AWS solutions documentation change
Summary
Updated architecture documentation to replace deprecated S3 Object Lambda option with new ECS architecture, added details about Lambda and ECS architectures including performance characteristics, components, and process flows.
Security assessment
The changes focus on architectural updates and feature enhancements (e.g., image size limits, new ECS architecture). While the ECS architecture introduces Cognito for admin interface authentication, this is a standard feature implementation rather than a response to a specific security vulnerability. No evidence of security patches or vulnerability fixes exists in the diff.
Diff
diff --git a/solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md b/solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md index dfd5809b9..31382f33c 100644 --- a//solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md +++ b//solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md @@ -5 +5 @@ -Architecture diagram +Architecture diagrams @@ -9 +9 @@ Architecture diagram -This section provides a reference implementation architecture diagram for the components deployed with this solution. Dynamic Image Transformation for Amazon CloudFront maintains two options for architecture. The Default Deployment uses API Gateway as a CloudFront origin and is limited to 6 MB responses. The S3 Object Lambda deployment uses a S3 Object Lambda Access Point as the CloudFront origin and can support as large an image as can be processed before the 30s response timeout. For more information about differences between the options, refer to choosing an architecture. +This section provides a reference implementation architecture diagram for the components deployed with this solution. Dynamic Image Transformation for Amazon CloudFront offers two deployment architectures to meet different performance and cost requirements. The Lambda architecture provides cost-optimized serverless processing for images up to 6 MB. The ECS architecture delivers high-performance processing for images up to 100 MB and includes advanced features like transformation policies, non-S3 origin support, and an administrative interface. @@ -11 +11 @@ This section provides a reference implementation architecture diagram for the co -## Architecture diagram +## Architecture diagrams @@ -13 +13 @@ This section provides a reference implementation architecture diagram for the co -Deploying this solution with the default parameters deploys the following components in your AWS account. +This solution provides two architecture options, each optimized for different use cases and performance requirements. @@ -15 +15,3 @@ Deploying this solution with the default parameters deploys the following compon -###### Important +### Lambda Architecture + +This cost-optimized serverless architecture is suitable for most image transformation workloads with images up to 6 MB. @@ -17 +19 @@ Deploying this solution with the default parameters deploys the following compon -This solution is intended for customers with public applications who want to provide an option to dynamically change or manipulate their public images. Because of these public requirements, this template creates a publicly accessible, unauthenticated CloudFront distribution and [Amazon API Gateway](https://aws.amazon.com/api-gateway/) endpoint in your account, allowing anyone to access it. For more information on API Gateway authorization, refer to the [Security](./security.html) section. This solution supports signing requests, which can serve to restrict unauthorized requests, for more information, refer to the [Image URL Signature section](./architecture-details.html#image-url-signature). +###### Important @@ -19 +21 @@ This solution is intended for customers with public applications who want to pro -The S3 Object Lambda architecture has been deprecated and will no longer be open to new customers starting on November 7, 2025. If you were not an existing user of S3 Object Lambda before November 7, 2025, select ‘No' for EnableS3ObjectLambdaParameter. For more information, please visit <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>. +This solution is intended for customers with public applications who want to provide an option to dynamically change or manipulate their public images. Because of these public requirements, this template creates a publicly accessible, unauthenticated CloudFront distribution and [Amazon API Gateway](https://aws.amazon.com/api-gateway/) endpoint in your account, allowing anyone to access it. For more information on API Gateway authorization, refer to the [Security](./security.html) section. This solution supports signing requests, which can serve to restrict unauthorized requests, for more information, refer to the [Image URL Signature section](./.html#image-url-signature). @@ -21 +23 @@ The S3 Object Lambda architecture has been deprecated and will no longer be open -**CloudFormation template deploys AWS resources for serverless image processing.** +**Lambda architecture for cost-optimized image processing** @@ -29 +31 @@ AWS CloudFormation resources are created from [AWS Cloud Development Kit](https: -The high-level process flow for the solution components deployed with the AWS CloudFormation template is as follows: +The high-level process flow for the Lambda architecture is as follows: @@ -31 +33 @@ The high-level process flow for the solution components deployed with the AWS Cl - 1. An [Amazon CloudFront](https://aws.amazon.com/cloudfront/) distribution provides a caching layer to reduce the cost of image processing and the latency of subsequent image delivery. The CloudFront domain name provides cached access to the image handler application programming interface (API). + 1. An [Amazon CloudFront](https://aws.amazon.com/cloudfront/) distribution provides a caching layer to reduce the cost of image processing and the latency of subsequent image delivery. @@ -33 +35 @@ The high-level process flow for the solution components deployed with the AWS Cl - 2. [Amazon API Gateway](https://aws.amazon.com/api-gateway/) / [Amazon S3 Object Lambda](https://aws.amazon.com/s3/features/object-lambda/) provides endpoint resources and initiate the [AWS Lambda](https://aws.amazon.com/lambda/) function / + 2. [Amazon API Gateway](https://aws.amazon.com/api-gateway/) provides endpoint resources and initiates the [AWS Lambda](https://aws.amazon.com/lambda/) function. @@ -35 +37 @@ The high-level process flow for the solution components deployed with the AWS Cl - 3. A Lambda function retrieves the image from a customer’s existing [Amazon S3](https://aws.amazon.com/s3/) bucket and uses `sharp` to return a modified version of the image to the API Gateway/S3 Object Lambda Access Point. + 3. A Lambda function retrieves the image from a customer’s existing [Amazon S3](https://aws.amazon.com/s3/) bucket and uses `sharp` to return a modified version of the image to the API Gateway. @@ -37 +39 @@ The high-level process flow for the solution components deployed with the AWS Cl - 4. A solution-created S3 bucket provides log storage, separate from your customer-created S3 bucket for storing images. If you enter `Yes` (default entry) for **the Deploy Demo UI** template parameter, the solution deploys another S3 bucket for storing the optional [demo user interface](./architecture-details.html#demo-ui) (UI). + 4. A solution-created S3 bucket provides log storage, separate from your customer-created S3 bucket for storing images. @@ -39 +41 @@ The high-level process flow for the solution components deployed with the AWS Cl - 5. (Optional) If you enter `Yes` for the **Enable Signature** template parameter, the Lambda function retrieves the secret value from your existing [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) secret to validate the signature. For more information, see [Launch the stack](./launch-stack.html). + 5. (Optional) If you enter `Yes` for the **Enable Signature** template parameter, the Lambda function retrieves the secret value from your existing [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) secret to validate the signature. @@ -41 +43 @@ The high-level process flow for the solution components deployed with the AWS Cl - 6. (Optional) If you use the [smart crop](./create-and-use-image-requests.html#dynamically-resize-photos) or [content moderation](./create-and-use-image-requests.html#activate-and-use-content-moderation) features, the Lambda function calls [Amazon Rekognition](https://aws.amazon.com/rekognition/) to analyze your image and returns the results. + 6. (Optional) If you use the smart crop or content moderation features, the Lambda function calls [Amazon Rekognition](https://aws.amazon.com/rekognition/) to analyze your image and returns the results. @@ -43 +45 @@ The high-level process flow for the solution components deployed with the AWS Cl - 7. The viewer request is proxied through an Amazon CloudFront function. This function is responsible for normalizing the accept header and query params to increase the cache hit rate. As well, if S3 Object Lambda is enabled in the CloudFormation template parameters, the viewer response will be proxied through a CloudFront function to allow for the rebuilding of certain response elements that are not natively supported by S3 Object Lambda. + 7. The viewer request is proxied through an Amazon CloudFront function to normalize headers and query parameters for improved cache hit rates. @@ -48 +50 @@ The high-level process flow for the solution components deployed with the AWS Cl -### S3 Object Lambda Architecture Info +### ECS Architecture @@ -50 +52 @@ The high-level process flow for the solution components deployed with the AWS Cl -###### Note +This high-performance container-based architecture supports images up to 100 MB and includes all advanced v8.0.0 features including transformation policies, non-S3 origin support, and administrative interface. @@ -52 +54 @@ The high-level process flow for the solution components deployed with the AWS Cl -S3 Object Lambda has been deprecated. Amazon S3 Object Lambda will no longer be open to new customers starting on November 7, 2025. If you were not an existing user of S3 Object Lambda before November 7, 2025, select ‘No' for Enable S3 Object Lambda parameter. For more information, please visit <https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html>. The S3 Object Lambda architecture allows for returning images which are larger than 6 MB. This infrastructure replaces the API Gateway component in the default architecture. This architecture will be used if the Enable S3 Object Lambda template parameter is set to Yes. +**ECS architecture for high-performance image processing** @@ -54 +56,28 @@ S3 Object Lambda has been deprecated. Amazon S3 Object Lambda will no longer be -###### Important + + +The high-level process flow for the ECS architecture is as follows: + + 1. An Amazon CloudFront distribution provides global caching and content delivery. + + 2. An [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) (ALB) distributes incoming requests across multiple ECS tasks for high availability and scalability. + + 3. [Amazon Elastic Container Service](https://aws.amazon.com/ecs/) (ECS) tasks running on [AWS Fargate](https://aws.amazon.com/fargate/) process image transformation requests using containerized applications. + + 4. ECS tasks maintain in-memory caches of transformation policies and origin mappings for fast request resolution and reduced latency. + + 5. Images are retrieved from multiple origin types: Amazon S3 buckets or external HTTP-accessible domains based on configured origin mappings. + + 6. An administrative interface built with [AWS Amplify](https://aws.amazon.com/amplify/) provides policy and origin management capabilities through a secure web interface. + + 7. [Amazon DynamoDB](https://aws.amazon.com/dynamodb/) stores transformation policies, origin configurations, and mapping rules with high availability and performance. + + 8. [Amazon Cognito](https://aws.amazon.com/cognito/) provides authentication and authorization for the administrative interface. + + 9. (Optional) Amazon Rekognition integration for smart cropping and content moderation features. + + + + +### Component descriptions + +#### Application Load Balancer (ALB) @@ -56 +85 @@ S3 Object Lambda has been deprecated. Amazon S3 Object Lambda will no longer be -This optional architecture makes several changes to the resources in the CloudFormation stack. Though care has been taken to ensure that responses are as similar as possible to those returned by the API Gateway Architecture, certain response headers may be slightly different. If you are updating an existing stack, please validate your application’s functionality post update. As API Gateway is no longer used as part of this optional architecture, any existing REST API will be deleted upon updating. When updating a stack to the S3 Object Lambda architecture, the existing CloudFront distribution will be replaced, resulting in a new endpoint URL and an empty cache. +Distributes incoming image transformation requests across multiple ECS tasks, providing high availability and automatic scaling capabilities. The ALB performs health checks on ECS tasks and routes traffic only to healthy instances. @@ -58 +87 @@ This optional architecture makes several changes to the resources in the CloudFo -### Choosing an Architecture +#### Amazon ECS with AWS Fargate @@ -60 +89 @@ This optional architecture makes several changes to the resources in the CloudFo -#### Cost consideration +Runs containerized image processing applications without managing servers. ECS tasks automatically scale based on demand and maintain in-memory caches for optimal performance. Fargate provides serverless compute for containers, eliminating the need to provision and manage EC2 instances. @@ -62 +91 @@ This optional architecture makes several changes to the resources in the CloudFo -With 50KB response sizes and 350ms of image processing per image, the Object Lambda architecture is ~14% less expensive per image. As image sizes increase, the costs for the Object Lambda architecture will grow faster than for the API Gateway architecture, breaking even when response sizes are an average of 700 KB. For more information, refer to Transform & Query on the [AWS S3 cost page](https://aws.amazon.com/s3/pricing/) or [Cost](./cost.html). +#### Administrative Interface @@ -64 +93 @@ With 50KB response sizes and 350ms of image processing per image, the Object Lam -#### Image Size +A web-based management console built with AWS Amplify that allows administrators to configure and manage image origins (both S3 and external sources), create and edit transformation policies, set up origin mappings using path-based and host-header routing, monitor system performance and usage metrics, and test configurations before deployment to ensure proper functionality. @@ -66 +95 @@ With 50KB response sizes and 350ms of image processing per image, the Object Lam -The default architecture limits response sizes to a maximum of 6 MB. The Object Lambda architecture is only limited by the 30 second CloudFront S3 Origin response timeout. Refer to [Object Lambda architecture response latency](./reference.html#s3-object-lambda-architecture-response-latency) for information surrounding expected processing time for basic requests of various sizes. +#### Amazon DynamoDB @@ -68 +97 @@ The default architecture limits response sizes to a maximum of 6 MB. The Object -#### Updating an existing deployment +Stores configuration data including transformation policies, origin definitions, and mapping rules. DynamoDB provides fast, predictable performance with seamless scalability for configuration lookups. @@ -70 +99 @@ The default architecture limits response sizes to a maximum of 6 MB. The Object -Updating an existing default deployment to a deployment using the S3 Object Lambda architecture will result in a new CloudFront distribution, with a new API endpoint and an empty cache. You will need to update references to this endpoint in your application to ensure functionality. For information on a workaround to use an alternate architecture type while maintaining the current endpoint URL and cache, refer to the instructions on [maintaining the existing endpoint and cache when modifying architecture type](./update-the-solution.html#maintain-endpoint-cache-architecture). +#### Amazon Cognito @@ -72 +101 @@ Updating an existing default deployment to a deployment using the S3 Object Lamb -Certain response headers in deployments using the S3 Object Lambda architecture are different from those in a default deployment. Of note, the X-Amz-Apigw-Id and X-Amzn-Trace-Id headers are no longer present, and the X-Cache header will no longer return "Error from CloudFront" when the solution returns an error, rather returning whether the Error itself was a cache hit/miss. If you depend on specific response elements, the default deployment will maintain that functionality. +Provides secure authentication and authorization for the administrative interface, supporting user management, multi-factor authentication, and role-based access control. @@ -80 +109 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Concepts and definitions +Solution overview