Infra path · AWS · 36 layers

AWS: a request, the services it touches

Click a feature. The highlighted boxes are the blast radius — homepage is the edge; create is gateway, Lambda, Redis, RDS, SQS send; PDF is the worker after 201. Pan down: async catalog, then hops, with the traps crossed out. Click Create, Homepage, or renderPDF in the API.

Click a shape or a feature

Feature · which services run

One request · hops · fan-out is not optional to name

Features · count the boxes

page · auth · write

read · files · webhook

pdf · email · search

user → edge → API

Operation

Source of truth

Auth · IAM · JWT

TLS · VPC · split

Hot state

Read path

Objects vs site

Secrets

Observe

Async catalog · after 201

queue · worker

email · search · alarms

hops after the door

intent · API hop

One request — hops and traps

DNS → TLS → split

don’t · mix modules

dnsRoute 53

alias to CloudFront

rejectedOne box does all of it

PDF + HTTP + cron
don’t

doorCloudFront

behaviors · two origins
hit never wakes Lambda

muxAPI Gateway

JWT · timeout · no cache on POST

operationLambda · cmd/api

commit then enqueue
not PDF

doorJWT authorizer

before invoke
not a login form

writerRDS primary

create commits here
list should not
sibling of API, not a child of CF

modulePage

R53 · CF · S3 site
zero VPC

moduleAuth

Cognito · JWT
not the invoice table

moduleCreate invoice

GW · Lambda · Redis
RDS · SQS send · 201
not SES · not PDF

moduleList / GET

replica · Redis
no queue

moduleUpload

presign · objects
not public-read

moduleWebhook

verify · persist
enqueue fulfill
fast 200

modulePDF

SQS · worker · S3
after 201

moduleEmail

SES from worker
no rollback

moduleSearch

index async
query OpenSearch
RDS still owns write

idpCognito

tokens · not invoices

roleIAM · per function

API send · worker receive · split buckets

rewriteCloudFront Function

www 301 · pretty URLs

admitWAF

before invoke · not a login

TLSACM · us-east-1

viewer cert · origin may be HTTP

pathVPC · ENI / endpoints

private RDS/Redis · S3 via endpoint

splitBehavior: S3 or API

cache hit stops here · /v1/* to Gateway

hotRedis

idempo · lock · cache-aside
not the ledger

readerRDS replica

list · print
lag is named
201 from primary

filesS3 · objects

PDFs · uploads · private

originS3 · website

HTML/JS · not PDFs

secretSecrets Manager

rotate · cache in Lambda
homepage does not fetch

logsCloudWatch Logs

request id · retention

traceX-Ray

GW → Lambda → RDS/SQS
hit has no Lambda segment

wallSQS

send after commit
receive in worker

poisonDLQ

max receive
alarm

busEventBridge

many targets
API stays dumb

workerLambda · cmd/worker

PDF · email · index
own IAM · own concurrency

mailSES

not on the 201
bounces aside

indexOpenSearch

async ingest
query here

pageAlarms · SNS

5xx · DLQ depth · p99
not site 404 as create

taxLogs · traces · alarms

emitted by whatever ran

laterWorker runs later

not on the user’s socket
trace id in the message

syncLock + commit + send

Redis · RDS · SQS
then 201

clientBrowser / app

one request · one intent
reload ≠ POST /invoices

API onlyGateway + JWT + invoke

page module is not here
timeout clock starts

1 DNSRoute 53 lookup

alias · not an origin IP
page and API share this hop

2 TLSACM at the POP

viewer TLS · still no Lambda

forbiddenrenderPDF in the API

holds GW timeout + the client
queue instead

forbiddenNo deadline on the store

fills Lambda concurrency
SQL · GW · visibility all need a cap

forbiddenpublic-read on PDFs

wrong bucket policy
presign / OAC

forbiddenOne function, all IAM

PDF starves create
split HTTP vs SQS

72%

Click a box · three arrows off a layer are what it allows

What the radius is