RAHUL PATEL

Project Overview

The Cloud Resume Challenge is a hands-on cloud engineering project covering AWS architecture, serverless application development, infrastructure as code, and automated deployment. The implementation combines global edge delivery, a serverless visitor counter, persistent state, Terraform-managed infrastructure, and continuous deployment.

Dual-Layer Architecture

The architecture is intentionally segregated into two decoupled tiers:

• Static Presentation Tier: Amazon S3 bucket with all public access blocked, fronted by Amazon CloudFront with Origin Access Control (OAC), HTTPS/TLS termination at CloudFront using a certificate managed through AWS Certificate Manager (ACM), and custom DNS resolution managed by Amazon Route 53.
• Serverless Visitor Counter Tier: Static frontend client initiates asynchronous GET requests to Amazon API Gateway, which invokes an AWS Lambda function running Python to perform an atomic increment and read operation against an Amazon DynamoDB table.

AWS Infrastructure Services

Infrastructure as Code (Terraform)

All AWS infrastructure components are declared, provisioned, and managed through HashiCorp Terraform in the crc-terraform repository.

Using Terraform reduces manual ClickOps and keeps infrastructure configuration version-controlled. Running terraform plan allows infrastructure differences to be reviewed before applying changes and provides a repeatable way to manage the declared resources.

Automated CI/CD Delivery Pipeline

Continuous integration and deployment is managed via GitHub Actions:

• Frontend Pipeline: On push to main branch, GitHub Actions executes validation, synchronizes static HTML/CSS/JS assets to the S3 bucket using aws s3 sync, and triggers CloudFront cache invalidation (aws cloudfront create-invalidation --distribution-id ... --paths "/*") to reduce stale-cache time as part of deployment.
• Backend Pipeline: Validates Lambda Python code, runs test assertions, and packages and deploys the function update.

Production Lessons Learned & Engineering Insights

• 1. CloudFront Certificate Regionality Constraint

  AWS Certificate Manager (ACM) certificates used with CloudFront distributions must be provisioned in the us-east-1 (N. Virginia) region regardless of where other regional resources reside. Handled cleanly in Terraform via multi-provider aliases.

• 2. Origin Access Control (OAC) Migration

  Legacy CloudFront setups relied on Origin Access Identity (OAI). Implementing the modernized Origin Access Control (OAC) provides stronger cryptographic signing (SigV4), SSE-KMS support, and allows the S3 bucket policy to restrict object access to the CloudFront distribution through Origin Access Control (OAC), keeping the bucket from being publicly readable.

• 3. Concurrency Safety with Atomic DynamoDB Increments

  A naive read-increment-write approach causes lost updates during simultaneous visits. Utilizing DynamoDB's native UpdateExpression='ADD visitor_count :inc' performs the increment atomically on the database storage node, preventing race conditions without requiring application-level locking.

• 4. Edge Cache Invalidation Lifecycle

  Without automated cache invalidation, browsers continue receiving stale cached versions until edge TTL expires. Automating invalidations in the GitHub Actions workflow reduces stale-cache time by clearing edge caches upon deployment.