GitHub Repository: aws_employee_management_project

This project is a serverless employee management application for authenticated users. It provides a browser-based interface for creating, viewing, updating, searching, and deleting employee records without managing traditional application servers.

flowchart TD
  User[Authenticated user] --> CloudFront[Amazon CloudFront]
  CloudFront --> S3[Amazon S3 frontend]
  User --> Cognito[Amazon Cognito]
  Cognito --> API[Amazon API Gateway]
  API --> Lambda[AWS Lambda CRUD functions]
  Lambda --> DynamoDB[Amazon DynamoDB Employees table]
  Lambda --> Logs[Amazon CloudWatch]
  Logs --> Alarms[CloudWatch alarms]
  Alarms --> SNS[Amazon SNS notifications]
							

What I built

The frontend is a static HTML, CSS, and JavaScript application hosted in Amazon S3 and delivered globally through CloudFront over HTTPS. Amazon Cognito provides user authentication, while API Gateway protects the application API and routes requests to dedicated Lambda functions.

• Create: add a new employee record and generate a unique employee ID
• Read: list employees or retrieve one employee by ID
• Update: change employee details such as department, designation, or joining date
• Delete: remove an employee record by its exact ID

Request flow

Authenticated browser → API Gateway → Lambda → DynamoDB

API Gateway exposes REST-style routes under /employees and /employees/{id}. Each operation has its own Python 3.12 Lambda function: list, create, get, update, and delete. Lambda validates request data, performs the corresponding DynamoDB operation, and returns an appropriate API response.

First-time access

If the application opens a login page, select the option to create an account. Use an email address you can access because Amazon Cognito sends a one-time verification code during account creation. If the code does not appear in your inbox, check your Spam or Junk folder. Complete verification, then return to the login page and sign in with the new account.

Data and security design

Employee records use employeeId as the DynamoDB partition key, with fields for name, email, department, designation, and joining date. DynamoDB encryption at rest protects stored records.

• Amazon Cognito authenticates users before they call protected CRUD routes.
• Each Lambda function uses an IAM role limited to the DynamoDB action it needs.
• CloudFront provides HTTPS delivery for the frontend.
• CORS is configured for browser requests while leaving preflight requests unauthenticated.
• No AWS credentials are embedded in the frontend source.

Observability

CloudWatch collects Lambda logs and API metrics such as request volume, latency, and failures. CloudWatch alarms can notify an SNS topic when operational thresholds are exceeded, giving the application a clear path from request handling to alerting.

Core technologies

• Amazon S3 and CloudFront
• Amazon Cognito
• Amazon API Gateway
• AWS Lambda with Python
• Amazon DynamoDB
• IAM, CloudWatch, and SNS

Why this project matters

This project extends the serverless patterns from my Cloud Resume Challenge into a practical internal business application. It brings together authentication, API design, least-privilege access, encrypted persistence, static hosting, and operational monitoring in one deployable workflow.

The main lesson is that a useful business application does not require a continuously running server. Managed AWS services can provide the delivery, identity, compute, storage, and visibility while keeping the application architecture focused and scalable.