Engineering a Distributed ServerlessE-Commerce Platformfor Modern Agriculture.

An end-to-end e-commerce platform featuring secure Cognito role-based access, fault-tolerant payment flows powered by the Saga pattern, and event-driven architecture for automated notifications.

Next.js

Python

FastAPI

AWS

MySQL

Scroll to Explore

Orchestrating a
Serverless Ecosystem.

A unified view of how our Next.js frontends, FastAPI microservices, and AWS infrastructure work together to power a multi-role digital storefront.

01 — User

The User Portal

High-Performance UX: A Next.js frontend designed for speed, featuring an Amplify-cached catalog, intelligent search, and a seamless Razorpay checkout flow.

02 — Admin

The Admin Control Center

Master Data Management: A secure, master-access portal allowing the business owner to push instant seasonal homepage updates, manage product lifecycles, and oversee global order fulfillment.

03 — Delivery

The Delivery Agent Module

Role-Based Logistics: A specialized UI module restricted via Cognito RBAC. It equips delivery personnel with real-time order routing using embedded Google Maps and reverse geocoding (longitude/latitude) for precise drop-offs.

04 — Cloud

The Cloud Backbone

Distributed & Event-Driven: A highly scalable Python/FastAPI backend executing entirely on AWS Lambda. State is managed via RDS MySQL, with complex asynchronous tasks orchestrated through AWS Step Functions.

Securing the Perimeter:
Multi-Portal Identity & RBAC

Security cannot be a single point of failure. We implemented a federated, Zero-Trust architecture using AWS Cognito to govern identities and access across two entirely distinct web portals.

Dual-Flow Authentication & UI Rendering

To minimize checkout friction, the public User Portal leverages Google SSO via Cognito. Conversely, the internal operations portal enforces strict credential-based logins.

Edge Authentication (The API Layer)

Every REST endpoint is shielded by API Gateway Cognito Authentication. Python Lambdas strictly enforce Role-Based Access Control (RBAC).

Stateful Connection Security

Securing asynchronous communication requires more than standard token checks. We engineered a Custom Lambda Authorizer specifically for WebSockets.

Customer App

Next.js

Admin App

Next.js

AWS Cognito

Token Machine

APIGW Native Auth

REST API

Custom Lambda Auth

WebSocket API

FastAPI / Lambdas

Video Coming Soon

Real interview footage explaining the Cognito architecture is being processed.

The 4-Layer
Performance Shield:
Zero-Latency UX.

To make the web platform feel as instantaneous as a native mobile app—while simultaneously protecting our FastAPI backend from redundant database queries—we engineered a sophisticated, 4-tier caching architecture.

Demo Video Coming Soon

Layer 01

Edge Caching (Next.js ISR)

The First Line of Defense: We utilize Next.js Incremental Static Regeneration (revalidate) to cache dynamic product catalogs at the AWS Amplify edge. If 1,000 users search for the same fertilizer, the database is queried exactly once.

Layer 02

In-Memory Mutability (React Query)

Eliminating Network Latency: We integrated React Query (TanStack) to manage data directly in the browser's active memory. Navigating between product details and previously viewed lists results in instant, zero-network-request loads.

Layer 03

Persistent Browser Storage

Bypassing the Server: Heavy, static layout data—such as category trees and global navigation menus—are written directly to LocalStorage. A custom invalidation script ensures the UI instantly loads from the hard drive.

Layer 04

Synchronized Application State

Volatile Session Memory: To prevent component re-renders, highly dynamic data like the shopping cart is held in a centralized React Context. Clicking 'Add to Cart' instantly synchronizes the UI globally without a page refresh.

REQ

Next.js Edge

React Query

Local Storage

React Context

FastAPI Backend

The Engine Room:
Distributed Transactions & The Saga Pattern

Processing payments requires absolute fault tolerance. We architected a zero-trust, event-driven checkout pipeline utilizing AWS Step Functions to guarantee exact-once execution and seamless rollbacks across our microservices.

Checkout

sapanafertilizer.com

🧪

Antracol — Bayer

Fungicide · 1 KG

Subtotal₹735.10

Discount-₹73.51

Total₹661.59

Pay Now →

✓

Order Confirmed

Order #SF-48291

₹661.59 Paid

FastAPI

Idempotency Engine

Hash: 7f8b9a2

✓

Hash: 7f8b9a2

⚠ Cached

Checkout — sapanafertilizer.com

ShippingChandrala, GJ

MethodUPI

Total

₹14,266₹1.00|

Place Order →

Outgoing Payload

shipping_to: "Chandrala"

payment_method: "UPI"

cart_total: "₹1.00"

Auth: Cognito Sub [884...]

RDS MySQL

→

VERIFIED TOTAL

₹14,266

✓

Order Confirmed

₹14,266 Verified

Hack attempt silently ignored

AWS Step Function

Checkout Saga

📦

Order & Logistics

Cart Hydration

PAYLOAD

✓Order Placed

✓Items Locked

🏷️

Promotion Engine

Discount Calc

PAYLOAD

−10% Applied

💳

Payment Service

Razorpay Intent

PAYLOAD

Intent_ID: rzp_123

✓

Checkout Initialized

Saga completed in 1.2s

OOrder

✓

DATA

Void Order #1234

↩

PPromotion

✓

🔒

DATA

Revert Promotion

↩

PPayment

DATA

⚡

Step Function: CATCH

Compensating Transaction

↩

✓

Eventual Consistency Achieved

All domains compensated

Public Internet

🌐

API Gateway

WebSocket

⚡

Alert Lambda

Non-VPC

📱

🔌NAT Gateway

Idle: $35/mo

$0Idle Cost

Private VPCAir-Gapped

⚡

Pre-Lambda

Lock DB

🗄️RDS

🔒

✓

⚡

Post-Lambda

Finalize

✓

Network Isolation Maintained

$0 egress · Zero NAT costs

HTTP Pollingevery 1s

Client

Idle Queries: 0

🗄️RDS

WebSocketbi-directional

Client

✓

Payment Success

Idle Queries: 0

🌐APIGW

⚡Step Fn

✓

DATA

Payload-Hashed Idempotency

Preventing Double-Charges

To protect against impatient clicks and network retries, we enforce state-driven idempotency. The frontend generates a deterministic hash from the exact checkout payload. If a user spam-clicks 'Pay Now', FastAPI detects the duplicate hash, short-circuits the AWS Step Function to prevent redundant billing, and returns the existing Order ID. However, altering the value of an even single checkout field generates a new hash, natively unlocking a fresh Saga orchestration.

Zero-Trust Payload Security

Tamper-Proof Financials

We never trust the client with financial data. To eliminate the risk of client-side price manipulation via Chrome DevTools, our frontend payload strictly transmits shipping coordinates and payment preferences—never cart totals. Instead, the REST API extracts the Cognito Sub from the Authorization header to securely fetch the immutable, true cart state directly from our RDS database.

Domain-Driven Saga Orchestration

Distributed Transaction Safety

Because checkout spans multiple microservices, a standard synchronous API risks catastrophic timeouts. We decoupled the flow into an asynchronous AWS Step Function. The Saga routes the payload through strictly sequenced domains—first hydrating the cart to safely persist the immutable records across the Order related tables. It then passes through an extensible Promotion Engine to calculate cascading discounts, before securely generating a tamper-proof Razorpay intent in the Payment Service.

Distributed Compensating Transactions

Cross-Boundary Rollbacks

A standard ORM session.rollback() cannot undo network requests across isolated microservices. This is exactly why we orchestrated the checkout via AWS Step Functions. If the Payment Service fails after the Order and Promotion domains have already committed their data, the Step Function's Catch block intercepts the failure. It natively triggers a compensating Lambda that reaches back across repository boundaries to gracefully release inventory locks, revert applied discounts, and void the transaction state—guaranteeing strict eventual consistency without manual database surgery.

FinOps-Driven VPC

Isolation Zero-Cost Network Egress

Core microservices run in an air-gapped VPC to protect RDS, but rollback failures require public WebSocket alerts. Instead of provisioning an expensive, always-on NAT Gateway, the Step Function acts as a secure network bridge. It orchestrates a 3-stage rollback: a VPC Lambda locks the database state, a non-VPC Lambda broadcasts the alert, and execution returns to the VPC to finalize the rollback. This guarantees strict network isolation with $0 idle infrastructure costs.

Async WebSocket Callbacks

Real-Time UI Updates

Because the Step Function processes the Saga asynchronously, the frontend cannot wait on an HTTP connection. We engineered a bi-directional WebSocket connection via API Gateway. As the Step Function resolves the Razorpay order ID or finalized offline payment, the backend pushes a real-time success or failure notification directly to the client's connection_id, ensuring a seamless, zero-lag user experience.

The Engine Room:
Distributed Transactions

We architected a zero-trust, event-driven checkout pipeline utilizing AWS Step Functions to guarantee exact-once execution and seamless rollbacks.

AWS Step Functions

🔒Idempotency

🛡️Zero-Trust

⚡Saga Pattern

🔄Compensating

💰FinOps VPC

🌐WebSocket

Explore Architecture

Spatial Logistics:Precision Routing with Google Maps

Precision Coordinate Capture

Triple-Fallback Logistics: Agricultural addresses can be highly unpredictable. To guarantee exact last-mile routing, we engineered a three-tier location capture UI. Users can leverage Google Places Auto-Suggest, trigger an instant 'Current Location' GPS ping, or manually drag-and-drop a map pin for pinpoint targeting. The frontend seamlessly normalizes these three distinct inputs into strict Longitude/Latitude coordinates for our backend validation engine.

|123 Farm Route, Gujarat

Farm Plot A

Event-Driven WhatsApp Pipeline:
Bridging the VPC Boundary

To guarantee zero API latency during checkout, we completely decoupled document generation from the main thread. By leveraging AWS S3 Event Notifications, we engineered a highly scalable pipeline to deliver real-time WhatsApp receipts.

PRIVATE_SUBNET

payload.json

offline.json

invoice.pdf

Razorpay Webhook

Admin Portal

Order Lambda

Payment Lambda

Receipt Service

RDS MySQL

Amazon S3

Receipt Msg

invoice.pdf1.2 MB • PDF

WhatsApp API

Instant Confirmation & The Success Trigger

State-Aware Messaging: Communication maps strictly to the order's lifecycle. The heavy PDF receipt pipeline remains dormant until the order definitively reaches a SUCCESS payment state.

The VPC Boundary & PDF Generation

Cost-Optimized Isolation: Our Receipt Lambda lives strictly inside a private VPC to query RDS. To avoid a $30/mo NAT Gateway just to reach WhatsApp, it uploads the PDF to S3.

The Air-Gap Bridge & WhatsApp Dispatch

Crossing the Network Divide: The S3 upload triggers our external Receipt Message Lambda. By reading the phone number from the S3 metadata, it bridges the network gap flawlessly.

The V2 Roadmap:
Voice-Activated AI Agronomist

Bridging the digital literacy gap. To keep serverless costs under $30/month while ensuring absolute safety, we are architecting a custom, highly-constrained RAG pipeline built on robust AI engineering patterns rather than bloated frameworks.

System Telemetry

// Audio Input Translated:

"What do I spray for yellow spots right now?"

// LLM Generated SQL:

SELECT * FROM treatments
WHERE MATCH(symptoms)
AGAINST('yellow spots')

AND season = 'Monsoon';

Schema-First Relational RAG

Tap to flip

Schema-First Relational RAG

MySQL FULLTEXT retrieval utilizing strict agricultural seasonality filtering to guarantee deterministic, hallucination-free context. Bypassing expensive Vector DBs entirely.

Click Box
to Flip

Voice-to-Intent Pipeline

Tap to flip

Voice-to-Intent Pipeline

Translating raw Gujarati audio into normalized, programmatic search inputs via Whisper API.

Agentic Model Routing

Tap to flip

Agentic Model Routing

Evaluating query complexity at the retrieval layer to dynamically route between gpt-4o-mini and gpt-4o—protecting the budget without sacrificing intelligence.

Cost-Zero Semantic Caching

Tap to flip

Cost-Zero Semantic Caching

Collapsing frequent seasonal queries into cached key-value hits via DynamoDB, bypassing inference costs entirely.

Confidence Floors

Tap to flip

Confidence Floors

Programmatic confidence thresholds that refuse low-probability generation, instantly triggering an asynchronous handoff to human agronomists.

Prompt Injection Defenses

Tap to flip

Prompt Injection Defenses

Strict XML delimiters and database-level payload restrictions to enforce absolute Data Leak Control.

Automated Red Teaming

Tap to flip

Automated Red Teaming

CI/CD adversarial testing to guarantee the agent strictly rejects Out-of-Domain (OOD) non-agricultural requests and prompt leaks.

Perceived Zero-Latency UX

Tap to flip

Perceived Zero-Latency UX

Streaming Web UI responses via Server-Sent Events (SSE) to mask backend RAG latency and maintain instant user engagement.

Operational Excellence:
From Code to Cloud

main.tf

deploy.yml

cloudwatch.log

qa_matrix.csv

# ── MODULE: Lambda ──
resource "null_resource" "build_lambda" {
triggers = { requirements_hash = filemd5("requirements.txt") }
provisioner "local-exec" {
command = "pip install -r requirements.txt -t dependencies && python prepare.py"
}
}
resource "aws_lambda_function" "this" {
# Dynamic naming: product-service-dev OR product-service-prod
function_name = "${var.function_name}-${var.stage}-lambda"
runtime       = "python3.13"
memory_size   = 512
timeout       = 30
environment {
variables = {
STAGE              = var.stage
POWERTOOLS_LOG_LEVEL = var.stage == "prod" ? "INFO" : "DEBUG"
DB_HOST            = var.rds_endpoint
}
}
vpc_config {
subnet_ids         = var.private_subnet_ids
security_group_ids = [var.lambda_security_group_id]
}
}
# ── MODULE: IAM (Least-Privilege) ──
resource "aws_iam_policy" "lambda_vpc_access" {
Action = ["ec2:CreateNetworkInterface",
"ec2:DescribeNetworkInterfaces"]
}
resource "aws_iam_policy" "lambda_rds_access" {
Action = ["rds:Connect", "secretsmanager:GetSecretValue"]
}
# ── MODULE: S3 (Selective Public Read) ──
resource "aws_s3_bucket_policy" "public_read" {
Sid    = "PublicReadForSpecificFolders"
Action = "s3:GetObject"
Resource = ["products/*", "brands/*", "homepage/*"]
}
# ── MODULE: API Gateway + Cognito ──
resource "aws_api_gateway_rest_api" "main" {
name = "${var.environment}-main-gateway"
endpoint_configuration { types = ["EDGE"] }
}
resource "aws_api_gateway_authorizer" "cognito" {
type            = "COGNITO_USER_POOLS"
identity_source = "method.request.header.Authorization"
provider_arns   = [var.cognito_user_pool_arn]
}

# Lambda (auto-build + VPC)
resource "null_resource" "build"
triggers = filemd5("requirements.txt")
"pip install && python prepare.py"
resource "aws_lambda_function"
name    = "svc-${stage}-lambda"
runtime = "python3.13"
LOG     = stage=="prod" ? "INFO" : "DEBUG"
vpc     = private_subnets
# IAM Least-Privilege
VPC  → ec2:CreateNetworkInterface
RDS  → rds:Connect, secrets:Get
S3   → PutObject, GetObject
# S3 Selective Public Read
folders: products/*, brands/*
# API Gateway + Cognito
type: EDGE + COGNITO_USER_POOLS

100% Infrastructure as Code

Every Lambda, IAM role, S3 bucket, API Gateway, and VPC config is version-controlled via Terraform modules. Dynamic naming per stage (dev/prod), automated Lambda packaging via null_resource, conditional log levels, least-privilege IAM policies, and selective S3 public access — zero console clicks.

name: ChatOps Deploy
on:
issue_comment:
types: [created]
jobs:
deploy:
# Only run on PR comments starting with /deploy
if: github.event.issue.pull_request &&
startsWith(github.event.comment.body, '/deploy')
runs-on: ubuntu-latest
steps:
# ── Parse "/deploy dev" or "/deploy prod" ──
- name: Parse Command
uses: actions/github-script@v6
const stage = args[1].toLowerCase();
core.setOutput('stage', stage);
# ── STRICT BRANCH CHECK ──
- name: Check Branch Permission
if (stage === 'prod' && targetBranch !== 'prod')
core.setFailed("❌ BLOCKING: Cannot /deploy prod")
# ── Dynamic AWS Credentials (per stage) ──
- name: Configure AWS Credentials
aws-access-key-id:
${{ secrets[format('AWS_ACCESS_KEY_{}', stage_upper)] }}
# ── Terraform IaC Deploy ──
- name: Terraform Apply
run: terraform apply -auto-approve
-var="stage=${{ steps.parse.outputs.stage }}"
-var="account_id=$TARGET_ACCOUNT_ID"
# ── PR Feedback ──
- name: Comment Success
'✅ Deployed to ${{ stage }} Successfully!'
- name: Comment Failure
'❌ Deployment Failed! Check Actions tab.'

name: ChatOps Deploy
on: issue_comment: [created]
if: startsWith(comment, '/deploy')
# Parse "/deploy dev" or "/deploy prod"
const stage = args[1]
core.setOutput('stage', stage)
# Branch-to-environment gate
if (stage==='prod' && branch!=='prod')
core.setFailed("❌ BLOCKING")
# Dynamic AWS creds per stage
key: secrets['AWS_KEY_' + STAGE]
# Terraform IaC Deploy
terraform apply -auto-approve
-var="stage=${{ stage }}"
✅ Deployed to ${{ stage }}
❌ Failed → Check Actions

ChatOps CI/CD Pipeline

We engineered a ChatOps-driven deployment system. Developers trigger deployments directly from Pull Request comments using /deploy dev or /deploy prod. The pipeline enforces strict branch-to-environment mapping, dynamically resolves AWS credentials per stage, packages Lambda dependencies, and orchestrates Terraform apply — all with automated PR feedback on success or failure.

45:12 [INFO]  POST /checkout - STATUS 200
45:14 [DEBUG] Invoking Step Function
45:15 [ERROR] Gateway Timeout - Retrying (1/3)
45:17 [WARN]  Latency spike in RDS pool
45:18 [INFO]  Payment Successful.
45:19 [INFO]  Orchestration Complete.

Proactive Debugging

We instrumented the entire backend with highly granular DEBUG, INFO, WARNING, and ERROR logging. By leveraging AWS CloudWatch and writing custom Log Insights queries, we maintain complete visibility into API health and real-time bottlenecks.

ID, FLOW_NAME, EXPECTED, ACTUAL, STATUS, OWNER
TC-01, Guest Checkout, 200 OK, 200 OK, [PASS], Sapana
TC-02, Out of Bounds, 400 Reject, 400 Reject, [PASS], Sapana
TC-03, Invalid Token, 401 Auth, 500 Err,  [FAIL], Backend
TC-04, DB Rollback, Compensate, Reverted, [PASS], DevOps

Lean E2E Testing

Heavy project management tools like Jira often create unnecessary friction for lean teams. We engineered a highly disciplined, multi-sheet Google Drive Test Matrix. It tracks rigorous end-to-end user flows and bug triaging with zero administrative overhead.

MACBOOK PRO

The Engine Room: Meet the Team

Abhi Patel

Cloud Consultant

Pathik Patel

Tech Lead

Rajvi Patel

Software engineer

Ready to dive deeper into the architecture?

Engineering a Distributed ServerlessE-Commerce Platformfor Modern Agriculture.

Orchestrating aServerless Ecosystem.

The User Portal

The Admin Control Center

The Delivery Agent Module

The Cloud Backbone

Securing the Perimeter:Multi-Portal Identity & RBAC

Dual-Flow Authentication & UI Rendering

Edge Authentication (The API Layer)

Stateful Connection Security

Customer App

Admin App

AWS Cognito

REST API

WebSocket API

FastAPI / Lambdas

Video Coming Soon

The 4-LayerPerformance Shield:Zero-Latency UX.

Demo Video Coming Soon

Edge Caching (Next.js ISR)

In-Memory Mutability (React Query)

Persistent Browser Storage

Synchronized Application State

The Engine Room: Distributed Transactions & The Saga Pattern

Payload-Hashed Idempotency

Zero-Trust Payload Security

Domain-Driven Saga Orchestration

Distributed Compensating Transactions

FinOps-Driven VPC

Async WebSocket Callbacks

The Engine Room: Distributed Transactions

Spatial Logistics:Precision Routing with Google Maps

Precision Coordinate Capture

Event-Driven WhatsApp Pipeline:Bridging the VPC Boundary

Instant Confirmation & The Success Trigger

The VPC Boundary & PDF Generation

The Air-Gap Bridge & WhatsApp Dispatch

The V2 Roadmap: Voice-Activated AI Agronomist

Schema-First Relational RAG

Schema-First Relational RAG

Voice-to-Intent Pipeline

Voice-to-Intent Pipeline

Agentic Model Routing

Agentic Model Routing

Cost-Zero Semantic Caching

Cost-Zero Semantic Caching

Confidence Floors

Confidence Floors

Prompt Injection Defenses

Prompt Injection Defenses

Automated Red Teaming

Automated Red Teaming

Perceived Zero-Latency UX

Perceived Zero-Latency UX

Operational Excellence: From Code to Cloud

100% Infrastructure as Code

ChatOps CI/CD Pipeline

Proactive Debugging

Lean E2E Testing

The Engine Room: Meet the Team

Abhi Patel

Pathik Patel

Rajvi Patel

Orchestrating a
Serverless Ecosystem.

Securing the Perimeter:
Multi-Portal Identity & RBAC

The 4-Layer
Performance Shield:
Zero-Latency UX.

The Engine Room:
Distributed Transactions & The Saga Pattern

The Engine Room:
Distributed Transactions

Event-Driven WhatsApp Pipeline:
Bridging the VPC Boundary

The V2 Roadmap:
Voice-Activated AI Agronomist

Operational Excellence:
From Code to Cloud