Why I built it this way

This portfolio uses a low-cost, serverless AWS architecture. Amplify hosts the Next.js application, Route 53 manages the custom domain, IAM controls secure service access, DynamoDB stores usage and chat state, SES handles contact-form email, Auth.js provides Google/Microsoft OAuth for the Recruiter Concierge, and OpenAI powers resume answers through server-side APIs.

Security decisions

• AI chat requires Google or Microsoft OAuth via Auth.js.
• Usage is tracked with a pseudonymous hashed provider subject id.
• Message limits are enforced server-side in DynamoDB.
• Clearing chat deletes history only, not the usage limit.
• AWS keys and OpenAI keys are never exposed to the browser.
• Amplify uses an IAM Compute Role to access DynamoDB and SES.
• SES is used for contact notifications only — not chatbot auth.

Cost-conscious design

• Amplify removes the need for EC2 or load balancers.
• DynamoDB on-demand keeps database cost low for small traffic.
• SES charges only for contact emails sent.
• DynamoDB TTL automatically expires temporary records.
• No Redis, DAX, DocumentDB, WAF, or always-on backend is used.

What this demonstrates

• Serverless architecture design
• AWS IAM and secure runtime permissions
• OAuth-based recruiter access control
• DynamoDB single-table modeling
• Transactional contact email using SES
• Next.js full-stack API routes
• CloudWatch-based production debugging
• Cost-aware engineering decisions