How usamaabdulkader/aws-reference-architectures works
This repository is a portfolio of four AWS reference architectures, not one deployed application. The principal request-to-result flow is the student submission API: a client submits JSON, API Gateway invokes Lambda, and the function validates and stores a timestamped, uniquely identified item in DynamoDB. The other projects demonstrate controlled private-instance access, a multi-AZ web tier, and static-site delivery. The root README documents these systems; only the Lambda implementation was sampled, so other wiring is shown only where documented. The README describes temporary environments that were decommissioned after validation.
Main entry points: lamda_function.py Submission Lambda · 02-High-Availability-ALB Application Load Balancer · 01-VPC-Networking Bastion Host · 03-Static-Website-Delivery CloudFront
Components 27
VPC Networking
- VPC and Subnets
01-VPC-Networking - Internet Gateway
01-VPC-Networking - NAT Gateway
01-VPC-Networking - Bastion Host
01-VPC-Networking - Private EC2
01-VPC-Networking - Security Groups
01-VPC-Networking - CloudWatch
01-VPC-Networking
Highly Available Web
- Multi-AZ VPC
02-High-Availability-ALB - Application Load Balancer
02-High-Availability-ALB - Target Group
02-High-Availability-ALB - Web EC2 Instances
02-High-Availability-ALB - Layered Security Groups
02-High-Availability-ALB
Static Website Delivery
- Route 53
03-Static-Website-Delivery - CloudFront
03-Static-Website-Delivery - S3 Website Files
03-Static-Website-Delivery/S3-files - ACM Certificate
03-Static-Website-Delivery - HTML Pages
03-Static-Website-Delivery/S3-files/Index.html
Submission API
- API Gateway
04-Serverless-Submission-API - Submission Lambda
04-Serverless-Submission-API/src/lamda_function.py - Students DynamoDB
04-Serverless-Submission-API - Lambda IAM Role
04-Serverless-Submission-API/iam/trust_policy.json - DynamoDB Policy
04-Serverless-Submission-API/iam/students-dynamodb-policy.json - CloudWatch Logs
04-Serverless-Submission-API
Other components
- Administrator
- Internet
- Site Visitor
- API Client
Connections 28
- Administrator → Bastion Host: administers
- Bastion Host → Private EC2: accesses privately
- VPC and Subnets → Bastion Host: hosts
- VPC and Subnets → Private EC2: segments
- Internet Gateway → Internet: connects
- NAT Gateway → Internet: outbound access
- Security Groups → Bastion Host: controls traffic
- Security Groups → Private EC2: controls traffic
- Private EC2 → CloudWatch: sends metrics
- Site Visitor → Application Load Balancer: sends HTTP
- Application Load Balancer → Target Group: forwards requests
- Target Group → Web EC2 Instances: routes traffic
- Application Load Balancer → Web EC2 Instances: checks health
- Layered Security Groups → Application Load Balancer: restricts access
- Layered Security Groups → Web EC2 Instances: allows ALB traffic
- Site Visitor → Route 53: requests domain
- Route 53 → CloudFront: resolves to
- CloudFront → S3 Website Files: fetches site files
- HTML Pages → S3 Website Files: stored in
- ACM Certificate → CloudFront: secures HTTPS
- Administrator → CloudFront: invalidates cache
- API Client → API Gateway: POST /submit
- API Gateway → Submission Lambda: invokes proxy
- Submission Lambda → Students DynamoDB: writes item
- Submission Lambda → API Gateway: returns response
- Lambda IAM Role → Submission Lambda: trusted execution
- DynamoDB Policy → Submission Lambda: grants scoped access
- Submission Lambda → CloudWatch Logs: writes logs