A contact form built on a fully serverless AWS stack — API Gateway, Lambda, and SES — with Google reCAPTCHA v3 bot protection. Demonstrates Infrastructure as Code using Terraform.
A static HTML form hosted on S3 behind CloudFront sends POST requests to API Gateway, which triggers a Lambda function. The Lambda validates the reCAPTCHA v3 token, sanitizes the input, and forwards the message via SES. Terraform manages the entire infrastructure as code, including IAM roles, API Gateway routes, and Lambda environment variables.
The first invocation after a period of inactivity could take over 2 seconds due to the cold start. Provisioned Concurrency was considered but ultimately avoided to keep costs at zero. The contact form use case was latency-tolerant, so this was acceptable.
Crafting a minimal IAM policy that allowed SES send operations without granting broad permissions required careful reading of the AWS documentation. The final policy restricted actions to ses:SendEmail and ses:SendRawEmail on a specific verified identity.