Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size. Uses EventBridge to trigger a Step Functions state machine when objects are uploaded to S3. Small files are processed by Lambda, large files by a Fargate task. Includes VPC, ECR repository, ECS cluster, and scoped IAM roles. Trigger keywords: Step Functions, Fargate, Lambda, S3 event, EventBridge, ECS, ECR, file processing, workflow orchestration, serverless.
This skill deploys an event-driven file-processing workflow on AWS using the official CLI. When a file is uploaded to an S3 bucket, EventBridge triggers a Step Functions state machine that inspects the file size and routes work to either a Lambda function for small files (up to 6 MB) or an ECS Fargate task for large files. It solves the problem of needing size-aware compute routing for uploads without hand-assembling the many services involved.
The procedure provisions the full stack: an S3 bucket with EventBridge notifications, an EventBridge rule, a Step Functions state machine with a Choice state, a Lambda function, an ECS Fargate task, a VPC with two subnets and an internet gateway, a security group whose egress is restricted to HTTPS and DNS, an ECR repository for the container image, and optional KMS-encrypted CloudWatch Logs. It emphasizes least-privilege IAM, creating four scoped roles (Lambda, ECS task execution, ECS task, and Step Functions) plus a separate EventBridge target role, each granted only the specific actions and resources it needs, such as s3:GetObject on the target bucket or states:StartExecution on the named state machine. It verifies dependencies (AWS CLI v2, Python 3.12, Docker), gathers and validates parameters up front, and waits for IAM propagation.
Target users are serverless and platform engineers who need to orchestrate mixed-size file processing with Step Functions, Lambda, and Fargate. It provisions real, billable infrastructure through official AWS tooling and follows scoped-permission and restricted-egress best practices rather than performing risky operations.
EventBridge triggers a Step Functions state machine on S3 object creation; a Choice state sends files up to 6 MB to Lambda and larger files to an ECS Fargate task.
AWS CLI v2 (configured), Python 3.12 for the Lambda runtime, and Docker for building and pushing the Fargate container image.
When all files are small enough for Lambda (use S3 to Lambda directly), when you need real-time streaming (use Kinesis), or when you don't need file-size-based routing.
It creates four roles plus a separate EventBridge role, each with least-privilege policies, for example s3:GetObject limited to the target bucket and states:StartExecution limited to the named state machine.
Yes. The Fargate security group is configured to allow only HTTPS and DNS outbound rather than open egress.
Quick Setup:
.claude/skills/Repository
aws/agent-toolkit-for-aws