4.

Design Rationale – Serverless Photo Album Architecture

4.1 Fulfillment of Business Scenario Using Proposed Services

The proposed architecture adopts a fully managed, serverless, and event-driven design
organized into six logical tiers. This satisfies all eight business requirements by eliminating
infrastructure maintenance, enabling global low-latency access, supporting unpredictable
traffic growth, and providing an extensible foundation for future media processing.

At the edge layer, Route 53 and CloudFront provide global DNS routing and CDN caching,
reducing international response times to under 150ms—a 70% improvement from single-
region hosting. AWS WAF mitigates threats such as SQL injection, XSS, and bot attacks at the
perimeter.

API Gateway and Amazon Cognito enable secure, serverless authentication and API access,
meeting Requirement 1 (managed services) and Requirement 4 (serverless adoption). All
application logic runs on AWS Lambda, which automatically scales to handle traffic doubling
every six months (Requirement 2) with zero idle cost.

Amazon DynamoDB On-Demand replaces the existing relational database, fulfilling

Requirement 5 with sub-10ms latency, zero administration, and 98% lower cost. All media
is stored in Amazon S3 with 11-nines durability. S3 event notifications trigger a routing
Lambda that publishes to an SNS Event Hub, enabling decoupled processing through
dedicated SQS queues (Requirement 8d). Rekognition, MediaConvert, and Step Functions
fulfill Requirements 7 and 8c for AI tagging and video transcoding.

Table 1 – Core AWS Services and Rationale

Service Function Req. Rationale

Route 53 + Global DNS + CDN 6 150ms worldwide

CloudFront latency; 70% faster

AWS WAF Web firewall Security SQLi/XSS + bot

protection

API Gateway + API + Auth 1,4 OIDC/OAuth2, zero

Cognito custom auth

AWS Lambda Compute 1,4 Auto-scale; pay-per-

use

DynamoDB On- Metadata store 5 <10ms latency; 98%

Demand cheaper than RDS

S3 Media storage 1 11 nines durability;

(raw/processed/sta event triggers
tic)

SNS + SQS + DLQ Event routing 8b,8d Fan-out, filtering,

fault isolation

Rekognition + AI + Video 7,8b,8c Managed processing

MediaConvert

Step Functions Orchestration 8c Retry logic, parallel

tasks

Worker Specialization: AI Worker (batch=1, 30s timeout), Image Worker (batch=10, 60s),
Video Worker (batch=1, 300s).

VPC Design: Multi-AZ, private subnets, Gateway Endpoints (S3/DynamoDB) eliminate NAT
costs.

4.2 Alternative Solutions and Comparative Analysis

4.2A Compute Platform Evaluation

Table 2 – Compute Options

Metric EC2 Fargate Lambda (Selected)

Scaling 5–10 min 2–3 min <10 sec

Ops overhead High Medium Minimal

Cost (10k uploads) $75.60 $14.40 $3.73

Idle cost High Medium $0

Decision: Lambda satisfies Requirements 1,2,4 with lowest operational burden.

4.2B Database Evaluation

Table 3 – Database Options

Metric RDS Aurora Serverless DynamoDB

(Selected)

Cost $15.50 ~$43 $0.29

Scaling Manual Semi-auto Automatic

Latency 10–50ms 5–20ms <10ms

Decision: DynamoDB best fits Requirement 5 (simple schema + cost reduction).

4.2C Messaging & Caching

Hybrid SNS→SQS pattern enables 1:N fan-out with message filtering, satisfying Req. 8b and
8d. CloudFront chosen over Redis (~$50/mo) and DynamoDB DAX ($200+/mo) for edge
caching with zero operational overhead.

4.3 Evaluation Against Design Criteria

4.3A Performance & Scalability

Table 4 – Performance Summary

Metric Target Achieved

API p99 latency <500ms ~250ms

Global latency <200ms ~150ms

Image processing <60s ~30s

Video processing <5 min ~3 min

Direct S3 uploads avoid API throttling. Lambda and DynamoDB On-Demand scale
automatically, supporting 8× load increases without configuration.

4.3B Reliability & Fault Tolerance

Multi-AZ deployment across all tiers. S3 provides 11-nines durability with versioning. SQS
DLQs isolate failures. Step Functions handle retry logic for video workflows. DynamoDB
PITR offers 35-day retention.
Disaster Recovery: S3 Cross-Region Replication enables RTO ≈ 1 hour, RPO < 15 minutes.

4.3C Security (Defence-in-Depth)

Table 5 – Security Layers

Layer Controls

Network Private subnets, SG/NACL, Gateway

Endpoints

Perimeter WAF (SQLi/XSS), geo-blocking, bot

mitigation

Identity Cognito JWT, MFA

Access Control IAM least privilege, STS tokens

Data Protection S3 SSE, DynamoDB encryption, TLS 1.2+

Audit CloudTrail, CloudWatch Insights

4.4 Cost Analysis and Optimization

Table 6 – Baseline Cost (10k uploads/month)

Component Cost

CloudFront $9.25

API Gateway $17.90

Lambda $3.73

DynamoDB $0.29

S3 $1.95

Rekognition + MediaConvert $12.50

SQS + SNS + CloudWatch $8.10

Total $71.69/mo

Scaling Projection: At 8× traffic, cost reaches $465.20/mo.

EC2 vs Serverless: EC2 = $2,091.10/mo vs $275.69 serverless → 87% savings.
Optimization techniques: S3 Intelligent-Tiering, Lambda memory right-sizing, CloudFront
Regional Edge Cache, DynamoDB reserved capacity, Compute Savings Plans.

4.5 Requirements Traceability

Table 7 – Requirements Coverage

Req Solution Verified By

1 Fully managed serverless Architecture diagram

2 Auto-scaling (Lambda, Load test

DynamoDB, API GW)

3 Remove EC2 Architecture diagram

4 Event-driven Event logs
(S3→SNS→SQS)

5 DynamoDB On-Demand Cost + latency tables

6 CloudFront global CDN Latency test

7 MediaConvert + Step Sample transcoding runs

Functions

8 Auto-trigger + extensibility Pipeline tests

Extensibility Example: Add PDF extraction by adding new SQS queue, SNS filter, Lambda
worker. Deployment ~2 hours with zero downtime.

4.6 Operational Strategy

4.6A Monitoring & Observability

CloudWatch dashboard monitors API latency, Lambda concurrency, SQS depth, S3 request
rates, CloudFront cache hit ratio. Alerts via SNS → Slack/PagerDuty.

4.6B CI/CD Deployment

Pipeline: GitHub → CodeBuild → CloudFormation → Canary 10% → rollback → security
scanning (IAM Analyzer, CodeGuru, Snyk).

4.6C Load Testing & Validation

Tools: AWS Distributed Load Testing, K6, Locust.
Includes baseline, stress, peak tests; resilience testing (DLQ redrive, retry logic).