Abimbola Alausa

reference architectures

Architecture

I design systems and publish the decisions behind them. Each reference architecture below states the constraint, the trade-offs, and where to go deeper.

how I approach decisions

Start with the constraint

Cost, risk, delivery pace and organisational capability shape the useful design space.

Expose the trade-off

A decision is more credible when its rejected alternatives and residual risks are visible.

Design for operation

Ownership, observability, failure recovery and change paths belong in the architecture.

reference architectures

Systems I’ve designed, decisions in the open

This portfolio

Live · AWS serverless

A static Next.js site on CloudFront and S3 with serverless integrations, least-privilege delivery roles and recorded trade-offs.

Full case study below ↓

NWAF Agent

Open source · reference architecture

An autonomous nightly agent that audits an AWS account against the Well-Architected Framework, pairing deterministic scanners with an LLM.

Overview below ↓

playshaka.com

Live product

Architecture write-up in preparation.

Visit site ↗

etiaba.com

Live product

Architecture write-up in preparation.

Visit site ↗

reference architecture · this site

Low-traffic, production-grade serverless delivery

Live

The main constraint is irregular portfolio traffic. Static delivery keeps the common path fast and inexpensive, while managed AWS services handle the few operations that require compute. The trade-off is greater reliance on cloud service configuration and careful IAM boundaries.

System context for the serverless portfolio showing visitor, delivery, API, data, email and GitHub integration boundaries
Portfolio system context, exported from the repository Draw.io source. Open the diagram for the full-resolution PNG.
Visitors reach the static site through CloudFront. Dynamic requests cross into API Gateway and Lambda; those functions use DynamoDB, private S3 storage and SES. EventBridge triggers project synchronisation, which reads public repository data from GitHub. CloudFront and API Gateway form the primary public trust boundary; private buckets and data stores are not directly exposed.

component architecture

The moving parts

Frontend — apps/web

Static-generated Next.js, delivered from a private S3 bucket through CloudFront with Origin Access Control. No public bucket read; environment-scoped key prefixes keep dev and prod isolated.

API — apps/api

Three Lambdas behind API Gateway: github-sync (daily EventBridge schedule), cv-download (a privacy-safe event, then a short-lived signed URL), and contact-form (validate, rate-limit, send via SES).

Data

DynamoDB for projects, CV-download events and contact submissions — one table set per environment. A single S3 bucket holds static assets and the CV binary, prefix-isolated per environment (ADR-010).

Content

Structured YAML and Markdown under content/, decoupled from the build so narrative, achievement and project edits need no code change.

how requests flow

Data flows

  • Page render: CloudFront serves static assets from S3, with build-time data baked in.
  • CV download: Browser to API Gateway to the cv-download Lambda; a privacy-safe event is written to DynamoDB, then a short-lived signed URL is returned for the browser to fetch from CloudFront.
  • Contact form: Browser to API Gateway to the contact-form Lambda; validation and rate-limiting, delivery via SES, delivery status recorded in DynamoDB.
  • GitHub sync: A daily EventBridge schedule triggers github-sync, which reads public repository data, normalises it against the .portfolio/project.yml contract, and writes to DynamoDB; the next build picks up the change.

deployment and delivery

How it ships

Infrastructure as code

Terraform across two environments (dev, prod) with remote state and locking. Terraform is the source of truth; pull requests expose the plan before merge.

No long-lived keys

CI authenticates to AWS via OIDC — no stored access keys. Production deploys are gated behind branch protection and explicit approval.

Static delivery

Build artefacts sync to S3 and CloudFront is invalidated on deploy. The common path is a cache hit, not a compute call.

trust boundaries

Where the boundaries are

  • Public internet to CloudFront — TLS only, rate-limiting at the edge.
  • CloudFront to S3 — Origin Access Control only; no public bucket policy, and no cross-environment read.
  • API Gateway to Lambda — a least-privilege IAM role per function, never one shared broad role.
  • Lambda to GitHub — authenticated with a token in Secrets Manager, never in source or the frontend bundle.
  • Lambda to SES — verified sender, recipient fixed to one address; no open relay.

graceful degradation

When something fails

  • GitHub unreachable: The sync job retries with exponential backoff and alarms on repeated failure; last-known-good project data keeps serving from DynamoDB.
  • SES send failure: Logged and surfaced via a CloudWatch alarm; the submission metadata is still recorded, so nothing is silently lost.
  • CloudFront or S3 outage: Treated as a standard AWS regional failure mode — no multi-region failover in V1, a deliberate trade-off against the near-zero-traffic cost target.

implementation status

What is live and what still needs work

ComponentStatusMeaning
Static Next.js siteLiveCloudFront and S3 deliver the production portfolio.
API Gateway and LambdaLiveContact, CV and project integrations are deployed serverlessly.
DynamoDB, SES and S3LiveManaged persistence, email delivery and private CV storage.
GitHub project syncUnder reviewDeployed, but the production token still needs to be populated.
API Gateway access loggingPlannedDisabled pending resolution of the account-level logging role.

architecture decision records

The decisions behind the diagram

reference architecture · open source

Nightly Well-Architected (NWAF) Agent

Open source

An autonomous agent that runs on a nightly schedule against an AWS account, evaluating it against the six Well-Architected pillars. It compares live infrastructure with the declared Terraform, classifies drift, and pairs deterministic scanners with an LLM so findings stay evidence-backed rather than model guesswork — then writes them into the AWS Well-Architected Tool for human-in-the-loop remediation.

NWAF Agent high-level design: EventBridge Scheduler triggers a CodeBuild runtime that runs deterministic scanners, retrieves context from an OpenSearch RAG store, reasons with a Bedrock-hosted Claude model, and writes findings to the AWS Well-Architected Tool with SNS notifications
NWAF Agent high-level design, exported from the repository Draw.io source. Open the diagram for full resolution.
EventBridge Scheduler triggers a CodeBuild runtime each night. It assumes a read-only cross-account role (AssumeRole with an ExternalId), runs the scanners, retrieves prior context from an OpenSearch RAG store, and reasons with a Claude model on Amazon Bedrock — provider-portable to the Claude Platform. Findings are written to the AWS Well-Architected Tool and summarised over SNS, and every stage runs under its own least-privilege IAM role.

Deterministic detection

Prowler, Checkov, Steampipe/Powerpipe, Infracost, Compute Optimizer and Cloud Carbon Footprint produce evidence across the pillars — security, cost and sustainability findings are measured, not inferred.

Reasoning layer

A Claude model correlates scanner output with the declared IaC and prior findings from the RAG store. The LLM explains and prioritises; it never fabricates a control result.

Governed by design

Least-privilege per-stage IAM, cross-account AssumeRole with an ExternalId, and human-in-the-loop remediation — mapped to ISO/IEC 42010 and 25010, TOGAF ADM and the AWS Well-Architected and Cloud Adoption frameworks.

key decisions

  • CodeBuild over ECS for the agent runtime
  • LLM provider portability — Amazon Bedrock or the Claude Platform
  • A deterministic detection portfolio, one tool per pillar
  • Least-privilege, per-stage IAM with cross-account AssumeRole
  • Human-in-the-loop remediation, never auto-apply

my role

Architecture and decision records. I designed the runtime, detection strategy, LLM-portability model, IAM boundaries and governance mapping, and published the full ADR set, high-level design and business case.

stack

  • EventBridge Scheduler
  • CodeBuild
  • Bedrock
  • OpenSearch
  • SNS
  • S3
  • IAM
  • Prowler
  • Checkov
  • Steampipe
  • Terraform
  • Python
  • Anthropic Claude
Deep dive → GitHub wikiView repository

governance and review

Decisions remain reviewable

ADRs capture material choices before implementation. Terraform remains the infrastructure source of truth, pull requests expose plans before merge, and operational follow-up stays visible rather than being presented as completed work.

Explore the architecture write-ups