Serverless site with login and API

Comments

• API Gateway can validate the JWT with a Cognito authorizer, so Lambda does not need to verify the token signature.
• Amplify Hosting uses its own distribution layer, which is why the diagram does not include CloudFront.
• DynamoDB charges per read and write (or per provisioned capacity). Design the partition key around your most frequent access patterns.
• The diagram shows login as a step in the flow. For an internal app, disable public sign-up in the Cognito user pool.

Information flow

1. AWS Amplify Hosting

   The user loads the HTML and JavaScript site from Amplify Hosting.

2. Amazon Cognito

   The user signs in with Cognito and receives a JWT token.

3. Amazon API Gateway

   The browser's JavaScript calls API Gateway, sending the token.

4. Amazon API Gateway

   API Gateway validates the token and, if it is valid, invokes the matching Lambda function.

5. AWS Lambda + Amazon DynamoDB

   Lambda reads or writes DynamoDB, builds the response and returns it through API Gateway.