# usamaabdulkader/aws-reference-architectures architecture

> Architecture diagram of the GitHub repository usamaabdulkader/aws-reference-architectures, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/usamaabdulkader/aws-reference-architectures
- Repository: https://github.com/usamaabdulkader/aws-reference-architectures

## Overview

This repository is a portfolio of four AWS reference architectures, not one deployed application. The principal request-to-result flow is the student submission API: a client submits JSON, API Gateway invokes Lambda, and the function validates and stores a timestamped, uniquely identified item in DynamoDB. The other projects demonstrate controlled private-instance access, a multi-AZ web tier, and static-site delivery. The root README documents these systems; only the Lambda implementation was sampled, so other wiring is shown only where documented. The README describes temporary environments that were decommissioned after validation.

Main entry points: [`04-Serverless-Submission-API/src/lamda_function.py`](https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/src/lamda_function.py) (Submission Lambda), [`02-High-Availability-ALB`](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB) (Application Load Balancer), [`01-VPC-Networking`](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking) (Bastion Host), [`03-Static-Website-Delivery`](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery) (CloudFront)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_vpc["VPC Networking"]
  node_vpcnet["VPC and Subnets"]
  node_igw["Internet Gateway"]
  node_nat["NAT Gateway"]
  node_bastion["Bastion Host"]
  node_privateec2["Private EC2"]
  node_vpcsg["Security Groups"]
  node_vpcmonitor["CloudWatch"]
end

subgraph group_alb["Highly Available Web"]
  node_albnet["Multi-AZ VPC"]
  node_albservice["Application Load Balancer"]
  node_targetgroup["Target Group"]
  node_webinstances["Web EC2 Instances"]
  node_albsecurity["Layered Security Groups"]
end

subgraph group_static["Static Website Delivery"]
  node_route53["Route 53"]
  node_cloudfront["CloudFront"]
  node_s3[("S3 Website Files")]
  node_acm["ACM Certificate"]
  node_websitecontent["HTML Pages<br/>[Index.html]"]
end

subgraph group_api["Submission API"]
  node_apigateway["API Gateway"]
  node_lambda["Submission Lambda<br/>[lamda_function.py]"]
  node_dynamodb[("Students DynamoDB")]
  node_iamrole["Lambda IAM Role<br/>[trust_policy.json]"]
  node_dbpolicy["DynamoDB Policy"]
  node_apilogs[("CloudWatch Logs")]
end

node_admin(("Administrator"))
node_internet(("Internet"))
node_sitevisitor(("Site Visitor"))
node_apiclient(("API Client"))

node_admin -->|"administers"| node_bastion
node_bastion -->|"accesses privately"| node_privateec2
node_vpcnet -->|"hosts"| node_bastion
node_vpcnet -->|"segments"| node_privateec2
node_igw -->|"connects"| node_internet
node_nat -->|"outbound access"| node_internet
node_vpcsg -->|"controls traffic"| node_bastion
node_vpcsg -->|"controls traffic"| node_privateec2
node_privateec2 -->|"sends metrics"| node_vpcmonitor
node_sitevisitor -->|"sends HTTP"| node_albservice
node_albservice -->|"forwards requests"| node_targetgroup
node_targetgroup -->|"routes traffic"| node_webinstances
node_albservice -->|"checks health"| node_webinstances
node_albsecurity -->|"restricts access"| node_albservice
node_albsecurity -->|"allows ALB traffic"| node_webinstances
node_sitevisitor -->|"requests domain"| node_route53
node_route53 -->|"resolves to"| node_cloudfront
node_cloudfront -->|"fetches site files"| node_s3
node_websitecontent -->|"stored in"| node_s3
node_acm -->|"secures HTTPS"| node_cloudfront
node_admin -.->|"invalidates cache"| node_cloudfront
node_apiclient -->|"POST /submit"| node_apigateway
node_apigateway -->|"invokes proxy"| node_lambda
node_lambda -->|"writes item"| node_dynamodb
node_lambda -->|"returns response"| node_apigateway
node_iamrole -->|"trusted execution"| node_lambda
node_dbpolicy -->|"grants scoped access"| node_lambda
node_lambda -->|"writes logs"| node_apilogs

click node_vpcnet "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_igw "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_nat "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_bastion "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_privateec2 "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_vpcsg "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_vpcmonitor "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking"
click node_albnet "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB"
click node_albservice "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB"
click node_targetgroup "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB"
click node_webinstances "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB"
click node_albsecurity "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB"
click node_route53 "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery"
click node_cloudfront "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery"
click node_s3 "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery/S3-files"
click node_acm "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery"
click node_websitecontent "https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/03-Static-Website-Delivery/S3-files/Index.html"
click node_apigateway "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/04-Serverless-Submission-API"
click node_lambda "https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/src/lamda_function.py"
click node_dynamodb "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/04-Serverless-Submission-API"
click node_iamrole "https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/iam/trust_policy.json"
click node_dbpolicy "https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/iam/students-dynamodb-policy.json"
click node_apilogs "https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/04-Serverless-Submission-API"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_vpcnet,node_igw,node_nat,node_bastion,node_privateec2,node_vpcsg,node_vpcmonitor,node_apiclient toneBlue
class node_albnet,node_albservice,node_targetgroup,node_webinstances,node_albsecurity toneAmber
class node_route53,node_cloudfront,node_s3,node_acm,node_websitecontent toneMint
class node_apigateway,node_lambda,node_dynamodb,node_iamrole,node_dbpolicy,node_apilogs toneRose
class node_admin,node_internet,node_sitevisitor toneIndigo
```

## Components

### VPC Networking

- [VPC and Subnets](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`
- [Internet Gateway](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`
- [NAT Gateway](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`
- [Bastion Host](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`
- [Private EC2](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`
- [Security Groups](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`
- [CloudWatch](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/01-VPC-Networking): `01-VPC-Networking`

### Highly Available Web

- [Multi-AZ VPC](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB): `02-High-Availability-ALB`
- [Application Load Balancer](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB): `02-High-Availability-ALB`
- [Target Group](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB): `02-High-Availability-ALB`
- [Web EC2 Instances](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB): `02-High-Availability-ALB`
- [Layered Security Groups](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/02-High-Availability-ALB): `02-High-Availability-ALB`

### Static Website Delivery

- [Route 53](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery): `03-Static-Website-Delivery`
- [CloudFront](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery): `03-Static-Website-Delivery`
- [S3 Website Files](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery/S3-files): `03-Static-Website-Delivery/S3-files`
- [ACM Certificate](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/03-Static-Website-Delivery): `03-Static-Website-Delivery`
- [HTML Pages](https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/03-Static-Website-Delivery/S3-files/Index.html): `03-Static-Website-Delivery/S3-files/Index.html`

### Submission API

- [API Gateway](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/04-Serverless-Submission-API): `04-Serverless-Submission-API`
- [Submission Lambda](https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/src/lamda_function.py): `04-Serverless-Submission-API/src/lamda_function.py`
- [Students DynamoDB](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/04-Serverless-Submission-API): `04-Serverless-Submission-API`
- [Lambda IAM Role](https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/iam/trust_policy.json): `04-Serverless-Submission-API/iam/trust_policy.json`
- [DynamoDB Policy](https://github.com/usamaabdulkader/aws-reference-architectures/blob/main/04-Serverless-Submission-API/iam/students-dynamodb-policy.json): `04-Serverless-Submission-API/iam/students-dynamodb-policy.json`
- [CloudWatch Logs](https://github.com/usamaabdulkader/aws-reference-architectures/tree/main/04-Serverless-Submission-API): `04-Serverless-Submission-API`

### Other components

- **Administrator**
- **Internet**
- **Site Visitor**
- **API Client**

## Connections

- Administrator → Bastion Host: administers
- Bastion Host → Private EC2: accesses privately
- VPC and Subnets → Bastion Host: hosts
- VPC and Subnets → Private EC2: segments
- Internet Gateway → Internet: connects
- NAT Gateway → Internet: outbound access
- Security Groups → Bastion Host: controls traffic
- Security Groups → Private EC2: controls traffic
- Private EC2 → CloudWatch: sends metrics
- Site Visitor → Application Load Balancer: sends HTTP
- Application Load Balancer → Target Group: forwards requests
- Target Group → Web EC2 Instances: routes traffic
- Application Load Balancer → Web EC2 Instances: checks health
- Layered Security Groups → Application Load Balancer: restricts access
- Layered Security Groups → Web EC2 Instances: allows ALB traffic
- Site Visitor → Route 53: requests domain
- Route 53 → CloudFront: resolves to
- CloudFront → S3 Website Files: fetches site files
- HTML Pages → S3 Website Files: stored in
- ACM Certificate → CloudFront: secures HTTPS
- Administrator → CloudFront: invalidates cache
- API Client → API Gateway: POST /submit
- API Gateway → Submission Lambda: invokes proxy
- Submission Lambda → Students DynamoDB: writes item
- Submission Lambda → API Gateway: returns response
- Lambda IAM Role → Submission Lambda: trusted execution
- DynamoDB Policy → Submission Lambda: grants scoped access
- Submission Lambda → CloudWatch Logs: writes logs