How this site is built.
dynamiccloud.info is a demonstration architecture — but it serves a real, live, public-facing application. Every visitor request is real, every Lambda invocation is real, every CloudFront log is being processed by a real EC2 worker as you read this. The system isn't a sandbox or a fixture; it's a working production-grade AWS deployment built on patterns that mirror what most teams run for their own customer-facing services.
We built it this way deliberately. dynamiccloud.info is the primary data source for LightPane's pane demonstrations — and a contrived, tidy environment would only ever produce contrived, tidy panes. Real architectures have CloudFront logs landing in unexpected formats, replication latency that varies by region, backups running at 03:30 UTC and Athena queries kicking off ad-hoc — and panes only earn their keep when they handle that reality cleanly.
The five things LightPane shows you
The architecture is organised, intentionally, around the five principles that almost every cloud provider's well-architected framework names — and that almost every operations team cares about. Each diagram below highlights which of these the underlying components contribute to.
Observability
What's running, what changed, what's about to break. CloudWatch alarms, log search, daily briefings.
Availability
Multi-region replication, backup posture, status checks, region maps. Knowing the system survives a region outage before one happens.
Security monitoring
Unrotated keys, public S3, IAM blast radius, GuardDuty findings, Config drift. Catching the thing that bites you next quarter, this quarter.
Performance
Right-sizing recommendations, Lambda cold-start radar, load-balancer health, slow-query surfacing. Performance you can act on, not just chart.
Cost insights
Spend by tag, idle resources, savings-plan coverage, free-tier headroom. The number on the bill explained, not just reported.
What follows is the architecture in three layers — the public-facing path a visitor's browser takes, the analytics event loop running behind the scenes, and the multi-region replication that gives the system real geographic resilience.
Public request flow
What happens when you visit dynamiccloud.info or click a lab
button. Route 53 hands the request to CloudFront, which runs a
small viewer-request function (canonical-host redirect plus
directory-style URL rewrite) and decides whether the path is
static content or a lab API call. Static paths stream from the
S3 origin bucket; lab paths route through API Gateway HTTP API
to one of six purpose-built Lambdas, with the guestbook lab
writing to a DynamoDB table. WAF (us-east-1, CloudFront-scoped)
rate-limits and pattern-matches at the edge. Embedded LightPane
panes load asynchronously from lightpane.io and
authenticate with a public read-only access key locked to this
origin.
Traffic analytics event loop
The workload behind the site-stats page. Every CloudFront access log delivery (every minute or so) fires an S3 ObjectCreated event, lands on an SQS queue, and is picked up by a small EC2 worker (a t4g.nano in a private subnet, reaching S3 over a VPC gateway endpoint). The worker normalises CloudFront's v2 JSON-Lines format, runs GoAccess over the cumulative log set, and publishes a fresh HTML report back to the origin bucket — invalidating the CloudFront edge cache so the new report appears within seconds. A DynamoDB idempotency table prevents double-counting; an SQS DLQ catches anything that fails five times; an EventBridge rollup at 03:00 UTC re-runs the last 7 days as a safety net. Side paths: a Glue+Athena workgroup over the same logs (for ad-hoc queries), an SNS topic publishing daily summaries, AWS Backup snapshotting the idempotency table, and a CloudWatch dashboard surfacing queue depth, parse time, and worker host metrics.
Multi-region resilience
Two complementary cross-region patterns running on real, measured replication. The static-site S3 bucket replicates one-way from London (eu-west-2) to Tokyo (ap-northeast-1) — a "global-content fan-out" pattern that mirrors how most CDNs and content platforms keep latency low for distant readers. The DynamoDB processed-logs table is a Global Table across London, Stockholm (eu-north-1), and Frankfurt (eu-central-1) — a "European HA" pattern that mirrors a typical disaster-recovery posture for regulated workloads with data-residency requirements. Writes from any region propagate to the others within a few seconds (last measured: ~5s for DynamoDB, ~30s for S3 cold-start, sub-second steady state).
Next: see all of this through LightPane's lens
The diagrams above describe the system from an architect's point of view — components, flows, regions. The Demonstration Dashboard shows the same system from an operator's point of view — organised by the five principles above, each pane reading live from the components in these diagrams.
That dashboard is how a customer would actually use LightPane on their own production environment: not to admire the architecture, but to spot the kms key that hasn't rotated in 400 days, the Lambda that's been throttled since Thursday, the $30 / month NAT-gateway charge nobody noticed.