Serverless Cloud Client Gallery

Executive Summary

Engineered to replace third-party photo delivery SaaS platforms like Pixieset, this architecture eliminates recurring monthly subscription fees by leveraging AWS's pay-as-you-go serverless ecosystem. By utilizing Amazon S3 ($0.023/GB standard storage) combined with CloudFront edge caching and Lambda's free usage tier, the platform operates at a $0 static base running cost.

A photographer would need to host approximately 40,000 full-resolution JPEG photos (or roughly 400 GB of media storage) on AWS before incurring a monthly bill equivalent to Pixieset's $10.99 base tier threshold. The system features secure client link generation via S3 Presigned URLs, single-digit millisecond metadata retrieval via DynamoDB, and keyless infrastructure deployment driven by Terraform and GitHub Actions.

Architecture & Workflow Decisions

1. Client Request & Authentication: Inbound client requests pass through Amazon CloudFront edge locations, enforcing HTTPS and negotiating secure TLS handshakes before reaching API Gateway.
2. Session & Access Validation: API Gateway routes authentication requests to AWS Lambda microservices, which validate gallery access tokens and query Amazon DynamoDB for gallery states, expiration limits, and image keys.
3. Presigned Media Streaming: Instead of proxying heavy media files through Lambda payloads, the backend dynamically generates time-bounded, secure S3 Presigned URLs and streams response payloads for full-resolution image downloads.
4. Edge Caching & Delivery: Amazon CloudFront caches public assets at global edge locations, minimizing latency for repeat photo downloads while shielding private S3 buckets from direct Internet access.
5. Keyless Infrastructure CI/CD: Commits to the repository trigger a GitHub Actions pipeline that uses OpenID Connect (OIDC) short-lived tokens to authenticate with AWS, executing Terraform execution plans to deploy infrastructure without storing long-lived access keys.

Infrastructure & Code Highlights

name: Deploy Cloud Client Gallery
on:
  push:
    branches: [ main ]

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Authenticate via AWS OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActions-Gallery-Role
          aws-region: eu-west-2

      - name: Provision Infrastructure
        run: |
          terraform init
          terraform apply -auto-approve

import { S3Client, GetObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const s3Client = new S3Client({ region: "eu-west-2" });

export const handler = awslambda.streamifyResponse(async (event, responseStream) => {
  const { galleryId, imageKey } = JSON.parse(event.body);

  // Generate 15-minute time-bounded S3 download token
  const command = new GetObjectCommand({
    Bucket: process.env.GALLERY_S3_BUCKET,
    Key: `${galleryId}/${imageKey}`,
  });

  const presignedUrl = await getSignedUrl(s3Client, command, { expiresIn: 900 });

  responseStream.write(JSON.stringify({
    statusCode: 200,
    headers: { "Access-Control-Allow-Origin": "https://samuelojo.tech" },
    downloadUrl: presignedUrl
  }));
  responseStream.end();
});

Key Technical Challenges Resolved