AWS in production

How it is wired

Service by service

• CloudFront SaaS (multi-tenant)

  Each rental company gets the app on its own address, app.{their domain}.

  One multi-tenant distribution serves every tenant. A new company is a new tenant with its own domain and certificate, not a new stack.

  Try it with your business name

• EC2

  The Rental Pilot API, its MySQL databases and the real-time chat server.

  One Ubuntu instance behind Apache. Production and the sandbox share the box but never a database; the sandbox is refreshed from a production snapshot with customer emails scrubbed.

• S3 and CloudFront

  The React web app and the customer portal.

  Every deploy builds, syncs to S3, invalidates CloudFront and runs a smoke suite against production before it counts as done.

• CodeCommit, CodePipeline and CodeDeploy

  Source control and the test server.

  Every push to main deploys itself to the test server. Production is a separate, deliberate deploy that refuses to run from anything but the tip of main.

• Amazon Bedrock

  Radar, the help assistant inside the app, and the assistants on three company websites.

  Claude with tool use: Radar searches the help guides and files a problem report only after the person agrees. Every question is logged with its cost, under a daily spend cap.

• SES

  Invoices, delivery and return notices, and alerts.

  Production sends live. The sandbox never does: its mail queues for approval, and its customer addresses are scrubbed so a test can never reach a real customer.

• Route 53

  DNS for the company domains.

  SPF, DKIM and DMARC on every domain, with DMARC and TLS reports flowing back; CAA records name the only authorities allowed to issue certificates.

• CloudFront response headers policies

  Security headers on every app host.

  HSTS, nosniff, frame and referrer rules applied at the edge, so no app build can forget them.

  See the security page

• WorkMail

  Company mailboxes.

  Hosted mail for the businesses I run systems for, on their own domains. AWS retires WorkMail on 31 March 2027, so these are moving next.

  WorkMail migration

• CloudWatch

  Server health.

  Memory and swap alarms on the API server email me before a slowdown becomes an outage.

How it is wired

Service by service

• CloudFront SaaS, Route 53 and Certificate Manager, automated

  A lender types in their domain and the app does the rest.

  The API writes the DNS records in Route 53, creates a CloudFront distribution tenant with a managed certificate, and switches the domain on once CloudFront is serving it. No ticket, no console.

• EC2 with Docker Compose

  The Node and Express API, PostgreSQL and the web app.

  Containers on one instance behind nginx, so the whole product starts, stops and upgrades as one unit.

• SES

  Sign-in links, reminders, renewal drips and campaigns.

  Every message goes through a status-tracked outbox with retries, so a failed send is recorded and retried, never silently lost.

How it is wired

Service by service

• EC2

  The stucco company's job app and both company websites.

  They share the Rental Pilot server under separate Apache sites. Deploys go through a locked script and are verified by checksum on the server.

• Amazon Bedrock

  Assistants on supersonicstucco.ca and supersonicrentals.ca.

  They answer visitors from each site's own content. Repeat questions get a saved answer at no cost, and every question reaches a person.

• WorkMail and SES

  Company mailboxes and outgoing mail.

  Mailboxes on WorkMail; application mail through SES, with SPF, DKIM and DMARC on every domain so it lands in the inbox.

How it is wired

Two examples

• Rail & Sail Montessori House

  A Richmond preschool, built from the school's own documents.

  Eight pages in Next.js, exported to static files and served from S3 through CloudFront, with DNS in Route 53, all in the school's own AWS account so they own it outright.

  railandsailmh.ca

• Zero Cut Disability Society

  A BC non-profit helping people claim the Disability Tax Credit without paying a promoter's cut.

  Twelve hand-written pages with no framework and no third-party requests at all: no fonts, analytics or trackers, enforced by a Content Security Policy. Accessible to WCAG 2.2 AA, served from S3 through CloudFront.

  zerocuttaxsociety.ca

How it is wired

Service by service

• Lambda

  Every dynamic thing on this site: the visitor map, the agent, the build crew, the tools and the feature switches.

  Five Node 22 functions on Graviton. Their URLs answer only CloudFront, through an Origin Access Control, so POST bodies are signed and nothing can call them directly.

• Amazon Bedrock and Guardrails

  Ask my agent, and five Claude agents that build a mini app while you watch.

  Answers stream as they are written. A guardrail checks every question and answer, and good answers are saved so the next person asking gets them instantly, at no cost.

  Ask my agent

• DynamoDB

  Who is on the site right now, saved answers and votes, and the activity log.

  One table, keyed by kind of record, with time-to-live so old visits clean themselves up.

• CloudFront Functions and KeyValueStore

  A hello at the edge, and switches I flip from my phone.

  The function reads the switches and your city at the nearest edge location and answers without calling any server. During re:Invent it adds a banner for visitors in Las Vegas.

  See the edge answer

• API Gateway WebSocket

  The build log, live.

  My coding sessions report what they are doing, and the page receives it as it happens over a WebSocket API.

  Open the build log

• Textract

  Read a receipt.

  Expense analysis finds the vendor, line items and total, and the page draws boxes on your own photo where each one was found.

  Try it

• Polly

  The agent, out loud.

  Answers are read by a generative voice one sentence at a time, so speech starts before the answer is finished.

• Cost Explorer and Budgets

  The real bill, on a public page.

  The month to date is pulled twice a day and shown on the glass box; a budget alarm emails me well before the limit.

  See this month's bill

• EventBridge

  Status checks.

  Every five minutes a scheduled rule checks every production system I run and records the result; an outage reaches my phone.

  Status page

• CloudWatch and SNS

  Errors and alarms.

  Seven alarms feed one topic that reaches my phone and my inbox. Error alerts are capped per function per hour, so one bad minute never becomes a hundred notifications.

• SES

  Email for mervinc.ca.

  Inbound mail lands in S3 through a receipt rule; a Lambda rewrites the headers so it passes SPF and DMARC, and forwards it to my inbox.

• CloudFormation and IAM

  All of it, reproducibly.

  The dynamic half of the site is one template, deployed by one script, with a separate least-privilege role for each function.

Running all of this costs a few dollars a month, and the bill is on the glass box page for anyone to check.

• Operational excellence

  • The dynamic half of this site is one CloudFormation template, deployed by one script.
  • Deploys refuse to run from anything but a clean tip of main.
  • Every production system is probed every five minutes; alarms reach my phone.

  The template, below Status page

• Security

  • Security headers and a hash-only Content Security Policy at the edge.
  • Function URLs answer only CloudFront, through an Origin Access Control.
  • One least-privilege IAM role per function; a Bedrock guardrail on every question and answer.

  Security page IAM and OAC

• Reliability

  • Serverless functions and on-demand DynamoDB, so there is no server to fall over.
  • Probes run in AWS, outside the systems they check, so a dead server cannot vouch for itself.
  • The edge answers some requests with no origin at all.

  Status page

• Performance efficiency

  • Lambda functions on Graviton (arm64).
  • Static pages cached at CloudFront edge locations near each visitor.
  • Answers stream as they are written instead of arriving all at once.

  Trace a request Lambda

• Cost optimization

  • Everything is pay-per-request: nothing bills while nobody is visiting.
  • A budget alarm emails me well before the limit.
  • The bill is public on this site, pulled from Cost Explorer twice a day.

  The glass box Cost Explorer

• Sustainability

  • Graviton processors and serverless functions that scale to zero between requests.
  • Pages and images are small and cached at the edge, so most requests never reach a function.
  • Static sites for small clients run on S3 and CloudFront with no server at all.

  Small sites S3