Streamora architecture
This page turns the live infrastructure topology into a reviewable demo for a job application. It focuses on system boundaries, deployment tradeoffs, and operational thinking without exposing sensitive identifiers from the real AWS environment.
The architecture still shows ingress, service ownership, queue-driven background work, private subnet design, and IAM role separation. What changed is the exposure level, not the underlying engineering story.
Reviewers can see the real shape of the system and the tradeoffs behind it, while account IDs, DNS names, ARNs, policy names, database endpoints, and network identifiers stay redacted.
Public Entry
Route53 resolves the production hostname to a single internet-facing ALB in eu-north-1. TLS terminates there through ACM, health checks stay centralized, and only the web service is exposed through the target group.
Service Split
The web tier and ingest worker run as separate ECS Fargate services. That keeps user-facing latency concerns isolated from background media processing, queue polling, and retry behavior.
Private Connectivity
Application tasks run in private subnets, while AWS service access is routed through interface endpoints and an S3 gateway endpoint. Data and queue access stay behind explicit security-group boundaries instead of broad network exposure.
Least Privilege
Execution roles and task roles are separated explicitly. The stack makes a visible distinction between task startup permissions, runtime queue access, database access, and media publishing permissions.
Browser request to application response
Route53 maps `app.example.com` to the ALB.
The ALB listeners on ports 80 and 443 both forward traffic into the web target group, with `/api/health` used for health checks.
The web ECS service serves the application, coordinates Cognito-backed authentication, and reads and writes application data.
Media links resolve to S3 object URLs while the application shell itself stays behind the ALB.
Database access remains an application-to-data-layer dependency rather than a browser-facing endpoint.
Background ingest and recovery loop
The web tier creates the job record in Postgres and emits a compact SQS message containing the video identifier.
The worker service long-polls SQS independently of the web tier and loads full ingest state only after a message arrives.
FFmpeg-based processing runs in the worker task, while heartbeats and claim ownership stay persisted in Postgres.
Generated playback files, thumbnails, and HLS outputs are published to S3 under stable object keys.
Queue retry behavior and media processing stay decoupled from the user-facing request path.
The architecture keeps compute-heavy ingest work out of the public service path.
How network and IAM boundaries line up
Security groups describe which components can initiate traffic to which destinations.
Interface endpoints handle Secrets Manager, SQS, ECR, and CloudWatch Logs access without sending those calls over public internet routes.
An S3 gateway endpoint keeps bucket access aligned with the private-subnet application design.
Task roles scope runtime permissions per workload instead of sharing a broad instance profile.
The portfolio export preserves those relationships while redacting identifiers and secrets.
What each part of the system actually does
The topology is more useful when each box has an operational meaning. This section explains the responsibility split between the public edge, application services, data layer, storage layer, and private AWS dependencies.
ALB
The application load balancer is the public entry point. It terminates TLS, runs health checks, and forwards browser traffic only to the web service instead of exposing containers directly.
Web Service
The web ECS service serves the Streamora UI, handles user-facing requests, coordinates Cognito-backed authentication, reads and writes application data, and decides which media objects are available for playback. It is the only service intentionally reachable through the public request path.
Worker Service
The worker ECS service is internal-only. It consumes SQS messages, claims the corresponding job in Postgres, downloads or processes source media, generates output artifacts, recovers stale claims, and publishes results without competing with browser traffic for latency-sensitive work.
RDS / Postgres
RDS stores durable operational state: video metadata, ingest status, claim ownership, heartbeats, and publish lifecycle data. Both the web and worker services depend on it, and the infrastructure is designed around controlled application access instead of direct browser reachability.
S3
S3 stores the actual media artifacts: uploaded source files, generated thumbnails, HLS outputs, and playback assets. The worker publishes into S3, and the web service turns those stored keys into browser-facing media URLs.
SQS
SQS is the dispatch layer between the web and worker services. The queue carries only small job messages so delivery is retryable, while Postgres remains the source of truth for job state, attempts, and final ingest results.
VPC Endpoints
VPC endpoints let private workloads reach AWS-managed services without routing that traffic over the public internet. In this stack that includes Secrets Manager, SQS, ECR, CloudWatch Logs, and S3 access paths needed by ECS tasks.
IAM Roles
Execution roles let ECS start tasks, pull images, and ship logs. Task roles grant runtime permissions to the application code itself, such as reading secrets, talking to SQS, or publishing media to S3. Keeping those roles separate demonstrates least-privilege intent instead of a single broad permission set.
Engineering improvements highlighted in this demo
How to read the sanitized topology
The exported topology below is intentionally machine-derived and lightly curated. It serves as evidence that the architecture summary above maps to a real deployment shape.
`public-app-alb` is the public entry point. Services show whether they are ALB-backed or internal-only. VPC endpoints, queue links, and security-group connections reveal how private service access is controlled.
The IAM section shows workload-level role separation. The ECS-to-RDS and ECS-to-SQS links demonstrate that the topology tool is not just listing resources, it is correlating how those resources are connected.
Public topology export
Generated from the real AWS topology with the portfolio-safe `--public` mode.
ROUTE53
+-------------+-----------------+------+-----------------------+----------------+----------------------+------------+
| Hosted Zone | Record | Type | Target | ALB Name | ALB DNS | Region |
+-------------+-----------------+------+-----------------------+----------------+----------------------+------------+
| example.com | app.example.com | A | alb.example.internal. | public-app-alb | alb.example.internal | eu-north-1 |
+-------------+-----------------+------+-----------------------+----------------+----------------------+------------+
ALB
+----------------+-------------+-----------------+--------+-------+--------------------+-----------------+----------------------+
| Name | Type | Scheme | State | VPC | Subnets | Security Groups | DNS |
+----------------+-------------+-----------------+--------+-------+--------------------+-----------------+----------------------+
| public-app-alb | application | internet-facing | active | vpc-1 | subnet-1, subnet-2 | sg-1 | alb.example.internal |
+----------------+-------------+-----------------+--------+-------+--------------------+-----------------+----------------------+
ALB LISTENERS
+------------+----------+------+----------------------------------------+--------------+----------------+
| Listener | Protocol | Port | Certificates | Action Types | Target Groups |
+------------+----------+------+----------------------------------------+--------------+----------------+
| listener-1 | HTTPS | 443 | arn:aws:acm:region:account:certificate | forward | target-group-1 |
| | | | /public-cert-1 | | |
+------------+----------+------+----------------------------------------+--------------+----------------+
| listener-2 | HTTP | 80 | - | forward | target-group-1 |
+------------+----------+------+----------------------------------------+--------------+----------------+
ALB LISTENER RULES
+------------+--------+----------+------------+---------+----------------+
| Listener | Rule | Priority | Conditions | Actions | Target Groups |
+------------+--------+----------+------------+---------+----------------+
| listener-1 | rule-1 | default | default | forward | target-group-1 |
+------------+--------+----------+------------+---------+----------------+
| listener-2 | rule-2 | default | default | forward | target-group-1 |
+------------+--------+----------+------------+---------+----------------+
ECS SERVICES
+-----------+-----------+---------+------------------+-------------+------------------+----------------------------------------+--------------------+-------------------------+------------------------------+---------------------------------------+----------------------------------------+----------------------------------------+
| Cluster | Service | Desired | Task Definition | Task Role | Execution Role | ALB Usage | Subnets | Security Groups | SG Connections | RDS Links | S3 Links | SQS Links |
+-----------+-----------+---------+------------------+-------------+------------------+----------------------------------------+--------------------+-------------------------+------------------------------+---------------------------------------+----------------------------------------+----------------------------------------+
| cluster-1 | service-1 | 1 | public-taskdef-1 | task-role-1 | execution-role-1 | public-app-alb -> target-group-1 | subnet-3, subnet-4 | security-group-3 (sg-2) | in<- security-group-1 (sg-1) | instance:db-instance-1 (sg-reference) | bucket:bucket-1 (env:<redacted>) | queue-arn:arn:aws:sqs:region:account:q |
| | | | | | | (container-1:3000) | | | | | service-mode:s3 (env:<redacted>) | ueue-1 (iam-policy:<redacted>) |
| | | | | | | | | | | | | queue-config:queue-config |
| | | | | | | | | | | | | (secret:<redacted>) |
+-----------+-----------+---------+------------------+-------------+------------------+----------------------------------------+--------------------+-------------------------+------------------------------+---------------------------------------+----------------------------------------+----------------------------------------+
| cluster-1 | service-2 | 1 | public-taskdef-2 | task-role-2 | execution-role-1 | - | subnet-3, subnet-4 | security-group-2 (sg-3) | - | instance:db-instance-1 (sg-reference) | bucket:bucket-1 (env:<redacted>) | queue-arn:arn:aws:sqs:region:account:q |
| | | | | | | | | | | | bucket:bucket-1 | ueue-1 (iam-policy:<redacted>) |
| | | | | | | | | | | | (iam-policy:<redacted>) | queue-config:queue-config |
| | | | | | | | | | | | service-mode:s3 (env:<redacted>) | (secret:<redacted>) |
+-----------+-----------+---------+------------------+-------------+------------------+----------------------------------------+--------------------+-------------------------+------------------------------+---------------------------------------+----------------------------------------+----------------------------------------+
SQS QUEUES
+---------+------------------------------------+-----+------------+
| Queue | ARN | URL | Source |
+---------+------------------------------------+-----+------------+
| queue-1 | arn:aws:sqs:region:account:queue-1 | - | iam-policy |
+---------+------------------------------------+-----+------------+
IAM ROLES
+------------------+----------------------------------------+---------------+----------------------------------------+------------------+-----------------+
| Role | ARN | Path | Principal | Managed Policies | Inline Policies |
+------------------+----------------------------------------+---------------+----------------------------------------+------------------+-----------------+
| execution-role-1 | arn:aws:iam::account:role/execution-ro | /application/ | {'Service': 'ecs-tasks.amazonaws.com'} | managed-policy-1 | inline-policy-2 |
| | le-1 | | | | |
+------------------+----------------------------------------+---------------+----------------------------------------+------------------+-----------------+
| task-role-1 | arn:aws:iam::account:role/task-role-1 | /application/ | {'Service': 'ecs-tasks.amazonaws.com'} | - | inline-policy-1 |
+------------------+----------------------------------------+---------------+----------------------------------------+------------------+-----------------+
| task-role-2 | arn:aws:iam::account:role/task-role-2 | /application/ | {'Service': 'ecs-tasks.amazonaws.com'} | - | inline-policy-3 |
+------------------+----------------------------------------+---------------+----------------------------------------+------------------+-----------------+
SECURITY GROUPS
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
| Name | ID | VPC | Description | Inbound Security Groups | Inbound Rules | Outbound Rules |
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
| security-group-1 | sg-1 | vpc-1 | Security boundary for a demo | - | CIDR public-internet | tcp 80 | CIDR public-internet | all all ports |
| | | | component. | | CIDR public-internet | tcp 443 | |
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
| security-group-2 | sg-3 | vpc-1 | Security boundary for a demo | - | - | CIDR public-internet | all all ports |
| | | | component. | | | |
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
| security-group-3 | sg-2 | vpc-1 | Security boundary for a demo | security-group-1 (sg-1) | SG security-group-1 (sg-1) | tcp 3000 | CIDR public-internet | all all ports |
| | | | component. | | | |
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
| security-group-4 | sg-4 | vpc-1 | Security boundary for a demo | security-group-2 (sg-3) | SG security-group-2 (sg-3) | tcp 443 | CIDR public-internet | all all ports |
| | | | component. | security-group-3 (sg-2) | SG security-group-3 (sg-2) | tcp 443 | |
| | | | | sg-5 (sg-5) | SG sg-5 (sg-5) | tcp 443 | |
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
| security-group-5 | sg-6 | vpc-1 | Security boundary for a demo | security-group-2 (sg-3) | SG sg-5 (sg-5) | tcp 5432 | CIDR public-internet | all all ports |
| | | | component. | security-group-3 (sg-2) | SG security-group-2 (sg-3) | tcp 5432 | |
| | | | | sg-5 (sg-5) | SG security-group-3 (sg-2) | tcp 5432 | |
+------------------+------+-------+----------------------------------------+-------------------------+---------------------------------------+--------------------------------------+
VPC ENDPOINTS
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| Endpoint ID | Service | Type | VPC | Subnets | Security Groups | Private DNS | State |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| vpce-1 | com.amazonaws.eu-north-1.ecr.dkr | Interface | vpc-1 | subnet-3, subnet-4 | security-group-4 (sg-4) | true | available |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| vpce-2 | com.amazonaws.eu-north-1.logs | Interface | vpc-1 | subnet-3, subnet-4 | security-group-4 (sg-4) | true | available |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| vpce-3 | com.amazonaws.eu-north-1.secretsmanage | Interface | vpc-1 | subnet-3, subnet-4 | security-group-4 (sg-4) | true | available |
| | r | | | | | | |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| vpce-4 | com.amazonaws.eu-north-1.sqs | Interface | vpc-1 | subnet-3, subnet-4 | security-group-4 (sg-4) | true | available |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| vpce-5 | com.amazonaws.eu-north-1.ecr.api | Interface | vpc-1 | subnet-3, subnet-4 | security-group-4 (sg-4) | true | available |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
| vpce-6 | com.amazonaws.eu-north-1.s3 | Gateway | vpc-1 | - | - | false | available |
+-------------+----------------------------------------+-----------+-------+--------------------+-------------------------+-------------+-----------+
RDS INSTANCES
+---------------+----------+-----------+----------------------------+-------+-------------------------+----------+
| Identifier | Engine | Status | Endpoint | VPC | Security Groups | Multi-AZ |
+---------------+----------+-----------+----------------------------+-------+-------------------------+----------+
| db-instance-1 | postgres | available | writer.db.example.internal | vpc-1 | security-group-5 (sg-6) | false |
+---------------+----------+-----------+----------------------------+-------+-------------------------+----------+
ECS TO RDS LINKS
+-------------+-------------+---------------+--------------+------------+
| ECS Service | Target Type | Target ID | Match Type | Match |
+-------------+-------------+---------------+--------------+------------+
| service-1 | instance | db-instance-1 | sg-reference | <redacted> |
+-------------+-------------+---------------+--------------+------------+
| service-2 | instance | db-instance-1 | sg-reference | <redacted> |
+-------------+-------------+---------------+--------------+------------+
ECS TO S3 LINKS
+-------------+--------------+-----------+------------+------------+
| ECS Service | Target Type | Target ID | Match Type | Match |
+-------------+--------------+-----------+------------+------------+
| service-1 | bucket | bucket-1 | env | <redacted> |
+-------------+--------------+-----------+------------+------------+
| service-1 | service-mode | s3 | env | <redacted> |
+-------------+--------------+-----------+------------+------------+
| service-2 | bucket | bucket-1 | env | <redacted> |
+-------------+--------------+-----------+------------+------------+
| service-2 | bucket | bucket-1 | iam-policy | <redacted> |
+-------------+--------------+-----------+------------+------------+
| service-2 | service-mode | s3 | env | <redacted> |
+-------------+--------------+-----------+------------+------------+
ECS TO SQS LINKS
+-------------+--------------+------------------------------------+------------+------------+
| ECS Service | Target Type | Target ID | Match Type | Match |
+-------------+--------------+------------------------------------+------------+------------+
| service-1 | queue-arn | arn:aws:sqs:region:account:queue-1 | iam-policy | <redacted> |
+-------------+--------------+------------------------------------+------------+------------+
| service-1 | queue-config | queue-config | secret | <redacted> |
+-------------+--------------+------------------------------------+------------+------------+
| service-2 | queue-arn | arn:aws:sqs:region:account:queue-1 | iam-policy | <redacted> |
+-------------+--------------+------------------------------------+------------+------------+
| service-2 | queue-config | queue-config | secret | <redacted> |
+-------------+--------------+------------------------------------+------------+------------+
WARNINGS
- Public mode enabled: infrastructure identifiers, endpoints, ARNs, and sensitive values have been redacted.