Webalways-on
Modern Web Application
Alpenglow Permits: a citizen permit portal with real sign-up, role-based access (guest / resident / staff),
document uploads straight to S3, printable permit certificates with QR field verification, a full
inspection workflow through close-out, in-app notifications, an open register of decisions with CSV
export, bilingual EN/ES chrome, WCAG 2.1 AA accessibility, transparency dashboards, and a nightly
self-reset.
S3 · CloudFront · Cognito · API Gateway · Lambda · DynamoDB
Containersalways-on
Containers (scale-to-zero)
Press a button and a real Docker container launches on ECS Fargate just for you: live logs, a
cold-start anatomy waterfall, and an itemized cost ticket with the meter running. Race two ovens
(¼ vs 1 vCPU) or two images (slim vs heavy), tour a failure museum with a real OOM kill and both
SIGTERM endings, and pull a batch early with a genuine StopTask. No idle compute, ever.
ECS Fargate · ECR · CodeBuild · EventBridge Scheduler · Lambda · DynamoDB
Foundation Modelsalways-on
Model Workbench
One prompt, four foundation models from four vendors (Anthropic, Amazon, Meta, Mistral)
side by side through the single Bedrock Converse API, with measured latency, tokens, and cost per
answer, a blind rubric judge scoring every comparison, a switchable PII-masking guardrail, a
public 30-day latency and cost record, and an audit ledger of every run.
Try it without signing in: 5 free scenario runs a day.
Bedrock Converse · Lambda · Cognito · DynamoDB
APIalways-on
API & Microservices
A documented public REST API with real governance: v1 endpoints that answer with honest
Deprecation/Sunset headers, API keys on throttled+quota'd usage plans, and request bodies
schema-validated by the gateway itself. Mint yourself a real personal API key, retry a POST
safely with an Idempotency-Key, and order an async catalog export (202 → SQS worker → presigned
download). Docs render live from the same OpenAPI spec that deploys the gateway.
API Gateway (REST) · Lambda · DynamoDB · SQS · S3 · CloudFront
Networkon-demand
Network Architecture
A textbook multi-AZ VPC, proven live: tiered subnets, security-group layering, NACLs, gateway
endpoints (the no-NAT cost pattern), and flow logs, every reachable and unreachable path
verified by Reachability Analyzer and probes run on the instances. While a window is open, send
the inspector on a live round and watch the probes walk the site; the evidence report stays up
in between.
VPC · Reachability Analyzer · PrivateLink · SSM · Flow Logs
Generative AIalways-on
Generative AI (RAG)
A retrieval-augmented assistant over a swappable document corpus: citation-grounded answers, prompt
guardrails, audit logs, and hard daily cost caps. Try it free: 5 curated questions a day with no
sign-in, every answer showing its retrieval trace, its sources in the browsable reading room, and
what it cost to generate.
Bedrock · Lambda · API Gateway · S3 · DynamoDB · Cognito
Eventsalways-on
Event-Driven & Messaging
A live event mesh you can poke: submit a 311-style request and watch it fan out through EventBridge
rules to department queues, SNS pub/sub, and a Step Functions escalation, traced hop by hop. Test your
own routing patterns against the real matcher, race a standard queue against a FIFO queue (with a
duplicate absorbed on camera), read the dead-letter evidence before you redrive it, and replay the
2-day event archive back through the mesh.
EventBridge · SQS · SNS · Step Functions · Lambda · DynamoDB
Dataalways-on
Data Lake & Analytics
A serverless lake over 3.1M real Colorado business registrations: raw JSONL and curated partitioned
Parquet zones, a Glue catalog, and live Athena SQL you can run yourself, with Athena's own
bytes-scanned and cost numbers, a raw-vs-curated race, and a static BI dashboard. Search any
business name (safely parameterized), watch the engine's stage-by-stage account with
partition-pruning bands drawn to scale, read the state as a bathymetric depth chart, and
time-travel an Apache Iceberg table across the two snapshots its ACID cleanup left behind.
S3 · Glue · Athena · Iceberg · Parquet · Lambda · DynamoDB
DevOps & SREalways-on
DevOps & SRE
The meta-environment that ships the others: GitHub Actions with OIDC (no stored keys), Terraform plan/apply
gates, Checkov + Trivy scanning on every PR, and levers you can pull: run the timed backup/restore drill and
watch it live, sweep every site on the boardwalk, read the CI log, and see the whole portfolio's real
month-to-date bill.
GitHub Actions · Terraform · CloudWatch · X-Ray · Step Functions · Cost Explorer
Documentsalways-on
Intelligent Document Processing
Drop any PDF or image: Textract OCR with the extraction geometry drawn on the rendered page,
Comprehend PII mapped into a live redaction exhibit, Textract Queries answering plain-language
questions, a search across every OCR'd word that highlights hits on the page, review triage,
and an itemized cost receipt per document. Try it anonymously: 5 private uploads a day, no
sign-in.
Textract · Comprehend · Bedrock · Step Functions · DynamoDB
Securityon-demand
Security & Governance
The deploy-demo-teardown plank: GuardDuty, Security Hub, a NIST 800-53 rev 5 Config conformance
pack, KMS-encrypted CloudTrail, and a permission-boundary proof. Light a safe practice smoke and
watch an event-driven tripwire remediate it live; lint policies at the always-on desk; read the
shared WAF's fence log of real blocked traffic. The findings-to-evidence report stays up in between.
GuardDuty · Security Hub · Config · CloudTrail · WAF · IAM · Lambda
Databaseon-demand
Relational Registry
Aurora Serverless v2 PostgreSQL that genuinely scales to zero, reached only through the RDS
Data API: no NAT, no open database port. A live seal watch counts down to the auto-pause and
files every measured wake; exhibits cover a trigger-kept chain of title, an injection-proof
parameterized search, a real deadlock with one victim, row-level security district desks,
engine-enforced constraints, EXPLAIN plans, and checksummed migrations. Deploys on demand;
the evidence report stays up in between.
Aurora Serverless v2 · RDS Data API · Secrets Manager · Lambda
