Building a Serverless, Event-Driven Blog for Pennies

In the world of cloud computing, there’s a common misconception that "enterprise-grade" architecture comes with an enterprise-grade price tag. Today, I’m pulling back the curtain on the infrastructure powering cloud-record.dev to show how you can build a high-performance, secure, and fully automated system for less than the price of a gumball.

As of this month, the total operating cost for this entire stack is just $0.14.

Here is how it works.

1. The Global Entry Point: Cloudflare & Frontend

While the core of the infrastructure lives within AWS, the journey begins at our domain registrar and DNS provider, Cloudflare. By leveraging Cloudflare for cloud-record.dev, we gain an immediate layer of DDoS protection and global edge caching before traffic even hits our origin.

Frontend Hosting (S3 + CloudFront)

The frontend is a decoupled static site (likely built with a framework like React or Next.js).

• S3 Bucket: Acts as the "Origin," storing the static HTML, CSS, and JS files.

• CloudFront: Our Content Delivery Network (CDN) that distributes the site globally.

• CloudFront Functions: We use a lightweight router function to handle URL rewrites, ensuring that pretty URLs (like /posts/my-story) map correctly to the S3 objects.

2. Secure Authentication with Amazon Cognito

Security isn't an afterthought. I use Amazon Cognito to manage user identities.

• JWT Authorization: When a user logs in, they receive a JSON Web Token (JWT).

• The Gatekeeper: This token is passed to API Gateway, which uses a native JWT Authorizer to validate the user before a single line of backend code is even executed. No valid token? No entry.

3. The Serverless Logic Layer

Our backend is entirely "Function-as-a-Service" (FaaS). I don’t manage servers; I manage logic.

• API Gateway (HTTP API): The front door for our backend, routing requests to specific Lambda functions.

• The Lambda Squad:

  • Auth Handler (Node.js): Handles post-confirmation triggers to sync user data.

  • Posts Handler (Python): Manages the CRUD (Create, Read, Update, Delete) operations for blog content.

  • Image Handler (Node.js): Generates Presigned URLs, allowing the admin user to upload images directly to S3 securely without hitting the backend with heavy binary data.

4. Reactive Data & Media Processing

This is where the architecture gets "smart."

Media Optimization

When an image is uploaded to the Media S3 Bucket, it triggers an Image Optimizer Lambda. This function automatically resizes and compresses the image, then stores the web-ready version back in S3. To prevent other sites from stealing bandwidth, a CloudFront Function provides hotlink protection on the media distribution.

The CI/CD Bridge (DynamoDB Streams)

Our blog utilizes an event-driven CI/CD pipeline:

1. A post is saved to DynamoDB.

2. DynamoDB Streams detects the change.

3. A GitHub Dispatcher Lambda is triggered.

4. It sends a signal to GitHub Actions, which kicks off a new build of the static site to reflect the new content.

5. The $0.14 Bill: Why is it so cheap?

The Breakdown

Month-to-date cost: $0.14.

Even with a 3,861% increase over last month (which was $0.00 during the build phase), the forecasted total is only $0.17.

Conclusion

Building on the cloud doesn't have to be expensive. By using an event-driven, serverless approach, cloud-record.dev stays fast, secure, and incredibly cost-efficient. We've traded "paying for uptime" for "paying for value."