Case Study · 2025
NotesWay – Academic Notes Management Platform
A production-oriented AWS architecture for an academic notes-sharing platform — containerized backend, secure cloud storage, load-balanced API, monitoring, and infrastructure designed to be operated, not just launched.
Context
NotesWay is an academic notes-sharing platform for students, professors, and institutions to upload, share, organize, and retrieve academic resources. It runs on a 3-tier AWS architecture with a containerized FastAPI backend, a managed database, private file storage, and production-oriented security and monitoring.
The Problem
Running the application was easy. The real challenge was designing infrastructure that could separate frontend, backend, data, and file storage — while providing secure API access, reliable file delivery, monitoring, and a deployment setup that could scale beyond a single server.
Process
01 — Tier before service
Split the platform into presentation, application, and data layers, so frontend delivery, backend compute, database, and file storage remain independently managed.
02 — Containerize the backend
Packaged the FastAPI backend with Docker and deployed it on Amazon EC2 behind an Application Load Balancer — making the backend reproducible and isolated from the frontend and storage layers.
03 — Secure by default
Protected API traffic with AWS WAF, HTTPS, and the Application Load Balancer. IAM, Security Groups, and Network ACLs layer access control, while academic files stay in S3, accessed only through time-limited pre-signed URLs.
Design Decisions
Containerized backend over a bare process
Docker gives the FastAPI backend a consistent runtime, making deployments easier to reproduce and maintain.
Load balancer as the application entry point
The API is exposed through the Application Load Balancer rather than the backend process directly — a foundation for future horizontal scaling.
Pre-signed URLs over public storage
Academic files stay in private S3 storage. Upload and download access is granted through scoped, time-limited pre-signed URLs instead of a public bucket.
Outcome
✦ ✦ A single-server application evolved into a structured, containerized AWS 3-tier deployment with separated frontend, application, database, and storage layers
✦ ✦ API traffic is protected through WAF, HTTPS, and an Application Load Balancer, with CloudWatch providing centralized monitoring and logging
✦ ✦ File storage is decoupled from compute through private S3 and pre-signed URLs, reducing backend load for large file transfers
Reflection
“The real value of cloud engineering isn't building something that works once — it's building something that keeps working, and keeps proving it.”