AWS solutions documentation change
Summary
Removed detailed architecture diagrams and descriptions of Lambda/ECS implementations, simplified content structure by removing component breakdowns and security implementation details
Security assessment
The removed content included security-related implementation details (API Gateway authorization, Secrets Manager integration, Cognito authentication) but the deletion appears to be part of general content simplification rather than addressing a specific security vulnerability. No new security documentation was added.
Diff
diff --git a/solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md b/solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md index 31382f33c..7f72b2e2a 100644 --- a//solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md +++ b//solutions/latest/dynamic-image-transformation-for-amazon-cloudfront/architecture-overview.md @@ -5,2 +4,0 @@ -Architecture diagrams - @@ -11,2 +8,0 @@ This section provides a reference implementation architecture diagram for the co -## Architecture diagrams - @@ -15,88 +10,0 @@ This solution provides two architecture options, each optimized for different us -### Lambda Architecture - -This cost-optimized serverless architecture is suitable for most image transformation workloads with images up to 6 MB. - -###### Important - -This solution is intended for customers with public applications who want to provide an option to dynamically change or manipulate their public images. Because of these public requirements, this template creates a publicly accessible, unauthenticated CloudFront distribution and [Amazon API Gateway](https://aws.amazon.com/api-gateway/) endpoint in your account, allowing anyone to access it. For more information on API Gateway authorization, refer to the [Security](./security.html) section. This solution supports signing requests, which can serve to restrict unauthorized requests, for more information, refer to the [Image URL Signature section](./.html#image-url-signature). - -**Lambda architecture for cost-optimized image processing** - - - -###### Note - -AWS CloudFormation resources are created from [AWS Cloud Development Kit](https://aws.amazon.com/cdk/) (AWS CDK) constructs. - -The high-level process flow for the Lambda architecture is as follows: - - 1. An [Amazon CloudFront](https://aws.amazon.com/cloudfront/) distribution provides a caching layer to reduce the cost of image processing and the latency of subsequent image delivery. - - 2. [Amazon API Gateway](https://aws.amazon.com/api-gateway/) provides endpoint resources and initiates the [AWS Lambda](https://aws.amazon.com/lambda/) function. - - 3. A Lambda function retrieves the image from a customer’s existing [Amazon S3](https://aws.amazon.com/s3/) bucket and uses `sharp` to return a modified version of the image to the API Gateway. - - 4. A solution-created S3 bucket provides log storage, separate from your customer-created S3 bucket for storing images. - - 5. (Optional) If you enter `Yes` for the **Enable Signature** template parameter, the Lambda function retrieves the secret value from your existing [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) secret to validate the signature. - - 6. (Optional) If you use the smart crop or content moderation features, the Lambda function calls [Amazon Rekognition](https://aws.amazon.com/rekognition/) to analyze your image and returns the results. - - 7. The viewer request is proxied through an Amazon CloudFront function to normalize headers and query parameters for improved cache hit rates. - - - - -### ECS Architecture - -This high-performance container-based architecture supports images up to 100 MB and includes all advanced v8.0.0 features including transformation policies, non-S3 origin support, and administrative interface. - -**ECS architecture for high-performance image processing** - - - -The high-level process flow for the ECS architecture is as follows: - - 1. An Amazon CloudFront distribution provides global caching and content delivery. - - 2. An [Application Load Balancer](https://aws.amazon.com/elasticloadbalancing/application-load-balancer/) (ALB) distributes incoming requests across multiple ECS tasks for high availability and scalability. - - 3. [Amazon Elastic Container Service](https://aws.amazon.com/ecs/) (ECS) tasks running on [AWS Fargate](https://aws.amazon.com/fargate/) process image transformation requests using containerized applications. - - 4. ECS tasks maintain in-memory caches of transformation policies and origin mappings for fast request resolution and reduced latency. - - 5. Images are retrieved from multiple origin types: Amazon S3 buckets or external HTTP-accessible domains based on configured origin mappings. - - 6. An administrative interface built with [AWS Amplify](https://aws.amazon.com/amplify/) provides policy and origin management capabilities through a secure web interface. - - 7. [Amazon DynamoDB](https://aws.amazon.com/dynamodb/) stores transformation policies, origin configurations, and mapping rules with high availability and performance. - - 8. [Amazon Cognito](https://aws.amazon.com/cognito/) provides authentication and authorization for the administrative interface. - - 9. (Optional) Amazon Rekognition integration for smart cropping and content moderation features. - - - - -### Component descriptions - -#### Application Load Balancer (ALB) - -Distributes incoming image transformation requests across multiple ECS tasks, providing high availability and automatic scaling capabilities. The ALB performs health checks on ECS tasks and routes traffic only to healthy instances. - -#### Amazon ECS with AWS Fargate - -Runs containerized image processing applications without managing servers. ECS tasks automatically scale based on demand and maintain in-memory caches for optimal performance. Fargate provides serverless compute for containers, eliminating the need to provision and manage EC2 instances. - -#### Administrative Interface - -A web-based management console built with AWS Amplify that allows administrators to configure and manage image origins (both S3 and external sources), create and edit transformation policies, set up origin mappings using path-based and host-header routing, monitor system performance and usage metrics, and test configurations before deployment to ensure proper functionality. - -#### Amazon DynamoDB - -Stores configuration data including transformation policies, origin definitions, and mapping rules. DynamoDB provides fast, predictable performance with seamless scalability for configuration lookups. - -#### Amazon Cognito - -Provides secure authentication and authorization for the administrative interface, supporting user management, multi-factor authentication, and role-based access control. - @@ -109 +17 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Solution overview +Concepts and definitions @@ -111 +19 @@ Solution overview -Architecture details +Lambda Architecture