How I used AWS Lambda and Amazon S3 to build a scalable certificate platform that minimizes storage costs while improving security.
Introduction
In my previous article, I shared why I decided to build a serverless certificate generation system for our student community. As our events grew, manually generating and distributing certificates became increasingly difficult because:
- Gmail SMTP had daily sending limits and required one of us to keep a laptop running until all 200-300 certificate emails were delivered.
- Google Apps Script required storing every generated certificate in Google Drive, leading to unnecessary long-term storage.
- Traditional mailing APIs still required certificate generation to run on our own infrastructure, making the process compute-intensive and consuming our Cloudflare Workers quota.
- Bulk email delivery through these approaches also increased the risk of emails being delayed or marked as spam.
These limitations made us rethink the entire workflow. Instead of trying to optimize the existing solution, we designed a serverless architecture on AWS that could generate certificates on demand, store them securely, and significantly reduce operational overhead.
The Challenge
Every event concludes with hundreds of participants expecting their certificates within minutes.
While generating a certificate isn't particularly difficult, doing it reliably for hundreds of users introduces several operational challenges.
The system needed to:
- Scale automatically during peak demand.
- Deliver certificates quickly.
- Avoid long-running servers.
- Reduce long-term storage.
- Keep certificate files secure.
- Be inexpensive enough for a student-led community.
Rather than permanently storing every generated PDF, I wanted a smarter approach that stored only what was necessary.
Architecture Overview
The platform uses a simple serverless architecture built entirely on managed AWS services.
Figure 1. High-level architecture of the serverless certificate generation workflow. AWS Lambda checks whether a certificate already exists in Amazon S3. If available, it generates a pre-signed URL for secure access. Otherwise, the certificate is regenerated, uploaded to Amazon S3, and served to the user. An Amazon S3 Lifecycle Rule automatically removes regenerated certificates after the configured retention period.
The idea is straightforward:
- If a certificate already exists, serve it immediately.
- If it doesn't, regenerate it from stored metadata.
- Store it temporarily.
- Automatically remove it later using Amazon S3 Lifecycle Rules.
Why AWS Lambda?
Certificate generation is not a continuous workload.
Immediately after an event, hundreds of participants may request certificates simultaneously, while on other days there may be no requests at all.
AWS Lambda was the ideal choice because it:
- Eliminates server management.
- Automatically scales with demand.
- Charges only when code runs.
- Integrates easily with other AWS services.
This means we never have to keep a server running just to generate certificates.
Why Amazon S3?
Certificates are simply generated PDF files.
Amazon S3 provides:
- Highly durable object storage.
- Excellent scalability.
- Low storage costs.
- Fine-grained access control.
Instead of exposing the bucket publicly, users receive temporary pre-signed URLs that allow secure downloads.
On-Demand Certificate Generation
One of the most important design decisions was treating certificates as derived artifacts instead of permanent data.
The participant information, event details, and certificate template remain the source of truth.
Whenever someone requests a certificate:
- AWS Lambda checks whether the PDF already exists in Amazon S3.
- If it exists, the system immediately returns a pre-signed URL.
- If it doesn't exist, Lambda regenerates the certificate using the stored metadata.
- The newly generated PDF is uploaded to Amazon S3.
- A pre-signed download URL is returned to the user.
Because certificates can always be recreated, there is no need to keep every generated PDF forever.
Automatic Cleanup with Amazon S3 Lifecycle Rules
Keeping generated certificates forever didn't make much sense.
Most participants download their certificate only once or twice. Storing every generated file indefinitely would gradually increase storage usage while retaining documents that might never be accessed again.
To solve this, regenerated certificates are uploaded to Amazon S3 temporarily.
An Amazon S3 Lifecycle Rule automatically removes these files after a short retention period.
This provides several benefits:
- Reduces unnecessary storage.
- Keeps the bucket clean.
- Limits the lifetime of generated certificate files.
- Ensures certificates are recreated only when needed.
Since the system always retains the certificate metadata, deleting the generated PDF never results in data loss.
Security Considerations
Security was another important factor in the architecture.
The platform follows a few simple principles:
- Amazon S3 buckets remain private.
- Users never receive direct bucket access.
- Downloads are provided using temporary pre-signed URLs.
- IAM roles follow the principle of least privilege.
- Generated certificate files are automatically removed after a limited period.
By reducing how long generated PDFs remain in storage, the platform also minimizes unnecessary exposure of sensitive documents.
Cost Optimization
As a student community, every cloud resource matters.
Several architectural decisions help keep operational costs low:
- AWS Lambda runs only when certificates are requested.
- Amazon S3 stores objects efficiently.
- Lifecycle Rules automatically clean up generated files.
- Certificates are regenerated only when required instead of occupying storage forever.
Rather than paying to retain thousands of PDFs indefinitely, the platform stores only what is necessary and recreates generated artifacts on demand.
Lessons Learned
Building this system reinforced several architectural principles.
First, not every generated file needs to be stored permanently. If it can be recreated reliably from source data, temporary storage is often the better choice.
Second, managed AWS services significantly reduce operational complexity. Instead of maintaining servers or writing cleanup scripts, services such as AWS Lambda and Amazon S3 handle much of the infrastructure automatically.
Finally, simple architectures are often the easiest to maintain. By focusing only on the services required for the workflow, the platform remains easy to understand, cost-effective, and scalable.
Conclusion
Migrating our certificate platform to a serverless architecture solved several challenges that we had experienced with previous approaches.
Instead of depending on laptops, SMTP servers, or long-running processes, the platform now generates certificates on demand using AWS Lambda, stores them securely in Amazon S3, and automatically cleans up generated files using Amazon S3 Lifecycle Rules.
The result is a solution that is scalable, secure, and significantly easier to operate.
Sometimes the best optimization isn't generating files faster—it's recognizing that you don't need to keep them forever.
Top comments (0)