AWS Task Manager
A serverless MVP, from infrastructure to deployment.
- Problem
- Build a task manager with managed AWS services and repeatable deployments.
- My role
- Application development, AWS architecture, Terraform, and CI/CD.
- Result
- Completed an individual-use MVP with accounts, project ownership checks, and persistent tasks.
The live application starts with account creation. Explore the architecture and delivery walkthrough below without signing in.
Own the full delivery path.
Build a small task manager with managed AWS services and repeatable deployments. My focus: practical cloud architecture, secure access, and infrastructure I could provision and maintain myself.
What the platform delivers.
Accounts
Cognito sign-up, email verification, sign-in, sign-out, and password recovery.
Projects & milestones
Create, rename, and delete projects and their milestones.
Tasks & persistence
Create, rename, complete, reopen, and delete tasks in the app. Task changes update milestone completion in the backend.
Ownership & deletion
Server-side ownership checks protect projects; deletion also removes child records.
Verified by 42 automated Vitest checks across the React frontend, Node.js 22 Lambda handlers, and Terraform configuration.
A small serverless architecture.
Static frontend, on-demand API, managed identity and storage.
HTTPS · Origin Access Control
Amplify · JWT validation
Ownership checks · Projects → milestones → tasks
One request, end to end
The browser sends a Cognito access token. API Gateway validates it; Lambda checks project ownership and milestone membership before reading tasks from DynamoDB.
Four decisions that shaped the system.
Private frontend delivery
Serve the React frontend through CloudFront while keeping S3 private. Origin Access Control restricts reads to the distribution; HTTPS and compression support delivery.
infra/app/cloudfront.tfIdentity and ownership
Cognito manages accounts; API Gateway validates access tokens. Lambda then checks project ownership before allowing milestone or task access.
backend/src/tasks.tsHierarchy-based data model
DynamoDB keys follow users, projects, milestones, and tasks. Conditional writes protect changes, and explicit child deletion handles the hierarchy.
backend/src/projects.tsSeparate Terraform state
Bootstrap manages deployment access and the protected state bucket. App resources use a separate S3 state key, with locking and bucket versioning.
infra/bootstrap/README.mdA repeatable release workflow.
Frontend and backend CI lint, test, and build changes. Releases run manually from main:
Build the backend
Compile and bundle the Node.js Lambda handlers.
Assume the AWS role
GitHub OIDC provides temporary credentials, restricted to this repository’s main branch.
Apply Terraform
Provision resources and pass the API and Cognito outputs to the frontend build.
Publish the frontend
Build with Vite, sync to S3, and invalidate CloudFront.
Vitest coverage includes API ownership, validation, task operations, pagination, and frontend authentication flows. CI also checks Terraform formatting, validation, and tests.
Read the deployment workflowCosts and compromises.
Serverless keeps operations small. The choices have clear limits:
| Choice | Benefit | Trade-off |
|---|---|---|
| S3 + CloudFront | No frontend server. | SSR needs another service. |
| Lambda | On-demand compute. | Cold-start latency. |
| API Gateway HTTP API | Lower-cost API option. | No built-in API caching or per-client usage plans. |
| DynamoDB on-demand | No capacity planning. | Usage-based costs; less query flexibility than SQL. |
| Cognito | Managed account security. | Cognito feature limits. |
| One backend region | Simpler deployment. | No regional failover. |
Cost awareness
DynamoDB on-demand reads and writes fall outside the free provisioned-capacity allowance. API Gateway is billed separately. Actual costs depend on usage and account credits.
Next: shared projects.
I’m extending the individual-use MVP toward collaboration. The next phase focuses on project membership, clear editing permissions, and predictable behavior when multiple people update shared work.
Inspect the implementation.
React screens and Cognito authentication.
Ownership checks and DynamoDB operations.
AWS services defined in Terraform.
OIDC access and Terraform state.
Checks and the release workflow.
Project notes
Source reviewed October 15, 2026 · commit d8b6490.
Let’s talk engineering
Have a role or project in mind?
I’m available for remote software & cloud engineering roles and B2B contracts.
Email me View résumé ↗Explore another project
Commercial client delivery: Barnicoat CRM →