Production-Hardened AWS CloudFormation & Zero-Idle Architecture
Tech Maven Geospatial engineers infrastructure that passes enterprise cloud security reviews on day one. Every component is codified in modular AWS CloudFormation (`infra/*.yaml`) with least-privilege task IAM roles, pinned container digests, Secrets Manager integration, and networking patterns that eliminate unnecessary 24/7 fixed costs.
Complete AWS CloudFormation Stack Catalog (`infra/`)
Deploy the full end-to-end platform or cherry-pick individual serverless capabilities into an existing AWS VPC.
| CloudFormation Template | Primary AWS Resources Provisioned | Scaling & Cost Model | Key Capabilities |
|---|---|---|---|
infra/aurora-postgis.yaml |
Aurora PostgreSQL Serverless v2 Cluster, RDS Data API (`EnableHttpEndpoint: true`), Secrets Manager, Bootstrap Custom Resource | 0.0 – 16 ACU (Auto-pause on idle) |
Initializes `postgis`, `postgis_raster`, `postgis_topology`, `workspace`/`scratch` schemas, and 3D SQL helpers (`sql/postgis_microservices.sql`) |
infra/postgis-lambda.yaml |
8 AWS Lambda Functions (7 dedicated + 1 unified router), IAM Role, optional Function URL & CloudWatch Logs | Pay-per-invocation (ms billing) | `FastGeospatial`, `FastGeostats`, `FastGeoTable`, `FastGeosuitability`, `FastImporter`, `FastGeo3D`, `FastGeoRaster` |
infra/starter-fargate.yaml |
VPC, Public/Private Subnets, S3 Gateway Endpoint, S3 Data Bucket, DynamoDB State Table, AWS Batch Fargate Compute Env | 0 – N vCPUs on Fargate |
Core serverless batch foundation with optional Zero-NAT topology for S3-native raster & vector workflows |
infra/production-hybrid-batch.yaml |
Dual AWS Batch Environments (Fargate + Managed EC2 Spot/On-Demand with `minvCpus: 0`), Step Functions, EventBridge | Scales to 0 instances when idle |
Routes standard jobs to Fargate and high-scratch/GPU jobs to elastic EC2 instances |
infra/duckdb-geoparquet.yaml |
AWS Batch Job Definition & Scoped IAM Role for DuckDB 2.0 Spatial Workers | Disposable per-query container | Executes `SPATIAL_JOIN` across S3 GeoParquet, Iceberg, S3 Tables, and Aurora PostGIS |
infra/terrio-batch.yaml |
AWS Batch Job Definition for GDAL-free Rust Terrio Raster Engine | Disposable per-job container | High-speed SIMD raster map algebra, terrain derivatives, and COG generation |
infra/otb-batch.yaml & infra/whitebox-batch.yaml |
AWS Batch Job Definitions for Orfeo ToolBox & WhiteboxTools | Disposable per-job container | Optical/SAR remote sensing segmentation & hydrological DEM conditioning |
infra/emr-sedona.yaml |
Amazon EMR Serverless Application, Glue Catalog Permissions, S3 Staging/Output Roles | 0 executors when idle |
Distributed Apache Spark + Apache Sedona spatial joins at terabyte-to-petabyte scale |
infra/neoserver-ecs.yaml |
ECS Fargate Service, Application Load Balancer, S3 & PostGIS Read Roles | Elastic Fargate tasks | Standards-compliant OGC WMS, WFS, WCS, and OGC API - Features publishing |
infra/arcgis-workstation.yaml |
EC2 `g4dn` GPU Instance (NVIDIA T4), EBS `gp3`, CloudWatch Idle Auto-Stop Alarm, IAM Role | Stopped by default ($0/hr compute) |
On-demand Windows workstation for ArcGIS Pro & QGIS with high-speed S3 & PostGIS access |
Six Architectural Guardrails Built Into Every Deployment
How Tech Maven Geospatial ensures security, scientific accuracy, and predictable cloud spend.
1. Strict Workload Separation
Scientific raster processing (`geoproc/`), trusted batch SQL (`duckdb_batch/`), and AI agent queries (`geoquery/` & `postgis_ops/`) are strictly isolated. AI MCP endpoints accept only catalog IDs and bound parameters—never raw SQL or arbitrary URLs.
2. Zero-NAT Cost Optimization
By combining S3 Gateway VPC Endpoints (free) with the Aurora RDS Data API over HTTPS, serverless Lambda and Fargate workloads can operate without expensive 24/7 VPC NAT Gateways.
3. Scientific Metadata Integrity
Every pipeline preserves physical units, CRS definitions, nodata masks, valid timestamps, and source provenance. Incompatible grids are rejected upfront, and any truncation or statistical approximation is explicitly reported in response metadata.
4. Bounded Resource Consumption
Downloads, raster decoding dimensions, SQL `LIMIT` clauses (`MAX_LIMIT = 25000`), memory allocations, and scratch disk footprints are strictly bounded to prevent runaway cloud bills or denial-of-service conditions.
5. Atomic Outputs & Monotonic Leases
Workers write and verify all S3 data assets (COGs, Zarr chunks, GeoParquet) before writing completion markers. DynamoDB leases use monotonic timestamps and outlive batch job timeouts to guarantee idempotent retries.
6. Scoped IAM & Secrets Manager
All S3 access uses task-scoped IAM roles (`ALLOWED_S3_BUCKETS`), and external database or API connectors resolve credentials dynamically from AWS Secrets Manager ARNs—zero hardcoded secrets in code or environment variables.
Deploy to Your AWS Account in Minutes
All deployment scripts include dry-run validation (`-ValidateOnly`) and live post-deployment smoke tests.
1. Deploy Aurora Serverless v2 + 7 PostGIS Lambda Microservices
Provisions the scale-to-zero Aurora PostgreSQL Serverless v2 cluster with `postgis` and `postgis_raster`, runs the SQL bootstrap (`sql/postgis_microservices.sql`), and deploys all 7 Lambda microservices (`infra/postgis-lambda.yaml`).
# 1. Validate templates & package Lambda bundle locally ./scripts/deploy-postgis-lambda.ps1 -ValidateOnly # 2. Deploy Aurora PostGIS Serverless v2 (scales to 0 ACU when idle) aws cloudformation deploy ` --template-file infra/aurora-postgis.yaml ` --stack-name tmg-aurora-postgis ` --capabilities CAPABILITY_NAMED_IAM ` --parameter-overrides VpcId=vpc-xxxx SubnetIds=subnet-aaa,subnet-bbb # 3. Deploy the 7 PostGIS + 3D + Raster Lambda Microservices ./scripts/deploy-postgis-lambda.ps1 ` -StackName tmg-postgis-microservices ` -DeploymentBucket my-artifact-bucket ` -DbClusterArn $ClusterArn ` -DbSecretArn $SecretArn # 4. Run end-to-end live verification across all 7 microservices ./scripts/test-postgis-live.ps1 -FunctionName tmg-postgis-microservices-unified
2. Deploy Serverless AWS Batch (Fargate, DuckDB 2.0 & Terrio)
Deploys the S3 data lakehouse, DynamoDB state table, and scale-to-zero AWS Batch environments for GDAL/Zarr, DuckDB 2.0 GeoParquet, Rust Terrio, OTB, and WhiteboxTools.
# 1. Deploy core Fargate Batch + S3 Lakehouse foundation aws cloudformation deploy ` --template-file infra/starter-fargate.yaml ` --stack-name tmg-geoproc-fargate ` --capabilities CAPABILITY_NAMED_IAM # 2. Add DuckDB 2.0 GeoParquet & Rust Terrio Batch Job Definitions aws cloudformation deploy ` --template-file infra/duckdb-geoparquet.yaml ` --stack-name tmg-duckdb-batch ` --capabilities CAPABILITY_NAMED_IAM aws cloudformation deploy ` --template-file infra/terrio-batch.yaml ` --stack-name tmg-terrio-batch ` --capabilities CAPABILITY_NAMED_IAM # 3. Run local offline test suite (80+ unit tests across all engines) pytest -q