@actuate-media/platform-aws

AWS platform adapter for Actuate CMS. This package provides the same PlatformAdapters interface as @actuate-media/platform-vercel but backed by AWS-native services.

Status: Not yet implemented. Planned for Phase 4.

Service Mapping

| Adapter | Vercel Service | AWS Service | Key Differences | | --- | --- | --- | --- | | Database | Neon serverless | RDS PostgreSQL / Aurora | Standard connection pool via pg. IAM role-based authentication instead of connection string tokens. Use RDS Proxy for connection pooling in Lambda environments. | | Storage | Vercel Blob | S3 + CloudFront | OAC (Origin Access Control) ensures S3 objects are only accessible via CloudFront. Presigned URLs for uploads. No egress cost from S3 to CloudFront within the same region. | | Cache | Next.js revalidateTag | ElastiCache Redis | Tag-based invalidation via Redis sets. Store tag → key mappings, then pipeline-delete all keys for a given tag. Use UNLINK for non-blocking removal. | | Email | Resend | SES | Direct integration via @aws-sdk/client-ses. Requires domain verification in SES console and production access request to move out of sandbox mode. | | Scheduler | Vercel Cron Jobs | EventBridge Scheduler → Lambda | Programmatic schedule creation via @aws-sdk/client-scheduler. Each schedule targets a Lambda function with a JSON payload. Supports flexible time windows, retry policies, and one-time schedules. | | Rate Limiter | Upstash Redis | ElastiCache Redis | Sliding window implementation using Redis MULTI/EXEC with sorted sets. ZADD with timestamp scores, ZREMRANGEBYSCORE to prune expired entries, ZCARD to count within the current window. |

Deployment Strategy

ECS/Fargate (Recommended for Next.js)

• Container-based deployment using the Next.js standalone output mode.
• ALB (Application Load Balancer) in front of Fargate tasks for HTTPS termination.
• Auto-scaling based on CPU/memory utilization or request count.
• Suitable for long-running processes, WebSocket connections, and ISR revalidation.

Lambda@Edge / Lambda (Alternative)

• Use OpenNext or SST to deploy Next.js on Lambda + CloudFront.
• Better for low-traffic or bursty workloads with pay-per-invocation pricing.
• Cold start latency is a consideration for latency-sensitive pages.
• Lambda functions have a 15-minute execution timeout.

Database Migration Notes

• Replace @neondatabase/serverless with the standard pg package.
• Use RDS_HOSTNAME, RDS_PORT, RDS_DB_NAME environment variables instead of DATABASE_URL.
• For Lambda deployments, use RDS Proxy to avoid connection exhaustion.
• IAM database authentication eliminates the need for stored passwords:

  RDS_AUTH_METHOD=iam
  RDS_ROLE_ARN=arn:aws:iam::123456789012:role/actuate-rds-access

• Aurora Serverless v2 provides automatic scaling for unpredictable workloads.

Environment Variable Mapping

| Vercel Env Var | AWS Equivalent | Notes | | --- | --- | --- | | DATABASE_URL | RDS_HOSTNAME + RDS_PORT + RDS_DB_NAME | Constructed as postgresql://user:pass@host:port/db or use IAM auth token | | BLOB_READ_WRITE_TOKEN | AWS_S3_BUCKET + IAM role | No token needed; IAM role grants access | | UPSTASH_REDIS_REST_URL | ELASTICACHE_ENDPOINT | Direct Redis protocol, not REST | | UPSTASH_REDIS_REST_TOKEN | N/A | IAM auth or VPC-internal access (no token) | | RESEND_API_KEY | AWS_SES_REGION | SES uses IAM permissions, not API keys | | CRON_SECRET | N/A | EventBridge invokes Lambda directly via IAM |

CDN Configuration

CloudFront Distribution

• Create a CloudFront distribution with two origins:
  1. Application origin — ALB or API Gateway pointing to the Next.js app.
  2. Static assets origin — S3 bucket for _next/static and uploaded media.
• Use Origin Access Control (OAC) for the S3 origin to prevent direct S3 access.
• Configure cache behaviors:
  • /_next/static/* → S3 origin, long TTL (immutable assets).
  • /media/* → S3 origin, moderate TTL with tag-based invalidation.
  • /* (default) → Application origin, respect Cache-Control headers.
• Enable automatic compression (gzip + Brotli).
• Use Lambda@Edge or CloudFront Functions for header manipulation (security headers, redirects).

Cache Invalidation

• CloudFront supports path-based invalidation (/blog/*) and wildcard patterns.
• For tag-based invalidation, maintain a mapping in ElastiCache Redis:
  • On content update, look up affected paths from the tag mapping.
  • Issue CloudFront invalidation for those paths.
  • Free tier includes 1,000 invalidation paths/month.