DEVSECOPS · GENERATIVE AI · AWS
Secure AI API Deployment
Production-style reference architecture for exposing Amazon Bedrock through a controlled API boundary with a Secrets Manager-backed Lambda authorizer, least-privilege IAM, validation, throttling, and CloudWatch observability.
API GatewayLambdaBedrockSecrets ManagerIAMCloudWatchTerraform
PROJECT STATUSImplemented
CI VALIDATIONLoading…
DEPLOYMENTManual by Design
AUTH MODELSecret-backed Authorizer
REQUEST TRUST PATH
Authenticate → Validate → Invoke → Observe
CLIENTHTTPS Request
Health route is public; AI inference requires a bearer token.
EDGEAPI Gateway
Explicit routes, throttling, CORS, and access logging.
AUTHLambda Authorizer
Reads the API token from Secrets Manager and validates it.
AILambda + Bedrock
Prompt validation and least-privilege model invocation.
OBSERVECloudWatch
API and Lambda operational logging with retention.
Implemented controls
Secrets ManagerToken value stays out of source and Terraform state.
Least PrivilegeSeparate IAM permissions for auth and inference.
Request ValidationJSON and prompt-length checks occur before AI calls.
ThrottlingAPI Gateway rate controls reduce abuse risk.
Safe LoggingAccess logs exclude tokens and request bodies.
CI SecurityUnit tests, Bandit, and Terraform validation.
Reference implementation only; the dashboard does not claim the Terraform stack is currently deployed in production.
Recent validation runs
| Run | Result |
|---|---|
| Loading… | |
Reading public GitHub Actions metadata.
MICROSOFT AZURE REFERENCE ARCHITECTURE
Azure reference equivalent for portfolio comparison. The original project implementation remains as documented elsewhere on this page.