AWS Image Pipeline
Serverless image processing pipeline on AWS — an S3 upload triggers a Lambda that generates a thumbnail and publishes a completion event via SNS, entirely defined in Terraform.
Role
Backend / Cloud Engineer
Capacity
Solo build — portfolio project
Year
2026
Stack size
11 tools
Overview
AWS Image Pipeline is a small, deliberately clean serverless system built to demonstrate solid infrastructure-as-code and Lambda design patterns rather than feature breadth. An object landing in the raw/ prefix of an S3 bucket triggers a Lambda function that generates a thumbnail, writes it to the processed/ prefix, and publishes a completion event to an SNS topic. The entire stack — S3 buckets, the Lambda, IAM roles, and SNS — is defined in Terraform as reusable modules (s3, iam, lambda, sns) composed together in a dev environment, so the whole system is reproducible from a single apply. The Lambda's execution role is scoped to exact resource ARNs, read access to raw/* and write access to processed/* only, with no wildcard actions or resources anywhere in the policy. All AWS SDK calls are isolated behind a thin boto3 client layer that is injected rather than hardcoded, which keeps the core image-processing logic fully unit-testable against moto mocks with no live AWS credentials required.
Responsibilities
- Designed the event-driven S3 → Lambda → SNS pipeline and defined the full stack as reusable Terraform modules (s3, iam, lambda, sns).
- Wrote least-privilege IAM policies scoped to exact resource ARNs per prefix, with no wildcard actions or resources.
- Isolated all boto3/AWS SDK calls behind an injected client layer to keep business logic fully unit-testable without live credentials.
- Built the pydantic-based request/response models and settings layer, with configuration read from environment variables set by Terraform.
- Wrote a pytest + moto unit test suite covering the image-processing logic against mocked AWS services.
Highlights
- Entire stack reproducible from a single `terraform apply` — S3, Lambda, IAM, and SNS as composed modules
- Least-privilege IAM scoped to exact per-prefix resource ARNs, no wildcards
- Fully unit-testable processing logic via an injected AWS client layer and moto mocks — no live AWS credentials needed for tests