source.
Infrastructure Composition
Terraform provisions the pipeline’s AWS resources and wiring across:
• Source and destination object storage: s3-bucket.tf
• Lambda compute and S3 event integration: lambda-function.tf
• Lambda execution identity and permissions: iam-role.tf, iam-policy.tf
• Completion notification topic and email subscription: sns-topic.tf
Resource names are parameterized through variables.tf and account-derived local values in locals.tf.
Ingestion Boundary: Source S3
Uploads enter through the source S3 bucket defined in s3-bucket.tf. S3 object-created events invoke the Lambda function configured in lambda-function.tf. This event boundary supplies object/bucket metadata to the handler and decouples clients uploading originals from image processing.
Processing Stage: Lambda
CreateThumbnail.zip contains the Lambda deployment artifact, with handler CreateThumbnail.handler as documented. The function runs Python 3.9, uses a Pillow Lambda layer, and is allocated 256 MB with a 60-second timeout through lambda-function.tf. It retrieves the uploaded object, generates a thumbnail, and coordinates output and notification actions.
Output Boundary: Destination S3
The resized image is persisted to a distinct destination bucket in s3-bucket.tf. Separating source and output buckets prevents output writes from re-entering the ingestion event path and establishes a clear original-versus-derived asset boundary.
Authorization Model
The Lambda execution role in iam-role.tf receives scoped AWS permissions defined by iam-policy.tf and associated policy documents (lambda_policy.json, lambda_role.json). Its required service interactions are S3 read access to originals, S3 write access for thumbnails, and SNS publish access. S3 also needs permission to invoke the Lambda, configured with the function/event resources in lambda-function.tf.
Notification Flow and External Services
After successful processing, Lambda publishes a completion message to Amazon SNS. sns-topic.tf defines the SNS topic and email subscription; the recipient is supplied through Terraform variables. AWS Lambda, Amazon S3, Amazon SNS, IAM, and CloudWatch logging are the material AWS runtime/services.
Deployment State
Terraform provider and remote-state/backend concerns are rooted in providers.tf and backend.tf. Configuration values, including AWS region, bucket/topic naming inputs, and notification address, flow through variables.tf and locals.tf into the resource graph.
Components 13
Terraform deployment
- Terraform root · Provisions and wires the AWS pipeline.
- Variables & locals · Region, names, and recipient inputs.
Object storage
- Source bucket · Stores uploaded original images.
s3-bucket.tf - Destination bucket · Stores derived thumbnails separately from originals.
s3-bucket.tf
Thumbnail processing
- CreateThumbnail.zip · Packaged Python thumbnail handler.
CreateThumbnail.zip - Object-created event · Invokes processing for new originals.
lambda-function.tf - Thumbnail Lambda · Reads originals, creates thumbnails, and publishes completion.
lambda-function.tf - Pillow layer
lambda-function.tf - Lambda execution role
iam-role.tf - Scoped access policy · Grants source read, destination write, and SNS publish.
- CloudWatch logs
Completion notification
- Completion topic
sns-topic.tf - Email recipient · Receives thumbnail completion messages.
sns-topic.tf
Connections 17
- Variables & locals → Terraform root: configures
- Terraform root → Source bucket: provisions
- Terraform root → Destination bucket: provisions
- Terraform root → Thumbnail Lambda: provisions
- Terraform root → Lambda execution role: provisions
- Terraform root → Completion topic: provisions
- CreateThumbnail.zip → Thumbnail Lambda: deploys
- Pillow layer → Thumbnail Lambda: extends
- Source bucket → Object-created event: object created
- Object-created event → Thumbnail Lambda: invokes
- Scoped access policy → Lambda execution role: attached to
- Lambda execution role → Thumbnail Lambda: execution identity
- Thumbnail Lambda → Source bucket: reads original
- Thumbnail Lambda → Destination bucket: writes thumbnail
- Thumbnail Lambda → Completion topic: publishes completion
- Completion topic → Email recipient: delivers
- Thumbnail Lambda → CloudWatch logs: writes logs