Shaylee Czech Security Automation & DevSecOps Engineer | CISSP

Infrastructure Architecture

Interactive visualization of the AWS infrastructure powering this site — S3 + CloudFront + Lambda, no servers to patch.

—
CF ƒ API λ DNS lookup → CDN TLS Cert Viewer Request Content Sync Static Assets /api/* Invoke Logs Code Deploy User HTTPS Request Route 53 DNS Resolution ACM SSL Certificate CloudFront CDN + Edge Routing + TLS CloudFront Fn Viewer Request (Edge JS) GitHub Actions CI/CD Pipeline S3 Bucket Static Site (Private, OAC-only) API Gateway HTTP API Lambda stats-api (Node.js 22, arm64) CloudWatch Logs Lambda Execution Logs

Why API Gateway, not a Lambda Function URL: Function URLs were tried first — both AuthType=AWS_IAM behind CloudFront's Origin Access Control, and AuthType=NONE with an explicit public resource policy. Both were rejected with a hard AccessDeniedException at the Lambda invoke layer itself, confirmed against a disposable from-scratch probe function with no other configuration. API Gateway sidesteps whatever that restriction is. Migrated off a VPC + ALB + Auto Scaling Group + EC2 + NAT Gateway architecture (~$64/mo) to this one (~$2–5/mo) in September 2026 — same site, same /api/stats behavior, no servers left to patch.