Infrastructure

Two AWS environments, QA and Prod, provisioned by environment-agnostic Terraform modules composed per environment.

Environments

Expand to see both AWS environments and the local environment:

QA deploys automatically on merge to main. Prod is gated behind a GitHub Environment manual-approval rule. Both environments are structurally identical; QA is paused more aggressively to keep idle cost down. Local development is a third environment running Postgres + pgvector in Docker — see the local guide.

Per-environment resources

Expand to see the resources deployed in each environment (QA shown):

Ingestion deployment

Expand to see ingestion, which runs as a local Python script during development or as a one-off Lambda invocation in AWS:

Lambda runs outside the VPC and reaches Aurora Serverless v2 through the RDS Data API, an HTTPS endpoint that needs no NAT gateway (~$32/month saved) and no VPC attachment on the Lambda. The VPC exists solely to host Aurora’s private subnets and security group.

AWS Resources per environment

Resource	Service	Notes
CloudFront distribution + S3 bucket	Edge	Serves the React SPA
API Gateway HTTP API	Compute	Route API requests to Lambda; throttle `/query`; no throttle on `/healthz`
API Lambda	Compute	No VPC attachment
Authorizer Lambda	Compute	Validates bearer tokens on `POST /query` (RAG009); no VPC attachment
Ingestion Lambda	Compute	One-time corpus load; triggered manually
Bedrock	AI	Embeddings and generation**
Aurora Serverless v2 cluster	Data	pgvector; 0-ACU auto-pause; in VPC
Secrets Manager secret	Security	DB credentials
IAM execution role	Security	Least-privilege: Bedrock, rds-data, Secrets Manager
CloudWatch + X-Ray	Observability	Logs, metrics, and traces via Lambda Powertools
AWS Budgets alarm	Cost	Per-environment spend alert

** AWS-managed API: no VPC endpoint or provisioned resource needed.