Cloud
Engineering

AWS multi-service backend for the NIH STTR pilot — Python 3.12 Lambdas, CDK v2, Cognito, IoT Core, and Bedrock Sonnet 4 serving real-time fall alerts and 12-hour narrative summaries at Mount Olivet Home.

ambientintel/ambient-platform-infra
Deploy pipeline
Architect
Infra
Deploy
Validate
Goal
Region
us-east-1
AWS · single-region pilot
Runtime
Python 3.12
Lambda + FastAPI + boto3
IaC
AWS CDK v2
Python · unified infra/app.py
AI Model
Sonnet 4.6
Bedrock us.anthropic.* inference profile · HIPAA-eligible
Standard
HIPAA §164.514(c)
Coded data · IRB protocol
STEP 01
Architect⏱ ~1 day
Complete

Architecture Review

AWS architecture v4 reviewed and approved. Five data paths: fall-alert hot path, device-side Parquet cold path, legacy Firehose cold path (retiring), 12h narrative, and nurse/admin API. Account-per-tenant isolation model confirmed.

PathTransportLatency budgetStatus
Fall alerts (hot)MQTT QoS 1 → IoT Rule → Lambda → DDB + SNS< 2 s end-to-endActive
Telemetry — new (cold)Device Parquet → presigned PUT → S35-min batchActive / dual-write
Telemetry — legacy (cold)MQTT QoS 0 → IoT Rule → Firehose → S35-min bufferRetiring
Narrative (12h)EventBridge → SQS → Ella Lambda → BedrockBest-effort, ~30 sActive
Nurse / Admin APIAPI GW → JWT → FastAPI Lambda → DDB/AthenaWeb requestActive
Service / StackPathCDK StackTests
admin-cliservices/admin-cli/—66 pass
apiservices/api/Ambient-{env}-Api41 pass
athenaservices/athena/Ambient-{env}-Athenan/a
cloudtrailservices/cloudtrail/Ambient-{env}-CloudTrailn/a
ellaservices/ella/Ambient-{env}-Ella11 pass
goldenservices/golden/Ambient-{env}-Goldenn/a
reconcilerservices/reconciler/embedded in Telemetry2 pass
simulation-runnerservices/simulation-runner/Ambient-{env}-SimRunnern/a
telemetryservices/telemetry/Ambient-{env}-Telemetry15 pass
url-minterservices/url-minter/Ambient-{env}-UrlMinter28 pass
KMS (CDK)infra/stacks/kms_stack.pyAmbient-{env}-Kmsn/a
Storage (CDK)infra/stacks/storage_stack.pyAmbient-{env}-Storagen/a
Data (CDK)infra/stacks/data_stack.pyAmbient-{env}-Datan/a
Artifacts
▸
docs/architecture-v4.md
Authoritative architecture v4 — five paths, account-per-tenant, dual-write state, KMS, Sonnet 4.
▸
docs/architecture-v4.mmd
Canonical Mermaid diagram.
▸
docs/tenancy.md
Multi-tenant account-per-tenant isolation model.
▸
docs/device-cloud-contract.md
Authoritative device ↔ cloud wire format, v0.2.
NOTE

The legacy Firehose cold path remains active during dual-write migration. Do not decommission it until all facilities promote to parquet_only and the reconciler shows zero divergence for 7 consecutive days.

NOTE

Central observability receives CloudWatch scalar metrics only — no logs, no traces, no string-valued metric dimensions that could carry subject identifiers.

Deploy Checklist
Complete83%
Open Decisions
1Multi-region per tenant — currently single-region us-east-1; tenants with residency requirements force this decision
2Cross-tenant de-identified research aggregation — separate research account with Glue Data Catalog sharing is the likely pattern
3Firehose retirement timeline — 90 days post-migration from parquet_only promotion is tentative, not contractually nailed down
4WAL fsync cadence on OSD62x-PM — 5s default; may need 1s depending on flash wear budget