What it does
VulnFlow accepts scanner reports, stores the payload privately and processes it asynchronously into normalized results. It treats duplicate delivery and failures between upload, publication and processing as expected conditions.
Architecture and data flow
Agent / Trivy
→
VPS API
→
Private S3
upload
upload
→
PostgreSQL Outbox
publish event
publish event
→
SQS
consume
consume
→
Java Lambda → DynamoDB
persist result
persist result
SQS failure path
Retries exhausted → DLQ
Operational boundaries
Terraform provisions AWS · CloudWatch logs · IAM Roles Anywhere gives VPS temporary credentials
Engineering decisions
Durable payloads
S3 holds reports; events reference work.
S3 holds reports; events reference work.
Reliable publication
Outbox records work before queue publication.
Outbox records work before queue publication.
Idempotent processing
Event identity protects against at-least-once delivery.
Event identity protects against at-least-once delivery.
Recoverable failure
Retries, partial-batch handling and DLQ redrive are explicit.
Retries, partial-batch handling and DLQ redrive are explicit.
Security and trade-offs
Storage is private and encrypted, with public access blocked and TLS-only access. Human access is MFA-gated; the workload uses temporary credentials. The cost-aware serverless design favors low operational overhead over speculative scale.