Kornerstor3: A Unified Platform Portal for Cloud Operations

Author: ItBytes LLC
Version: 1.0
Date: August 2026

Abstract

Kornerstor3 is a serverless platform portal that consolidates infrastructure deployment, compliance management, identity administration, and operational visibility into a single authenticated web application. Built on AWS Lambda (Go), DynamoDB, and CloudFront, it eliminates tool sprawl by providing a unified interface for teams managing cloud environments at scale.

This paper describes the platform’s architecture, features, and operational model.

1. Problem Statement

Organizations managing AWS infrastructure face a recurring challenge: critical operations are scattered across dozens of tools, consoles, scripts, and tribal knowledge. Teams context-switch between the AWS Console, CLI scripts, compliance spreadsheets, identity providers, and deployment pipelines — with no single pane of glass to coordinate work or enforce standards.

The consequences are predictable:

• Configuration drift — manual changes bypass Infrastructure as Code and go undetected.
• Compliance gaps — security findings accumulate because no one owns the remediation workflow.
• Deployment friction — developers need AWS expertise to stand up standard infrastructure patterns.
• Visibility loss — understanding what is deployed, who has access, and what state things are in requires querying multiple systems.

Kornerstor3 solves this by consolidating these operations into a single authenticated portal backed by serverless infrastructure.

2. Architecture

2.1 High-Level Design

Browser → CloudFront → API Gateway → Lambda (Go) → DynamoDB
                                   → S3 (static site + white papers)
                                   → ECS Fargate (terraform-runner)
                                   → IAM Identity Center (SSO)
                                   → Security Hub (findings)
                                   → Athena (inventory queries)

2.2 Components

2.3 Security Layers

3. Features

3.1 Blueprint System — Infrastructure from Templates

Kornerstor3’s blueprint system allows teams to deploy standardized infrastructure without writing Terraform manually.

How it works:

1. An administrator defines a blueprint template (e.g., “Lambda API with DynamoDB and CloudFront”).
2. A developer creates an instance of that blueprint, filling in parameters (project name, environment, memory size).
3. The portal validates inputs — enforcing type constraints, CIDR format, ARN patterns, and enum values.
4. The developer clicks Plan — an ECS Fargate task generates the Terraform plan.
5. An administrator clicks Apply — the task executes terraform apply in an isolated container.
6. Deploy Code builds and uploads Lambda binaries to S3.

Security controls:

• Input validation rejects XSS, template injection, and invalid types server-side.
• Sensitive values (passwords, tokens) are classified automatically and stored encrypted (AES-256-GCM) — never exposed in API list responses or plan output.
• Apply and Destroy operations require admin group membership.
• All actions produce an audit trail with user, timestamp, and outcome.

Operational model:

• Blueprints generate real Terraform — teams are not locked into a proprietary abstraction.
• The Fargate runner uses Graviton arm64 with an EFS build cache for fast execution.
• Running tasks can be cancelled from the UI.

3.2 Compliance Management

Kornerstor3 provides continuous compliance tracking against NIST 800-53, CMS ARS, and CIS Benchmarks.

Capabilities:

• Control catalog — browse all applicable controls with implementation status (implemented, planned, inherited, not applicable).
• Evidence collection — automated Lambda (lambda-evidence-sync) gathers evidence from Security Hub, IAM, CloudTrail, and SSM and maps it to specific controls.
• Findings pipeline — Security Hub findings are ingested, correlated to controls, and displayed with remediation status and owner assignment.
• Inherited controls — PaaS/IaaS controls inherited from AWS are documented with annual review tracking.
• OSCAL export — compliance state can be exported in machine-readable OSCAL format.
• Approval workflows — findings require documented remediation and approval before closure.

3.3 AWS Resource Inventory

Real-time visibility into all deployed AWS resources.

Capabilities:

• On-demand scanning — trigger inventory scans from the UI that enumerate resources across all configured accounts.
• Split-panel browsing — resource list with detail panel showing tags, configuration, and relationships.
• Drilldown — click any resource to see its full configuration, compliance status, and tag conformance.
• Athena integration — ad-hoc SQL queries over historical inventory data stored in S3 with Hive-style partitioning.
• Progress tracking — live progress indicators during multi-account, multi-service scans.
• Export — inline export of filtered results.

3.4 Identity and Access Management

Kornerstor3 integrates with AWS IAM Identity Center for centralized identity administration.

Capabilities:

• User management — view and manage Identity Center users and group memberships.
• Group administration — assign users to groups that control portal access and AWS permissions.
• Role visibility — see which IAM roles exist, which projects own them, and what policies are attached.
• Application registry — track all SSO applications with their assignment status.
• Access request workflow — structured process for requesting elevated access.
• Audit trail — all identity changes logged with actor, timestamp, and before/after state.

3.5 Document Portal

Kornerstor3 serves organizational documentation — standards, SOPs, onboarding guides — via its built-in document system.

Capabilities:

• Document ingestion — scan directories of Markdown/text files and index them in DynamoDB.
• Full-text search — find documents by content or metadata.
• Encrypted documents — sensitive SDLC artifacts stored with per-document encryption keys, decrypted only for authorized users.
• GitHub sync — documents sourced from GitHub repositories, synced automatically.

3.6 White Paper Publishing

A lightweight publishing pipeline for technical white papers.

Workflow:

1. Author writes a paper in Markdown.
2. publish-white-paper.sh converts it to styled HTML via pandoc with a professional template.
3. A manifest is auto-generated from all published papers.
4. Static files sync to S3 and serve via CloudFront.

Papers are publicly accessible — no authentication required for read access.

3.7 Deployment and CI/CD

Kornerstor3 includes built-in deployment capabilities for the projects it manages.

Capabilities:

• Deploy from portal — trigger infrastructure deployments without CLI access.
• CI build integration — ECS-based build runner compiles Go Lambda binaries, pushes to S3, and updates Lambda function code.
• GitHub webhook ingestion — receive push events to trigger rebuilds.
• Deployment status — real-time status of running deployments with log output.
• Pipeline tracking — view SDLC pipeline stage for each project (dev → staging → prod).

3.8 Security Operations

Capabilities:

• WAF IP allowlist automation — IP changes detected and propagated to WAF rules via EventBridge + Lambda.
• Security Hub findings dashboard — view, filter, assign, and remediate findings.
• Automated remediation — Lambda-driven auto-fix for common findings (unencrypted resources, missing tags, overly permissive policies).
• Log management — centralized log viewer with tiered retention (hot → warm → archive).
• Drift detection — compare live infrastructure state against Terraform state.

3.9 Visitor Feedback

Public visitors can submit feedback on white papers and public content. Submissions are stored in DynamoDB and surfaced in the admin UI for review.

3.10 Project Scaffolding

The “Creates” module generates new project repositories from templates, pre-configured with:

• Standard directory structure
• CI/CD workflows
• Terraform infrastructure stubs
• OSCAL compliance manifests
• README and CHANGELOG templates

4. Deployment Model

4.1 Infrastructure as Code

All kornerstor3 infrastructure is managed via Terraform with modular composition:

• Shared resources (WAF IP sets, VPC endpoints) deploy via itbackend.
• Application resources (Lambda, API Gateway, DynamoDB, CloudFront, ECS) deploy via infra/terraform/deploy.sh.
• S3 backend with DynamoDB state locking.

4.2 Operational Scripts

4.3 DR / Failover

Static content (white papers, publications) fails over to Cloudflare Pages for rapid recovery. DNS switches from CloudFront to Cloudflare within minutes. The API and data layer remain on AWS.

5. Technology Stack

6. Design Principles

1. Serverless by default — no servers to patch, no idle compute costs. Lambda scales to zero.
2. Zero-trust authorization — every request validated. No implicit trust between layers.
3. Infrastructure as code, always — nothing deployed via console clicks. All state in Terraform.
4. Compliance as code — security controls are testable, evidence is machine-gathered, findings are tracked to closure.
5. Single binary — the entire API compiles to one Go binary. Fast cold starts, simple deployment.
6. Accessibility first — all UI meets Section 508 / WCAG 2.1 AA. No compromises.
7. Operational transparency — every action audited, every deployment logged, every drift detected.

7. Outcomes

8. Conclusion

Kornerstor3 is not a replacement for AWS — it is a force multiplier for teams operating within it. By consolidating deployment, compliance, identity, and visibility into a single serverless portal, it eliminates the operational overhead that accumulates when these concerns are managed separately.

The platform is fully operational, deployed via Terraform, and serving the ItBytes engineering team in production.

© 2026 ItBytes LLC. All rights reserved.