Infrastructure

This reference implementation deploys to two AWS environments, QA and Prod, provisioned by environment-agnostic Terraform modules composed per environment with separate remote state.

Environments

QA deploys automatically on merge to main. Prod is gated behind a GitHub Environment manual-approval rule. Both environments are structurally identical; QA is paused more aggressively to keep idle cost down. Local development is a third environment running Postgres + pgvector in Docker — see the local guide.

Per-environment resources

Ingestion deployment

Ingestion runs as a local Python script during development and as a one-off Lambda invocation in AWS:

Lambda runs outside the VPC and reaches Aurora Serverless v2 through the RDS Data API, an HTTPS endpoint that needs no NAT gateway (~$32/month saved) and no VPC attachment on the Lambda. The VPC exists solely to host Aurora’s private subnets and security group.

Resources per environment

Resource	Service	Notes
CloudFront distribution + S3 bucket	Edge	Serves the React SPA; ~$0 idle
API Gateway HTTP API	Compute	Routes `/query` to Lambda; `POST /query` carries a route-level throttle: 1 req/s steady-state, burst 5 (`ANY /{proxy+}` used by `/healthz` is unthrottled)
API Lambda	Compute	FastAPI + Mangum; no VPC attachment
Ingestion Lambda	Compute	One-time corpus load; triggered manually
Aurora Serverless v2 cluster	Data	pgvector; 0-ACU auto-pause; in VPC
Secrets Manager secret	Security	DB credentials; read by Lambda at cold start
IAM execution role	Security	Least-privilege: Bedrock, rds-data, Secrets Manager
AWS Budgets alarm	Cost	Per-environment spend alert; the cost filter must resolve to spend, which requires an activated `Environment` cost-allocation tag

Bedrock (embeddings and generation) is an AWS-managed API — no VPC endpoint or provisioned resource needed.

Terraform module structure

The infrastructure is organized as reusable modules composed by thin per-environment roots. The module catalog, per-env roots, state backend, and how each module enforces RAG010/RAG011 structurally are detailed in Terraform layout.

CI/CD pipeline

QA deploys automatically on merge to main; Prod is gated behind a GitHub Environment manual-approval rule, with Infracost posting a cost diff on every PR so cost impact is visible before merge (see RAG001). The Prod apply step is gated and logged; no force-apply path exists. The promotion model, fan-out pipeline shape, and failure modes are covered in Environments & CI, with the stage-by-stage outline in the deployment plan.