@prenta/platform-aws

AWS platform adapter for Prenta CMS. This package provides the same PlatformAdapters interface as @prenta/platform-vercel but backed by AWS-native services.

Status: Available. S3 storage, RDS (Postgres), ElastiCache (Redis) cache + rate limiting, SES email, and EventBridge scheduling are implemented.

Usage

For most projects you don't call this package directly — scaffold with --platform aws and prenta.config.ts uses the client-safe shorthand storage: { provider: 's3' }, which Prenta auto-wires to this package's S3 adapter server-side (credentials come from the task/instance IAM role).

To compose the full platform explicitly (e.g. in a custom API bootstrap):

import { aws } from '@prenta/platform-aws'

const platform = aws({
  storage: { bucket: process.env.AWS_S3_BUCKET, region: process.env.AWS_REGION },
  // database / cache / email / scheduler / rateLimit accept per-adapter options;
  // all resolve from env + the IAM role by default.
})

Every AWS SDK is an optional peer dependency, dynamically imported on first use — installing this package pulls in nothing until an adapter runs. Install only what you use (e.g. @aws-sdk/client-s3 + @aws-sdk/s3-request-presigner for storage, pg for RDS, ioredis for ElastiCache, @aws-sdk/client-ses for email).

Service Mapping

| Adapter | Vercel Service | AWS Service | Key Differences | | ------------ | ----------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Database | Neon serverless | RDS PostgreSQL / Aurora | Standard connection pool via pg. IAM role-based authentication instead of connection string tokens. Use RDS Proxy for connection pooling in Lambda environments. | | Storage | Vercel Blob | S3 + CloudFront | OAC (Origin Access Control) ensures S3 objects are only accessible via CloudFront. Presigned URLs for uploads. No egress cost from S3 to CloudFront within the same region. | | Cache | Next.js revalidateTag | ElastiCache Redis | Tag-based invalidation via Redis sets. Store tag → key mappings, then pipeline-delete all keys for a given tag. Use UNLINK for non-blocking removal. | | Email | Resend | SES | Direct integration via @aws-sdk/client-ses. Requires domain verification in SES console and production access request to move out of sandbox mode. | | Scheduler | Vercel Cron Jobs | EventBridge Scheduler → Lambda | Programmatic schedule creation via @aws-sdk/client-scheduler. Each schedule targets a Lambda function with a JSON payload. Supports flexible time windows, retry policies, and one-time schedules. | | Rate Limiter | Upstash Redis | ElastiCache Redis | Sliding window implementation using Redis MULTI/EXEC with sorted sets. ZADD with timestamp scores, ZREMRANGEBYSCORE to prune expired entries, ZCARD to count within the current window. |

Deployment Strategy

ECS/Fargate (Recommended for Next.js)

• Container-based deployment using the Next.js standalone output mode.
• ALB (Application Load Balancer) in front of Fargate tasks for HTTPS termination.
• Auto-scaling based on CPU/memory utilization or request count.
• Suitable for long-running processes, WebSocket connections, and ISR revalidation.

Lambda@Edge / Lambda (Alternative)

• Use OpenNext or SST to deploy Next.js on Lambda + CloudFront.
• Better for low-traffic or bursty workloads with pay-per-invocation pricing.
• Cold start latency is a consideration for latency-sensitive pages.
• Lambda functions have a 15-minute execution timeout.

Database Migration Notes

• Replace @neondatabase/serverless with the standard pg package.
• Use RDS_HOSTNAME, RDS_PORT, RDS_DB_NAME environment variables instead of DATABASE_URL.
• For Lambda deployments, use RDS Proxy to avoid connection exhaustion.
• IAM database authentication eliminates the need for stored passwords:

  RDS_AUTH_METHOD=iam
  RDS_ROLE_ARN=arn:aws:iam::123456789012:role/prenta-rds-access

• Aurora Serverless v2 provides automatic scaling for unpredictable workloads.

Environment Variable Mapping

| Vercel Env Var | AWS Equivalent | Notes | | -------------------------- | ------------------------------------------- | -------------------------------------------------------------------------- | | DATABASE_URL | RDS_HOSTNAME + RDS_PORT + RDS_DB_NAME | Constructed as postgresql://user:pass@host:port/db or use IAM auth token | | BLOB_READ_WRITE_TOKEN | AWS_S3_BUCKET + IAM role | No token needed; IAM role grants access | | UPSTASH_REDIS_REST_URL | ELASTICACHE_ENDPOINT | Direct Redis protocol, not REST | | UPSTASH_REDIS_REST_TOKEN | N/A | IAM auth or VPC-internal access (no token) | | RESEND_API_KEY | AWS_SES_REGION | SES uses IAM permissions, not API keys | | CRON_SECRET | N/A | EventBridge invokes Lambda directly via IAM |

CDN Configuration

CloudFront Distribution

• Create a CloudFront distribution with two origins:
  1. Application origin — ALB or API Gateway pointing to the Next.js app.
  2. Static assets origin — S3 bucket for _next/static and uploaded media.
• Use Origin Access Control (OAC) for the S3 origin to prevent direct S3 access.
• Configure cache behaviors:
  • /_next/static/* → S3 origin, long TTL (immutable assets).
  • /media/* → S3 origin, moderate TTL with tag-based invalidation.
  • /* (default) → Application origin, respect Cache-Control headers.
• Enable automatic compression (gzip + Brotli).
• Use Lambda@Edge or CloudFront Functions for header manipulation (security headers, redirects).

Cache Invalidation

• CloudFront supports path-based invalidation (/blog/*) and wildcard patterns.
• For tag-based invalidation, maintain a mapping in ElastiCache Redis:
  • On content update, look up affected paths from the tag mapping.
  • Issue CloudFront invalidation for those paths.
  • Free tier includes 1,000 invalidation paths/month.