Enterprise-grade serverless backend for clinical document annotation, built with Hono and deployed on AWS.

🚀 Live Demo: https://d1pijuvgczqoi4.cloudfront.net/

Unlike traditional servers (EC2, Render, Railway, etc.) that cap their financial damage by crashing under high load, AWS serverless applications scale infinitely.

Under high virality or a DDoS attack, an unprotected serverless stack will spin up thousands of concurrent containers instantly. This can lead to runaway AWS bills of hundreds of thousands of dollars overnight.

To mitigate this, this repository implements a custom DDoS/DoW Circuit Breaker:

1. Zero-Base-Cost Function URLs bypass API Gateway completely, eliminating gateway request charges ($3.50/M) for blocked requests.
2. CloudWatch Alarm Metric Math monitors total Lambda traffic (Invocations + Throttles) in a 1-minute window.
3. Lambda Concurrency Kill Switch automatically triggers during an anomaly, programmatically throttling the API's reserved concurrency to 0 to drop subsequent request costs to exactly $0.00.

• Backend: https://github.com/harsh-vardhhan/EHR-backend
• Frontend: https://github.com/harsh-vardhhan/EHR-frontend

The backend follows a highly scalable, serverless architecture designed for clinical data residency and high availability.

graph TD
    User((Clinician)) -->|API Request with API Key| LambdaURL[AWS Lambda Function URL]
    LambdaURL -->|Hono Router & Auth Middleware| LambdaAPI[AWS Lambda - API]
    LambdaAPI -->|Read/Write| DynamoDB[(Amazon DynamoDB)]
    LambdaAPI -->|Read| S3[(Amazon S3 - Medical Notes)]
    LambdaAPI -->|Manual Trigger| SQS[AWS SQS - Annotation Queue]

    S3 -->|Emit Event| EB[Amazon EventBridge - Bus]
    EB -->|Route Rule| SQS[AWS SQS - Annotation Queue]
    SQS -->|Trigger| LambdaWorker[AWS Lambda - NLP Worker]
    SQS -.->|Failures| DLQ[AWS SQS - Dead Letter Queue]
    
    LambdaWorker -->|Inference| Groq[Groq AI - LLM Inference]
    LambdaWorker -->|Save Annotations| DynamoDB

    %% DDoS Protection
    LambdaAPI -.->|Invocations & Throttles| CWAlarm[CloudWatch Traffic Alarm]
    CWAlarm -->|Trigger if >200 req/1m| SNS[SNS Topic]
    SNS -->|Invoke| LambdaKillSwitch[AWS Lambda - Kill Switch]
    LambdaKillSwitch -->|Set Reserved Concurrency to 0| LambdaAPI

To maximize performance, cut database costs, and eliminate cross-table JOIN latency, this application uses a consolidated Single-Table Design layout (EhrTable) instead of traditional relational multi-table structures.

1. Unified Read (Document + Annotations): When opening a patient note, the backend executes a single DynamoDB query where PK = DOCUMENT#<docId>. This retrieves the document metadata and all its annotations in a single physical database operation, reducing network roundtrips and latency by 50%.
2. Inverted Index (SKIndex): To update or delete an annotation by its annotationId alone (without knowing the parent documentId), we use a Global Secondary Index (GSI) called SKIndex (where HashKey = SK and RangeKey = PK). This resolves the parent PK in milliseconds, allowing targeted, isolated edits on specific rows.

The project uses GitHub Actions for an automated, zero-downtime deployment workflow.

This backend incorporates a robust, multi-layered security architecture designed to prevent volumetric DDoS abuse and cloud-native Denial of Wallet (DoW) attacks, guaranteeing predictable operational billing.

• Node.js 20+
• AWS CLI (configured via AWS IAM Identity Center/SSO profile e.g., ehr-dev)
• SAM CLI (optional, for local Lambda emulation)

$ npm install

# development
$ npm run start:dev

• npm run build: Compiles the application.
• npm run bundle: Creates a production-ready esbuild bundle for AWS Lambda.
• npm run lint: Runs the linter.
• npm run test: Executes unit tests.
• npm run cleanup: Wipes all DynamoDB table items and S3 objects to reset the environment.
• npm run seed: Seeds the S3 bucket with sample document notes.

Built for the Modern Clinical Workflow.