A brief walkthrough of the architecture, tooling, and design decisions behind harshavemula.com — a fully serverless, cost-optimized portfolio with a resume-aware chatbot.

The short version

Every part of this site is serverless and runs entirely on AWS. The static content is served from a private S3 bucket through CloudFront over HTTPS on a custom domain. The chatbot at the bottom-right is an AWS Lambda function that calls Amazon Bedrock (Claude Haiku 4.5) with the resume injected into the system prompt, wrapped in Bedrock Guardrails for content and prompt-injection protection. Total operating cost is under one dollar per month, on top of the ~$12/year domain fee.

Architecture at a glance

Browser  ──HTTPS──▶  CloudFront (edge cache + TLS)  ──OAC──▶  Private S3 bucket (static site)
                     │
                     └──▶ chatbot.js in bundle  ──POST /chat──▶  API Gateway (HTTP API v2)
                                                                       │
                                                                       ▼
                                                                    Lambda (Python)
                                                                       │
                                                                       ▼
                                                              Bedrock Converse API
                                                              • Claude Haiku 4.5
                                                              • Guardrail attached

Static site

• The HTML, CSS, JavaScript, images, and PDF resume live in a private S3 bucket.
• CloudFront acts as the CDN, terminating TLS at the edge and caching content close to visitors.
• The S3 bucket is not publicly readable. CloudFront uses Origin Access Control (OAC) with a signed request to fetch objects, and the bucket policy only allows the CloudFront distribution.
• A single edge cert issued by AWS Certificate Manager (ACM) covers both the apex domain and the www subdomain.

Custom domain

• The domain was registered directly through Route 53 Domains with auto-renew and WHOIS privacy enabled.
• Route 53 hosts the DNS zone. Apex and www records use A and AAAA aliases pointing at the CloudFront distribution, so both IPv4 and IPv6 clients get routed correctly.
• ACM validation CNAMEs remain in the zone so the certificate auto-renews without manual involvement.

Chatbot

• The frontend chat widget POSTs to an API Gateway HTTP API endpoint with CORS enabled and stage-level throttling (10 requests per second, burst 20).
• The Lambda function is written in Python. On cold start it loads the resume text bundled into its deployment package, builds a system prompt that grounds the model in that resume, and calls the Bedrock Converse API with Claude Haiku 4.5.