Reference

Quick-reference page for the Terraform Terraform
HashiCorp Terraform — infrastructure-as-code tool used to provision all AWS resources in this demo. -provisioned S3 Vectors S3 Vectors
Amazon S3 Vectors — a purpose-built vector storage capability within S3 that enables similarity search over embeddings without a separate vector database. RAG demo. Use this as a lookup for repository structure, configuration variables, deployment outputs, API routes, and external documentation.

Source repository

terraform-aws-s3-vectors-rag-demo

Repository layout

terraform-aws-s3-vectors-rag-demo/
├── main.tf                    # Provider config, locals
├── variables.tf               # Input variables
├── outputs.tf                 # Terraform outputs
├── s3.tf                      # S3 bucket for documents
├── s3_vectors.tf              # S3 Vectors bucket + index
├── lambda_ingest.tf           # Ingest Lambda + role + policy
├── lambda_query.tf            # Query Lambda + role + policy
├── api_gateway.tf             # HTTP API + routes + authorizer
├── cognito.tf                 # User pool, client, groups, admin user
├── amplify.tf                 # Amplify app + branch
├── eventbridge.tf             # Scheduled ingest trigger
├── deploy.tf                  # Web UI deployment null_resource
├── rag/                       # Python Lambda code
│   ├── fetch.py              # RSS fetching + HTML stripping
│   ├── ingest.py             # Embedding + PutVectors
│   ├── query.py              # Search + rerank + LLM
│   └── config.py             # Shared configuration
├── web/                       # SPA frontend
│   ├── index.html
│   ├── app.js
│   ├── styles.css
│   └── config.template.js
├── scripts/
│   └── deploy-web.sh         # Amplify deployment script
├── terraform.tfvars.example   # Example variables
└── README.md                  # Setup instructions

Path	Purpose
main.tf	AWS provider configuration, random prefix, and local values
variables.tf	All input variables with types, defaults, and validations
outputs.tf	Stack outputs exposed after terraform apply
s3.tf	Standard S3 bucket for raw RSS document storage
s3_vectors.tf	Vector bucket Vector bucket A specialized S3 bucket type (aws_s3vectors_vector_bucket) that hosts vector indexes for similarity search. and vector index vector index A named index (aws_s3vectors_index) within a vector bucket defining dimension, distance metric, and data type. resources
lambda_ingest.tf	Ingest Lambda Lambda AWS Lambda — serverless compute. This project uses two functions: ingest (RSS → embed → store) and query (search → answer). function, IAM role, and least-privilege policy
lambda_query.tf	Query Lambda function, IAM role, and least-privilege policy
api_gateway.tf	API Gateway API Gateway Amazon API Gateway — a managed HTTP API service with JWT authorization, CORS, and throttling. Routes requests to the Query Lambda. HTTP API, routes, stages, and JWT authorizer
cognito.tf	Cognito Cognito Amazon Cognito — a user authentication service providing user pools, JWT tokens, and group-based authorization. user pool, app client, groups, and default admin user
amplify.tf	Amplify Amplify AWS Amplify — a managed hosting service for static web applications. Used to host the briefing UI SPA. hosting app and branch for the SPA frontend
eventbridge.tf	EventBridge EventBridge Amazon EventBridge — a serverless event bus. Used here for the daily scheduled corpus ingest cron trigger. rule for daily scheduled ingest
deploy.tf	null_resource that runs the web deployment script
rag/	Python source for both Lambda functions (shared library)
web/	Static SPA frontend served by Amplify
scripts/	Helper scripts for deployment automation

Terraform input variables

Name	Type	Required	Description
aws_region	string	No (default: us-east-1)	AWS region for all resources
project_name	string	No (default: s3-vectors-rag)	Name prefix for all resources
vector_bucket_name	string	No (default: rag-vectors)	Suffix for the S3 Vectors bucket name
vector_index_name	string	No (default: announcements)	Name of the vector index
vector_dimension	number	No (default: 1024)	Dimensionality of embedding vectors (1–4096)
vector_distance_metric	string	No (default: cosine)	Distance metric: cosine or euclidean
embedding_model_id	string	No (default: amazon.titan-embed-text-v2:0)	Embedding model Embedding model Amazon Titan Embeddings V2 (amazon.titan-embed-text-v2:0) — converts text into 1024-dimensional vectors for similarity search. ARN or ID
inference_profile_id	string	No (default: au.anthropic.claude-sonnet-4-5-20250929-v1:0)	Inference profile Inference profile A Bedrock cross-region inference profile that routes requests to the nearest available region. Used for the LLM (au.anthropic.claude-sonnet-4-5-20250929-v1:0). for LLM generation
rss_feed_urls	list(string)	No	List of RSS feed URLs to ingest for the corpus
admin_email	string	Yes	Email for the default Cognito admin user
admin_username	string	No (default: admin)	Username for the default admin account
schedule_expression	string	No (default: rate(1 day))	EventBridge schedule for automatic ingest

Note

Only admin_email is strictly required. All other variables have sensible defaults. Copy terraform.tfvars.example to get started.

Terraform outputs

Output	Description	Usage
app_url	Amplify HTTPS URL for the web UI	Open in browser to access the briefing app
api_endpoint	API Gateway base URL	Base URL for API calls (/query, /ingest, /status)
cognito_user_pool_id	Cognito user pool identifier	Used for authentication configuration
cognito_client_id	SPA client ID for the Cognito app client	Passed to the web app for login flows
vector_bucket_name	S3 Vectors bucket name (with random prefix)	Used in Lambda environment and debugging
ingest_function_name	Ingest Lambda function name	Manual invocation via AWS CLI

Tip

Run terraform output after apply to see all values. Use terraform output -json for scripted consumption.

API endpoints

The API Gateway API Gateway
Amazon API Gateway — a managed HTTP API service with JWT authorization, CORS, and throttling. Routes requests to the Query Lambda. exposes three routes, all protected by a Cognito JWT authorizer:

Method	Path	Description	Lambda
POST	/query	Submit a question for RAG RAG Retrieval-Augmented Generation — a pattern that combines vector similarity search with LLM generation to produce grounded answers. -powered answer generation	Query Lambda
POST	/ingest	Trigger a manual corpus ingest from RSS feeds	Ingest Lambda
GET	/status	Health check — returns ingest stats and index metadata	Query Lambda

Note

All requests must include a valid JWT in the Authorization header. The web UI handles token refresh automatically via Cognito.

Lambda function details

Property	Ingest Lambda	Query Lambda
Runtime	python3.12	python3.12
Memory	512 MB	512 MB
Timeout	300 s	60 s
Handler	ingest.handler	query.handler
Source	rag/ingest.py	rag/query.py
Trigger	EventBridge schedule, API Gateway, manual invoke	API Gateway only

Environment variables

Both Lambda Lambda
AWS Lambda — serverless compute. This project uses two functions: ingest (RSS → embed → store) and query (search → answer). functions receive configuration via environment variables set in Terraform:

Variable	Function	Description
VECTOR_BUCKET_NAME	Both	S3 Vectors bucket name for API calls
VECTOR_INDEX_NAME	Both	Vector index name within the bucket
EMBEDDING_MODEL_ID	Both	Titan V2 Titan V2 Amazon Titan Embeddings V2 — the Bedrock foundation model used to generate 1024-dimensional text embeddings. model ID for embedding generation
INFERENCE_PROFILE_ID	Query	Inference profile Inference profile A Bedrock cross-region inference profile that routes requests to the nearest available region. Used for the LLM (au.anthropic.claude-sonnet-4-5-20250929-v1:0). for LLM answer generation
DOCUMENT_BUCKET_NAME	Ingest	S3 bucket for storing raw fetched documents
RSS_FEED_URLS	Ingest	Comma-separated list of RSS feed URLs to fetch

Architecture decisions

Key design choices made in the source repository:

• S3 Vectors over dedicated vector DB — eliminates operational overhead for a demo-scale workload; native S3 integration simplifies IAM
• Single-chunk embedding — each RSS article is embedded as one vector (no chunking) because articles are short enough to fit within the Titan V2 token limit
• Cosine distance metric — chosen for normalized text embeddings where direction matters more than magnitude
• Composite scoring (0.8 similarity + 0.2 recency) — balances relevance with freshness so recent announcements surface even if slightly less similar
• Cross-region inference profile inference profile
  A Bedrock cross-region inference profile that routes requests to the nearest available region. Used for the LLM (au.anthropic.claude-sonnet-4-5-20250929-v1:0). — avoids single-region capacity limits for the LLM by routing to the nearest available region
• EventBridge daily schedule — keeps the corpus fresh without manual intervention; manual trigger available via API for immediate updates
• Cognito JWT authorizer — secures the API without custom auth code; group-based access control via Cognito groups
• Amplify static hosting — zero-config HTTPS hosting with automatic deployments triggered by Terraform

External links

AWS documentation

• Amazon S3 Vectors documentation
• Amazon Bedrock documentation
• Amazon Bedrock model access
• Amazon Titan Embeddings V2
• Amazon Cognito developer guide
• AWS Lambda developer guide

Terraform provider

• Terraform AWS Provider — s3vectors_vector_bucket
• Terraform AWS Provider — s3vectors_index
• Terraform AWS Provider changelog

Model documentation

• Anthropic Claude on Bedrock
• Bedrock cross-region inference