Week 10 Worklog

Week 10 Objectives:

  • Revise the DocuFlow AI architecture after evaluating that Bedrock should not be a mandatory dependency for the Free Tier/workshop environment.
  • Replace the Bedrock normalization step with an external AI provider/API called through a Lambda adapter while keeping the post-Textract JSON normalization flow.
  • Rewrite the proposal and workshop so the architecture, cost model, risks, and implementation steps match the new design.

Tasks to be carried out this week:

DayTaskStart DateCompletion DateReference Material
2- Review Free Tier and AI access constraints
  + Check Bedrock pricing and model access requirements
  + Decide that Bedrock should not be mandatory in the MVP
  + Move to an external AI approach to reduce account/policy risk		06/22/202606/22/2026Amazon Bedrock Pricing
AWS Free Tier
3- Revise the system architecture
  + Remove the Bedrock state from the Step Functions workflow
  + Add an externalAiNormalize Lambda that calls an external AI API
  + Store the API key in Secrets Manager instead of code or frontend config
  + Update the diagram and data flow		06/23/202606/23/2026AWS Lambda
AWS Secrets Manager
Step Functions
4- Update the data contract, status model, and error handling
  + Keep the shared JSON schema for invoices/receipts
  + Add EXTERNAL_AI_FAILED handling or map it to REVIEW_REQUIRED/FAILED
  + Update workflow retry/catch behavior
  + Adjust the IAM role for the Lambda adapter		06/24/202606/24/2026Step Functions Error Handling
IAM Best Practices
5- Update cost and risk analysis
  + Remove Bedrock from the AWS baseline cost table
  + Add external AI provider cost by request/token
  + Add risks for API keys, quota, latency, network timeout, and sensitive data leaving AWS
  + Update cost control and cleanup checklists		06/25/202606/25/2026AWS Budgets
CloudWatch Logs
Secrets Manager Pricing
6- Rewrite the proposal based on the new architecture
  + Update the executive summary, architecture, service selection, and workflow
  + Replace Bedrock with the External AI Lambda Adapter
  + Update the timeline, cost estimation, risk mitigation, and definition of done		06/26/202606/26/2026AWS Well-Architected Framework
Serverless Lens
7- Rewrite the workshop based on the updated proposal
  + Update overview, prerequisites, and the AI extraction module
  + Rewrite the external AI secret configuration steps
  + Update deploy steps, test cases, evidence, and cleanup
  + Re-check workshop internal links		06/27/202606/27/2026AWS SAM
S3 Presigned URL Upload
Amazon Textract AnalyzeExpense

Week 10 Achievements:

  • Reconfirmed the DocuFlow AI architecture direction:

    • Bedrock is no longer a mandatory MVP component because of policy/model access/cost risk in Free Tier or workshop accounts.
    • Textract remains responsible for invoice/receipt data extraction.
    • Normalization, classification, and JSON schema generation now move to an external AI provider behind a dedicated Lambda adapter.

  • Updated the processing flow:

    • The user uploads an invoice/receipt to the S3 raw bucket using a presigned URL.
    • The S3 Object Created event flows through EventBridge and SQS.
    • Step Functions orchestrates file validation, Textract, externalAiNormalize, JSON validation, result persistence, and status updates.
    • DynamoDB stores metadata/status; S3 processed stores result JSON; CloudWatch and SNS handle logs, alarms, and notifications.

  • Redesigned the external AI integration:

    • A Lambda adapter isolates external AI API calls from the main workflow.
    • The API key is stored in AWS Secrets Manager, not in frontend code, source code, or public configuration files.
    • The adapter handles sensitive-data masking when needed, input length limits, timeout, retry, and response normalization into the internal schema.

  • Updated the data contract and status model:

    • Kept the shared schema with documentId, userId, fileName, documentType, vendorName, invoiceDate, currency, totalAmount, taxAmount, lineItems, confidenceScore, status, s3RawPath, and s3ProcessedPath.
    • Added handling for external AI failures such as timeout, quota exceeded, invalid JSON, and schema mismatch.
    • Failures can move to REVIEW_REQUIRED when human review is useful, or FAILED when the workflow cannot continue.

  • Updated the cost analysis:

    • Removed Bedrock from the AWS baseline cost.
    • Kept the main AWS services: Cognito, S3, CloudFront, API Gateway, Lambda, EventBridge, SQS, Step Functions, Textract, DynamoDB, CloudWatch, SNS, Secrets Manager, and SAM/CloudFormation.
    • Added external AI provider cost as a separate item based on request/token usage and outside AWS Free Tier.
    • Added cost controls: demo file limit, page-per-file limit, input/output token limits, budget alerts, and post-workshop cleanup.

  • Updated the risk matrix:

    • External AI API key exposure is mitigated with Secrets Manager and least-privilege IAM.
    • Quota/rate-limit risk is mitigated with controlled retry, timeout, and fallback to REVIEW_REQUIRED.
    • Sensitive data leaving AWS is mitigated by sending only fields needed for normalization, masking when required, and documenting the boundary in the workshop.
    • Latency/network timeout risk is mitigated with Step Functions retry/catch and explicit statuses.

  • Reworked the proposal:

    • Updated the high-level architecture and service selection.
    • Replaced Bedrock with the External AI Lambda Adapter.
    • Updated workflow, cost estimation, risk mitigation, security baseline, and definition of done.
    • Synchronized the bilingual Vietnamese and English content.

  • Reworked the workshop:

    • Updated overview and prerequisites for the new architecture.
    • Rewrote the AI extraction module to use Textract + external AI adapter instead of Textract + Bedrock.
    • Added secret configuration, deployment, happy-path test, low-confidence/failure-path test, and cleanup steps.
    • Rechecked the evidence checklist for the final report.