backend

Create one OpenAPIHono app in a single Lambda entry point, wire middleware for logging and errors, then register each domain module's routes onto that app. Each module contains routes.ts, handler.ts, repository.ts, and vitest tests rather than its own Lambda.

Routes are declared with createRoute and zod schemas, then mounted via app.openapi. The same schema validates incoming requests and generates the OpenAPI 3.1 document, so the contract cannot drift from the handler implementation.

No. The SPA uses the Cognito SDK to hold the JWT, and an API Gateway Cognito authorizer validates every request before it reaches the BFF. The BFF only reads validated claims like sub and cognito:groups for RBAC and response shaping.

Lambda is ephemeral, so Prometheus pull-based scraping has no stable endpoint. Powertools Metrics writes EMF-formatted log lines that CloudWatch auto-extracts as metrics, requiring no collector and no cloudwatch:PutMetricData IAM permission.

Start as a modular monolith for fastest delivery. Split a module into a microservice the BFF calls when it grows, keeping the SPA contract stable since the BFF owns the public OpenAPI contract while internal services keep private contracts.

It is a retired reference architecture, not a description of any live deployment, so nothing exercises it to keep it current. It also accepts trade-offs like tokens in the browser, a shared Lambda fault domain, and per-request audit write costs.