DevOps Infrastructure

This section outlines the cloud infrastructure configuration for the photo analysis platform. Our architecture follows a serverless model to minimize operational overhead and ensure high availability for our 40-student development cohort.

---

Cognito Setup

We utilize AWS Cognito User Pools to manage user identity and secure access to our application. By offloading authentication to Cognito, we ensure that user credentials are not stored in our local database, reducing security risks and simplifying the login flow.

• User Pool: Configured to allow sign-in via email and username.

• App Client: Created without a client secret to enable seamless integration with our React frontend.

• Password Policy: Set to a minimum of 8 characters with requirements for uppercase, numbers, and special characters.

• Attributes: Configured to require email as a mandatory attribute for user registration and identity tracking.

S3 Setup

AWS S3 serves as our primary storage layer. We use a centralized bucket to store all uploaded user images, acting as the primary trigger point for our automated analysis pipeline.

• Access Level: Set to Private with "Block all public access" enabled.
• Access Pattern: Images are written to the bucket by a Lambda function (triggered via API Gateway) rather than direct client-side uploads.
• CORS Configuration: Updated to allow authorized requests from our specific deployment domain.
• Event Notifications: Configured to trigger the Rekognition Lambda function immediately upon an s3:ObjectCreated:* event.

DynamoDB Setup

AWS DynamoDB is our NoSQL database used to store image metadata and AI-generated tags. Its low-latency performance allows for near-instant gallery filtering.

Table Schema:

Attribute	Type	Description
userId (Partition Key)	String	Allows efficient user-specific queries
imageId (Sort Key)	String	Uniquely identifies each upload
S3Key	String	S3 object key
tags	List	List of labels from Rekognition
uploadedAt	String	Date of upload
dimension	List	Dimension of image (ex: 128x128
size	Number	Image size in bytes

Key Takeaways

• Gateway Decoupling: By routing uploads through API Gateway, we can validate file types and sizes at the API layer before they ever reach our storage.

• IAM Roles (Least Privilege): The API Gateway/Lambda execution role is strictly limited to s3:PutObject permissions, while the Rekognition Lambda is restricted to s3:GetObject.