A company sends confidential files to outside recipients by an expiring link, or asks an outsider to upload files to it. Recipients verify their email before they download. Every file is encrypted with KMS, scanned for malware and sensitive data before anyone can download it, and audit-logged. Click any box, step through any flow, and switch views with the tabs.
Status: this is the design. The Terraform is written and statically checked, and nothing has been applied to a real AWS account yet. Numbers marked as budgets or estimates come from the design documents and haven't been measured. Read the Architecture doc · architecture.md on GitHub ↗
The whole system
Pick a path to see how a request moves, or click a box to see what it does, how it scales and what happens when it fails.
All connections at once. Choose a path to follow one kind of work, or click a box to see only its connections.
Details
Click any box on the map to see its responsibility, how it scales, what happens when it fails and its IAM permissions.
Six ideas the design rests on
The API, the outbox relay, every worker and the lifecycle jobs come from one container image with different start commands. They share the data model and service layer: one API service plus workers, no microservice sprawl.
Every state change, its audit record and any “do this later” message are written in one transaction. The outbox relay forwards the messages to SQS, so a crash between the database write and the queue send loses nothing.
Browsers upload parts straight to S3 with pre-signed URLs. Downloads stream through the API under a session-bound grant, so the API can count downloads, check revocation every 30 s and stop a stream within 60 s.
The API's IAM role can read an object only when its scan tag says clean. Only the scan worker can set that tag, after ClamAV (or GuardDuty for files over 2 GB) and the DLP inspector have seen the bytes.
Terraform owns AWS resources. Argo CD owns what runs in Kubernetes and keeps it equal to Git. Deploying, rolling back and fencing a failed region are all commits; nobody runs kubectl apply.
Data replicates to Osaka all the time, and Osaka's network, cluster control plane and one system node stay up. A regional failover only has to add compute, inside a 1-hour budget.
docs/architecture.md, ADR-0002 to ADR-0022, docs/design/capacity-and-cost.md, docs/security/encryption-and-keys.md, infra/ and .github/workflows/ in the public repository, as of 5 November 2026. The Markdown in the repository is the source of truth.