AI, LLM and real-time · WebRTC · Amazon Chime SDK
A managed real-time platform on AWS: a Meetings API backend, mobile and web clients, media regions close to users, SIP media applications for phone calls and media pipelines for recording, all driven by Lambda and EventBridge.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
Users sign in with Cognito, which can federate to the organisation's IdP and enforce MFA. The app receives tokens.
The app calls your meeting API with its token. The API authorises the user for this session or appointment.
The backend calls CreateMeeting, choosing the media Region closest to most attendees (Sydney is available), then CreateAttendee for each participant. The Meetings API control plane and the media Region are separate choices.
Meeting and attendee identifiers and your own roster rules are stored in DynamoDB for authorisation and reporting.
The client receives the meeting and attendee join token and connects directly to the Chime media services with the iOS, Android or JavaScript SDK. Audio, video and screen share are encrypted in transit.
A media capture pipeline can record the meeting. Concatenation merges artefacts into a single file after the meeting ends.
Pipeline output is written to S3 with a bucket policy trusting the Chime service principal, and KMS encryption.
Meeting, attendee and pipeline events flow to EventBridge. Rules trigger Lambda for notifications, billing and transcript processing.
For phone calls, SIP media applications invoke a Lambda function with call events. The function returns actions such as play audio, gather digits or bridge the call to a meeting, through a voice connector or phone numbers.
| Component | What it does | Why this choice |
|---|---|---|
| Amazon Chime SDK Meetings | Managed audio, video and content-share media with client SDKs. | No media servers to run, and the media Region can be chosen per meeting. |
| Chime SDK client libraries (iOS, Android, JavaScript) | Join, device handling, video tiles and metrics. | Native SDKs give better mobile device control than a webview. |
| Amazon Cognito | Authentication and federation. | Identity is separate from Chime, so you decide who may join. |
| API Gateway and Lambda | Meeting lifecycle and authorisation. | The Chime API credentials stay on the server. |
| Chime SDK Voice (SIP media applications and voice connectors) | Programmable telephony driven by Lambda. | Bridges PSTN callers into meetings or builds IVR. |
| Media pipelines | Recording, concatenation, live streaming and analytics. | Managed capture without running recorders. |
| Amazon EventBridge | Lifecycle events from meetings and pipelines. | Event-driven automation without polling. |
| Amazon S3 and DynamoDB | Recordings and state. | Durable, simple and cheap. |
Chime SDK or LiveKit
Why. Chime removes media operations and integrates with IAM, EventBridge and S3.
Trade-off. Less control over the media path and features follow the service roadmap.
Media Region
Why. Latency to the media Region matters most.
Trade-off. Check which Regions the service supports and where recordings and metadata are stored.
Authorisation
Why. Chime does not know your business rules.
Trade-off. You maintain the authorisation logic.
Telephony
Why. Programmable and serverless.
Trade-off. Phone number availability and carrier arrangements need planning in Australia.
Server-side meeting creation, short-lived join tokens, encryption in transit, KMS-encrypted recordings and IAM scoped per Lambda.
Managed multi-AZ media services. Handle client reconnects and cleanup of orphaned meetings with EventBridge.
Pick the media Region near attendees, use simulcast and bandwidth adaptation in the SDK, and test on real mobile networks.
Priced per attendee-minute and by pipeline, voice and transcription features. Model the cost against your usage before launch.
Infrastructure as code, event-driven runbooks and client metrics from the SDK observer APIs.
No idle media servers, and recording only on demand.
Clients reach Chime media endpoints over the internet using UDP with TCP fallback, so corporate users need the required ports and domains allowed. The backend sits behind API Gateway with WAF. Lambda can run in a VPC where it needs private resources.
Cognito identity per user. IAM roles per Lambda with only the Chime actions it needs. A resource policy on S3 limited to the Chime pipeline service principal and your account.
Meetings and recordings can contain sensitive information. Notify and record consent, encrypt with KMS, restrict recordings by prefix, set retention, and review where metadata and media are processed for your residency requirements.
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Cognito MFA for staff. Essential Eight. |
| Restrict administrative privileges | Least-privilege IAM for Chime APIs. Essential Eight. |
| Collection and consent | Recording consent and notices support APP 3 and APP 5. |
| Security of personal information | KMS, retention and access logging support APP 11. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
| Failure mode | Mitigation |
|---|---|
| Attendee cannot connect | SDK network diagnostics, TCP fallback and a pre-call device and network check. |
| Meeting never ends and incurs cost | Scheduled cleanup using EventBridge and DeleteMeeting after inactivity. |
| Recording pipeline fails | Pipeline events to EventBridge, retries and alerts, with a fallback recorder if the use case demands one. |
| Lambda call handler errors | Return safe default actions and use timeouts and DLQs. |
Attendee-minutes, recording pipelines, PSTN and phone numbers, transcription and S3.
Google Cloud
A private, governed Gemini and Model Garden inference platform: Cloud Armor at the edge, Cloud Run for the application, Vertex AI over Private Service Connect, Pub/Sub for async jobs and BigQuery for audit and cost analytics.
Azure
A governed Azure OpenAI platform: Front Door and API Management as the AI gateway, private endpoints, Entra ID managed identities, AI Search for retrieval, Content Safety, Cosmos DB for conversation state and Monitor for cost and quality.
AI platform
A reusable platform, not a single bot: channels, an agent runtime, a model gateway, retrieval, a tool registry with policy, a durable workflow engine, human approvals, CRM and ERP connectors, evaluation and cost control.
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.