Architecture
How Snitch is built. This section is written for developers and operators working on the system itself — it is the only part of the documentation that assumes familiarity with AWS internals.
System Overview
Snitch is a fullstack AWS application on Amplify Gen 2. It keeps two complementary stores — DynamoDB for application records and AWS Verified Permissions for policy decisions — and hands the grant-and-revoke choreography to Step Functions.
┌─────────────────────────────────────────────────────────┐
│ Browser │
│ React 19 + Cloudscape Design System │
└────────────────────────┬────────────────────────────────┘
│ GraphQL (Cognito user pool auth)
┌────────────────────────▼────────────────────────────────┐
│ AWS AppSync │
└──┬──────────────┬────────────────────────────────┬──────┘
│ │ │
▼ ▼ ▼
DynamoDB Lambda resolvers Step Functions
(4 tables) (CRUD, evaluation, (JIT grant/revoke
│ approval, audit) state machine)
│ │ │
│ ▼ ▼
│ AWS Verified Permissions IAM Identity Center
│ (Cedar — authoritative for (SSO Admin API:
│ every access decision) assign / remove)
│
▼
DynamoDB Stream (AccessRequestTable)
│
▼
publishRequestStatusChange ──► AppSync subscription ──► Browser
Slack ◄──► Lambda Function URL (HMAC-verified)
Amazon SNS ◄── notification publishers
How to Read This Section
| Page | Covers |
|---|---|
| Stacks & Lambda Placement | The five CloudFormation stacks, all 31 Lambdas, and where IAM grants live |
| Data Model & Storage | The four DynamoDB tables, the dual-write ordering, and the stream |
| GraphQL API & Live Updates | Every operation with its authorization rule, and how tables update without polling |
| Access Request Workflow | All eleven Step Functions states, task tokens, and failure handling |
| Authorization | The Cedar schema, both authorization checks, and how group claims are minted |
| Notifications & Slack Integration | The notification module, the Slack endpoint, and its signature verification |
| Configuration & Project Layout | Build-time and runtime environment variables, and the repository tree |