Dependency map
An arrow A --> B here means "A depends on B" in Terraform — build order.
This is a different relationship from the Runtime event flow,
where an arrow means "this event causes that to run".
A single whole-estate graph of ~150 resources renders as an unreadable tangle, so resources are grouped into subsystems. Repetitive plumbing sub-resources (API Gateway method/integration/response quads, IAM policy-attachment triads, S3 configuration sub-resources) are counted in each subsystem total but collapsed out of the flowcharts, leaving the architecturally meaningful nodes and their dependency edges.
Those same collapsed resources are the entire signal of the runtime diagram — noise in one view, signal in the other.
Subsystem overview
Upload Pipeline
107 resources - 89 plumbing sub-resources collapsed for readability
CDN & Certificates
9 resources
Identity & Access (IAM)
73 resources - 35 plumbing sub-resources collapsed for readability
Compute (GPU / EC2)
11 resources
Secrets & Encryption
11 resources
Observability
7 resources
Subsystems at a glance
| Subsystem | What it is |
|---|---|
| Upload Pipeline | The core data path: S3 capture buckets, the on_upload / pipeline_l0 / presigned-URL Lambdas, shared Lambda layers, and the API Gateway REST API + stage that front them. |
| CDN & Certificates | CloudFront distributions (releases, OTel), the latest_rewrite CloudFront Function, origin access control, and the ACM certificates they serve. |
| Identity & Access (IAM) | Lambda execution roles, GitHub Actions OIDC roles (push-based deploy), managed policies, and the OIDC provider they trust. |
| Compute (GPU / EC2) | GPU dev/worker instances (video indexing, the data_filtering_dev box), their launch templates, security groups, and the ECR repository. |
| Secrets & Encryption | Secrets Manager secrets (Supabase credentials, Prefect API key, OTel), their versions and policies, the generated random_password, and the KMS key + alias that encrypt them. |
| Observability | CloudWatch log groups, one per Lambda and for API Gateway access logs. |
The automations department's resources are not in these diagrams — they live in a separate Terraform root. See Automations.