connections HTTPS /api/* invoke PutItem static jwt enqueue batch write deploy sync depth traces User browser CloudFront cdn / tls API Gateway http api Lambda api handler DynamoDB single table S3 static assets Cognito user pool SQS work queue Lambda queue consumer GitHub Actions build / test CloudFormation stack / iac IAM roles / policies CloudWatch logs / alarms X-Ray traces hover to isolate · click to pin · esc to release
Pick a box to read why it is in the stack.
API Gateway will not wait longer than 29 seconds, and a Lambda is billed for every millisecond it sits idle waiting on someone else. Those two limits are why the queue exists: the request path answers with what it already knows, and everything slow — the email, the PDF, the third-party call with no SLA — crosses into the async lane and comes back as a write. Read the diagram as two clocks, not one flow.
Nothing in the region can reach anything else by being drawn next to it. The handler writes to DynamoDB because its execution role says so, the gateway invokes it because a resource policy says so, and the pipeline can deploy because it assumed a short-lived role over OIDC rather than holding a key. The useful review question stops being what the code does and becomes what its role allows it to do.
CloudFront and its bucket sit inside the account box but outside the region box, and that gap is the whole availability story: the front door is replicated everywhere, while the table, the queue and the functions live in one region and fail with it. Deciding to draw a second region is deciding to answer what happens to the data — which is why the boundary is drawn before anyone asks about multi-region.
