Cloud platforms · AWS
A scale-to-zero API for web and mobile apps. Cognito authenticates, API Gateway enforces, Lambda runs the business logic, DynamoDB stores state and SQS or EventBridge decouple the slow work.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
The client signs in with the Cognito hosted UI or your own UI using authorization code with PKCE. Cognito enforces MFA and returns short-lived JWTs.
The client calls the API over HTTPS with the access token in the Authorization header. WAF is attached to the API stage.
WAF applies rate-based and managed rules. Allowed requests continue to the API.
API Gateway validates the JWT with a Cognito authoriser, validates the request against a JSON schema, applies throttling and invokes the integration.
The function reads and writes DynamoDB using its own least-privilege execution role, with conditional writes to enforce invariants and idempotency keys for retries.
Slow or fallible work (email, exports, third-party calls) is published to SQS or EventBridge rather than done in the request path.
Worker functions poll the queue with partial batch responses. Poison messages go to a dead-letter queue with an alarm.
| Component | What it does | Why this choice |
|---|---|---|
| Amazon Cognito user pool | Sign-up and sign-in, MFA, password policy, groups and federation to Entra ID or other OIDC and SAML providers. | Managed identity avoids building authentication. Federation lets staff use the corporate IdP. |
| Amazon API Gateway (REST) | Routing, authorisation, request validation, throttling, usage plans and WAF integration. | REST APIs support WAF and usage plans. HTTP APIs are cheaper but lack some of these features. |
| AWS WAF | Rate limiting, managed rule groups and bot controls on the API stage. | Cheap first line of defence against abuse. |
| AWS Lambda | Business logic as small functions with their own IAM roles. | No servers to patch and scale to zero. Per-function roles give least privilege. |
| Amazon DynamoDB | Key-value and document store with single-digit millisecond reads at any scale. | Operationally simple and elastic when access patterns are known up front. |
| Amazon SQS and EventBridge | Queues for buffering and an event bus for fan-out. | Decoupling protects the API from slow dependencies and gives built-in retries and DLQs. |
| AWS Secrets Manager | Stores and rotates third-party credentials. | Keeps secrets out of environment variables and source control. |
| AWS KMS | Customer-managed key for DynamoDB, SQS and secrets. | Key policy and CloudTrail give auditable control over decryption. |
Compute
Why. Spiky or low-volume workloads pay only for use and need no capacity planning.
Trade-off. Cold starts, a 15-minute limit per invocation and 29-second integration timeout on REST APIs. Sustained high volume can be cheaper on containers.
Datastore
Why. Predictable latency and no instance to manage.
Trade-off. You model access patterns first. Ad hoc reporting needs an export to S3 and Athena, not scans.
API flavour
Why. WAF, usage plans and request validation are first-class.
Trade-off. Higher per-request price than HTTP API.
Async work
Why. SQS gives back-pressure and DLQs. EventBridge gives routing and schema discovery.
Trade-off. Eventual consistency means the UI must handle pending states.
JWT validation at the edge, per-function IAM roles, CMK encryption, request validation and WAF. Secrets never in code.
Multi-AZ managed services, retries with idempotency, DLQs and PITR. Throttling protects downstream limits.
Provisioned concurrency for latency-sensitive paths, DynamoDB single-table or well-chosen keys, Lambda memory tuned with power tuning.
Per-request and per-GB-second pricing. Cost grows linearly with traffic and is easy to attribute with tags per function.
Everything in IaC (CDK, SAM or Terraform), canary deployments with Lambda aliases and CodeDeploy or gradual rollouts.
Scale to zero and shared multi-tenant infrastructure. Right-size memory and use Graviton (arm64) where libraries allow.
Lambdas that only call AWS services need no VPC. Attach them to a VPC only to reach private resources, and then use VPC endpoints (gateway for DynamoDB and S3, interface for Secrets Manager, SQS and KMS) rather than a NAT gateway.
Humans and machines are separate. Users are in Cognito groups mapped to scopes. Each Lambda has its own role limited to specific table ARNs and key conditions such as dynamodb:LeadingKeys for tenant isolation. Deployments use a pipeline role, never developer credentials.
Classify fields at design time. Encrypt DynamoDB with a customer-managed KMS key, keep PII fields minimal, and tokenise or hash where search is not needed. Log request IDs, never payloads containing personal information.
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Cognito MFA for users, Identity Center MFA for administrators. Essential Eight multi-factor authentication. |
| Restrict administrative privileges | Per-function roles, permission boundaries and SCPs from the landing zone. Essential Eight restrict administrative privileges. |
| Patch applications | Managed runtimes updated on a schedule, dependency scanning in CI. Essential Eight patch applications. |
| Regular backups | DynamoDB PITR and on-demand backups through AWS Backup. Essential Eight regular backups. |
| Personal information security | Encryption at rest and in transit, minimised retention and breach response plan. APP 11. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
| Failure mode | Mitigation |
|---|---|
| Downstream dependency is slow or down | Queue the work, apply timeouts and circuit breaking, return 202 with a status resource. |
| Hot partition or throttled table | High-cardinality partition keys, on-demand mode, adaptive capacity monitoring and write sharding if needed. |
| Retry storm duplicates a write | Idempotency keys stored with conditional writes. Powertools for AWS Lambda provides this pattern. |
| Regional event in ap-southeast-2 | Documented warm standby with DynamoDB global tables only when the business impact justifies the cost. |
API requests, Lambda duration and memory, DynamoDB read and write units, data transfer and WAF.
AWS
The workhorse for line-of-business web apps: public load balancer, containers across three Availability Zones, a private Aurora PostgreSQL cluster, ElastiCache for sessions and S3 for files.
Azure
The Azure equivalent of the three-tier pattern: Front Door with WAF, Container Apps or App Service on a private network, Azure SQL, Entra ID for identity and Key Vault for secrets.
AWS and Azure
The foundation every other pattern sits on: separate accounts or subscriptions for blast-radius control, preventive guardrails, central identity, central logging and a security account that workloads cannot switch off.
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.