View a markdown version of this page

AWS services used in ECS architecture - Dynamic Image Transformation for Amazon CloudFront

AWS services used in ECS architecture

AWS service Description

Compute & Serverless

AWS Lambda

Management API handlers, configuration redeployment triggers, and custom resources

Amazon Rekognition

Content-aware smart cropping (face, label, custom label, text, and logo detection) and content moderation (v8.1+)

API & Networking

Amazon API Gateway

REST API for the management API (Admin UI CRUD operations on origins, mappings, and transformation policies)

Amazon CloudFront

CDN for content delivery and caching

Elastic Load Balancing

Application Load Balancer that distributes image transformation requests across ECS tasks

Storage

Amazon S3

Source image storage, transformed image cache

Database

Amazon DynamoDB

Storing transformation policies, mappings, and origins; caching Amazon Rekognition detection results (a dedicated RekognitionCacheTable resource, v8.1+)

Authentication & Authorization

Amazon Cognito

User authentication for admin UI

AWS IAM

Roles, policies, and permissions

Monitoring & Logging

Amazon CloudWatch

Supporting service for metrics, dashboards, alarms, and log management

Container Services (ECS Architecture)

Amazon ECS

Container orchestration for image processor

Amazon ECR

Container image registry

Amazon EC2

VPC, subnets, security groups for ECS

Automation & Events

Amazon EventBridge

Event-driven automation

AWS Application Auto Scaling

ECS task auto-scaling

Security & Encryption

AWS KMS

Encryption key management

AWS Secrets Manager

Stores the secret used to derive the encryption key for the management API’s encrypted pagination tokens (v8.1+)

Deployment & Management

AWS CloudFormation

Infrastructure as code

AWS CDK

Infrastructure definition framework

Important

Configuration Delay and Cached Images

Changes to origins, transformation policies, or mappings may take up to 5 minutes to propagate across all image processing tasks. During this period, some requests may still use the previous configuration. Configuration updates do not automatically refresh cached images. Cached images processed with previous settings will remain available until they expire or are manually invalidated.