Serverless Email Gateway | Cognito Auth, Zero Server Ops
Client / Industry
Enterprise internal tooling / secure notifications
🛑 The Business Challenge
Several internal applications — including a legacy program — needed to send authenticated email notifications through the organization's Office 365 SMTP relay. Giving each app direct SMTP credentials would mean scattering sensitive credentials across both modern and legacy systems, with no central audit trail of what was actually sent.
- Credential sprawl: giving every client app direct SMTP credentials multiplies the exposure risk
- Legacy compatibility: an older, non-cloud-native program still needed to send authenticated email through the same pipeline
- Auditability: there was no central log of what was sent, to whom, or whether delivery succeeded
- Observability: no consistent way to monitor delivery health across all the applications using the relay
Solution: Serverless, Token-Mediated Email Middleware
We designed and implemented a serverless middleware layer, entirely on managed AWS services within a VPC-scoped account, that mediates every email send through short-lived tokens instead of shared credentials.
- Zero Credential Sharing: Amazon Cognito issues short-lived ID tokens — client apps, including the legacy program, never touch SMTP credentials directly
- Token Validation: Amazon API Gateway validates every incoming token against Cognito before routing any request, with no custom auth code needed
- Stateless Compute: A .NET AWS Lambda function builds and dispatches the outbound email payload, scaling automatically with request volume
- Full Auditability: Amazon RDS persists a complete log of every message and its delivery status, supporting compliance and troubleshooting
- Infrastructure as Code: AWS CloudFormation keeps the environment reproducible and version-controlled
💻 Modern Technical Architecture
Authentication: Amazon Cognito issues short-lived ID tokens; no long-term credentials are ever exposed to client apps
API Layer: Amazon API Gateway validates tokens directly against Cognito before forwarding requests
Compute: A stateless .NET AWS Lambda function handles the core send logic
Data & Observability: Amazon RDS for the audit log, CloudWatch for monitoring, Certificate Manager for TLS, CloudFormation for infrastructure-as-code deployment
Technology
📋 Project Technical Summary
| SEO Category | Technology Implemented |
|---|---|
| Industry | Enterprise Internal Tooling / Secure Notifications |
| Core Stack | AWS Lambda (.NET), Cognito, API Gateway, RDS |
| Security Model | Token-mediated access, zero shared SMTP credentials |
| Infrastructure | CloudFormation (IaC), VPC-scoped AWS account |
| Key Outcome | Secure, auditable, serverless replacement for direct-SMTP integration |
Result
Replaced a legacy direct-SMTP integration with a secure, observable, horizontally scalable notification pipeline
Business Impact
Reduced credential exposure risk across both modern and legacy client applications, with full delivery visibility via CloudWatch and the RDS audit trail
🚀 Project Results & Impact
🔒
Zero Credential Exposure: Client apps, including the legacy program, never touch SMTP credentials directly
📋
Full Auditability: Every send attempt and its delivery outcome is logged for compliance and troubleshooting
⚙️
Serverless Scale: Stateless Lambda compute scales automatically with request volume at low operating cost
Discuss a Similar Project
Have a similar project in mind? Let's discuss your specific requirements.