Building a Federal Compliance Portal with AI in 5 Days

White Paper — ItBytes LLC
June 2026

Abstract

This paper documents the creation of a CMS-compliant federal compliance portal using AI coding assistants. In 5 days (May 10–15, 2026), a solo developer built a full-stack application with 21 API endpoints, NIST 800-53 control mapping, IAM Identity Center authentication, and serverless infrastructure — at 1.4% of the equivalent contractor cost. The paper covers what AI did well, the architecture produced, and the productivity gains achievable when AI is paired with a developer who maintains oversight.

1. The Task

Build kornerstor3 — a CMS ARS compliance portal with: - 21 API endpoints (Go Lambda) - DynamoDB single-table design - IAM Identity Center SAML → Cognito authentication - CloudFront + S3 static site with WAF - NIST 800-53 control mapping - Blueprint-driven infrastructure deployment - Zero-trust API authorization

Timeline: 5 days. Team: 1 architect + AI assistants (Amazon Q, Kiro CLI, Claude).

2. What Was Built

Component	Detail
API endpoints	21 Go Lambda handlers (compliance, blueprints, identity, inventory, docs)
Frontend	HTML/JS/CSS, 508-compliant, WCAG 2.1 AA
Authentication	IAM Identity Center → SAML → Cognito → JWT
Authorization	Group-based RBAC (admin, developer, viewer)
Data store	DynamoDB single-table, encrypted at rest
Infrastructure	CloudFront, WAF, API Gateway, Lambda (arm64), S3
Compliance	352 NIST controls mapped, OSCAL export
Security	WAF IP allowlist, geo-blocking, XSS prevention, input validation
IaC	Terraform (modular), CloudFormation fallback

3. Cost

Category	Cost
AI coding assistants (5 days)	~$55
AWS Infrastructure	~$12
Total	~$67

The equivalent labor at federal contractor rates ($150/hr) for 5 days of full-time development: $6,000. AI delivered at 1.1% of that cost.

Over the full 47-day lifecycle (including lockout recovery), the total came to $794 — still 1.4% of the $56,400 equivalent.

4. What AI Did Well

Capability	Evidence
Bulk code generation	15K+ lines of Go across 30+ packages in 5 days
Terraform infrastructure	VPC, Lambda, API Gateway, DynamoDB, WAF, CloudFront
Security control documentation	OSCAL, NIST 800-53 mappings, inherited controls
Pattern implementation	Store interfaces, middleware, RBAC, XSS prevention
Rapid iteration	Blueprint system (model + template + validation + UI) in one session
Compliance artifacts	Generated control implementation statements from code analysis

5. Architecture

User → kornerstor3.dti.it4bytes.com
     → CloudFront (ACM TLS 1.2+, WAF geo-block)
     → API Gateway HTTP API
     → Lambda (Go, arm64)
     → DynamoDB (encrypted, PITR)

Auth: Identity Center → SAML → Cognito → JWT → Lambda authorizer

Key Design Decisions

Decision	Rationale
Single Lambda binary	Fast cold starts, simple deployment, one artifact
DynamoDB single-table	No connection management, pay-per-request, unlimited scale
arm64 (Graviton)	20% cheaper, 20% faster than x86 for Go
CloudFront + WAF	Edge caching, DDoS protection, IP allowlist
Terraform modular	Shared modules for VPC, Lambda, CloudFront patterns

6. Guardrails Required

AI produces code fast. Producing correct code requires human oversight at every step:

Guardrail	Why
Requirements before code	AI will build the wrong thing without a spec
Smoke test after every deploy	AI declares “done” without verifying
Deploy scripts, not raw commands	Prevents partial deploys and missed steps
Account verification before apply	AI doesn’t check which account it targets
All commands as .sh files	Copy-paste from chat causes whitespace errors

7. Recommendations

AI is a force multiplier, not an autonomous operator. It produces 10x output but requires 100% verification.
Write requirements first. The 5-day timeline was possible because each feature had a documented spec before coding started.
Automate verification. Smoke tests, health checks, and validation scripts are non-negotiable.
Use deploy scripts. Never run raw terraform apply — wrap it in a script that handles build + upload + apply + verify.
Tag everything. Every resource gets Project + Environment + ManagedBy tags. Drift is caught automatically.

8. Conclusion

A single architect with AI assistants built a production-ready federal compliance portal in 5 days for $67. The application is fully operational, serving real compliance workflows, and meeting CMS ARS security requirements. AI made this possible — but only because the developer maintained control over architecture decisions, verified every deployment, and refused to accept “done” without proof.

ItBytes LLC — June 2026