Amazon S3
Event notifications
S3 Event Notifications are designed for at-least-once delivery. Duplicate or out-of-order notifications are possible, which is why the workflow uses deterministic identity and conditional writes.
Read AWS documentationEvent processing and metadata
The core workflow depends on S3 notification behavior and object metadata APIs.
Amazon S3 API
HeadObject
HeadObject returns object metadata without returning the object body. The Lambda function uses it to inspect headers without downloading the complete file.
AWS SAM
S3 event source
The SAM template connects the upload bucket to the Lambda function through an S3 event and limits processing to the configured key prefix.
Read AWS SAM referenceRetries, failure handling, and idempotency
The workflow allows Lambda to retry transient failures while preventing duplicate DynamoDB records.
AWS Lambda
Asynchronous error handling
Lambda retries asynchronous failures and supports limits for event age and retry attempts. The public template configures a one-hour maximum event age and two retries.
Read AWS documentationAWS Lambda
Failure destinations
Failed asynchronous invocation records can be sent to an SQS destination after retries are exhausted. The project uses an encrypted failure queue.
Read AWS documentationAmazon DynamoDB
Conditional writes
attribute_not_exists(RecordId) prevents an existing item with the same primary key from being overwritten, making repeated event delivery safe.
Security, monitoring, and retention
The infrastructure template includes explicit controls for public access, encryption, alarms, and retained data.
Amazon S3
Block Public Access
The upload bucket enables all four Block Public Access settings and uses bucket-owner-enforced object ownership with ACLs disabled.
Read AWS documentationAmazon CloudWatch
Metric alarms
CloudWatch alarms monitor Lambda errors, throttles, and the number of visible messages in the SQS failure queue.
Read AWS documentationAWS CloudFormation
Retained resources
DeletionPolicy: Retain keeps the upload bucket and DynamoDB table when the stack is deleted, so cleanup must be intentional.
Compare the references with the implementation
The source repository shows how these documented service behaviors are handled in code and infrastructure.