Architecture: How GSM Infrastructure Fits Together on AWS

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ti-infinite/GSMInfrastructure/llms.txt

Use this file to discover all available pages before exploring further.

​

Frontend layer

• Origin Access Control (OAC) — named {env}-{appName}-oac, configured with SigningBehavior: always and SigningProtocol: sigv4. The bucket policy allows s3:GetObject only when the request’s AWS:SourceArn matches the distribution ARN, so the bucket is never publicly reachable.
• S3 origin path — CloudFront requests assets from the /admin prefix of the bucket.
• SPA router CloudFront Function — a lightweight cloudfront-js-2.0 function named {env}-{appName}-spa-router intercepts every viewer request. If the last URL segment does not contain a . (i.e., it is an extensionless route like /dashboard), the function rewrites request.uri to /index.html, enabling client-side routing without server redirects.

function handler(event) {
    var request = event.request;
    var lastSegment = request.uri.split('/').pop();
    if (!lastSegment.includes('.')) {
        request.uri = '/index.html';
    }
    return request;
}

• Viewer protocol policy — redirect-to-https on the default cache behavior (S3 origin).
• Price class — PriceClass_100 (North America and Europe edge locations only).
• Default root object — index.html.

​

Backend layer

#!/bin/bash
mkdir -p /etc/ecs
echo ECS_CLUSTER=${Environment}-${AppName}-cluster > /etc/ecs/ecs.config

systemctl enable docker
systemctl start docker
systemctl enable ecs
systemctl daemon-reload
systemctl start ecs

​

Microservices

​

Secrets management

Secrets:
  - Name: JWT_SECRET
    ValueFrom: !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${JWTSecretParameterName}'
  - Name: DB_MASTER_URL
    ValueFrom: !Sub 'arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/${DBMasterUrlParameterName}'

​

Networking

Browser
  │
  ├─ GET /api/*  ──▶ CloudFront cache behavior (AllowedMethods: all, TTL: 0)
  │                        │
  │                        └─▶ EC2 origin (HTTP port 80) ──▶ gsmgateway container
  │
  └─ GET /*      ──▶ CloudFront default behavior (GET/HEAD/OPTIONS, redirect-to-https)
                           │
                           └─▶ S3 origin (OAC, /admin path)

​

CI/CD authentication

ThumbprintList:
  - 6938fd4d98bab03faadb97b34396831e3780aea1
  - 1c58a3a8518e8759bf075b76b750d4f2df264fcd

• token.actions.githubusercontent.com:aud equals sts.amazonaws.com
• token.actions.githubusercontent.com:sub matches one of:
  • repo:{GitHubOrg}/{GitHubRepo}:ref:refs/heads/{GitHubBranch}
  • repo:{GitHubOrg}/{GitHubRepo}:environment:infra-*
  • repo:{GitHubOrg}/{GitHubRepo}:environment:backend-*
  • repo:{GitHubOrg}/{GitHubRepo}:environment:frontend-*

permissions:
  id-token: write   # required to request the OIDC JWT
  contents: read

steps:
  - name: Configure AWS credentials
    uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: ${{ secrets.AWS_INFRA_ROLE_ARN }}
      aws-region: us-east-1

​

Cost controls

​

AWS Budget

NotificationsWithSubscribers:
  - Notification:
      NotificationType: ACTUAL
      ComparisonOperator: GREATER_THAN
      Threshold: 100
      ThresholdType: PERCENTAGE
    Subscribers:
      - SubscriptionType: SNS
        Address: !Ref NotificationSNSTopic

​

EventBridge Scheduler + Lambda

1. Scale all four ECS services to desiredCount=0
2. Sleep 10 seconds to let the ECS agent process the scale-down
3. Disassociate the EIP (prevents charges for idle Elastic IPs)
4. Stop the EC2 instance

1. Start the EC2 instance
2. Wait for the instance_running waiter (polling every 10 s, up to 30 attempts)
3. Reassociate the EIP to the instance
4. Sleep 30 seconds for the ECS agent to register with the cluster
5. Scale all four ECS services to desiredCount=1