▸ AWS Services in This Build

Compute

Lambda 18 functions — door control, lockdown, phone monitor, camera analyze, headcount, inmate lookup, incident create, transfer, visitation, medical, commissary, schedule, audit writer, alarm fanout, MFA verifier, WAF health, drift detector, cost monitor

Fargate Operator console (3 tasks in prod), commissary order processor, report generator

Data

DynamoDB inmates, incidents, visits, phone_calls, audit_ledger, attorney_allowlist — on-demand billing, PITR on every table

S3 recordings bucket (Object Lock COMPLIANCE 7yr, KMS video key), transcripts bucket (phone key), config bucket (general key)

Eventing

EventBridge Single bus, one rule per domain, DLQ on every target

IoT Core Door controllers, sensors, loudspeaker zone — per-thing policies with mutual TLS

SNS Security alarm topic, staff broadcast topic

AI / Media

Kinesis Video 24 camera streams ingested continuously

Rekognition Frame sampling at 1 frame / 5s across active cameras — the reason the cost stays sane

Transcribe Real-time phone call transcription (attorney allowlist checked first)

Comprehend Sentiment + keyword analysis on transcribed calls

Connect Phone system — every inbound call routes through here

Chime SDK Officer-to-officer secure comms (WebRTC mesh)

Identity / Security

Cognito User pool with MFA enforced, groups: operator, supervisor, warden, auditor

KMS 5 customer-managed keys — general, audit, video, phone, secrets

WAF Operator API — default-block, allow-list facility CIDRs only

IAM Compute role cannot decrypt audit key — can write, cannot read back

API

API Gateway REST for door commands, WAF-protected, Cognito authorizer on every method

AppSync GraphQL for operator console, subscriptions for live state

Observability

CloudWatch Per-env log retention, narrow metric filters, alarms that page humans

X-Ray Distributed tracing on the two control-plane functions

Compliance

HealthLake FHIR-compliant medical records, HIPAA covered

Object Lock S3 COMPLIANCE mode — nobody, including root, can delete before 7 years

▸ Sample Pipelines (End to End)

Door Open — Operator Command

• 1. Operator clicks → WebSocket → API Gateway
• 2. Lambda authorizer validates JWT + MFA
• 3. Two-person rule checked (supervisor OR second operator within 10s)
• 4. IoT Core publishes to facility/doors/{id}/command
• 5. Door controller receives (mutual TLS), relay fires
• 6. EventBridge logs the event
• 7. Audit writer Lambda appends to ledger (compute role has PutItem, no GetItem)
• 8. CloudWatch metric filter watches for unlock_denied

Phone Monitoring — Attorney Check First

• 1. Inmate dials → Amazon Connect
• 2. Lambda fires on call start
• 3. Attorney allowlist check runs FIRST
• 4. If attorney → no transcription, only metadata to EventBridge
• 5. If not → Transcribe streams audio, Comprehend analyzes
• 6. Flagged content → EventBridge → SNS → investigator
• 7. Full transcript archived to S3 (7y, phone KMS key)

Camera AI — Frame Sampling

• 1. Camera → Kinesis Video Streams
• 2. Sampler Lambda grabs 1 frame every 5s (not every frame)
• 3. Rekognition detects labels — Person, Fight, Fall
• 4. High-confidence anomalies → EventBridge
• 5. Operator console gets live alert via AppSync

Lockdown — Cascading Fanout

• 1. Commander triggers (MFA required)
• 2. EventBridge receives LockdownTriggered
• 3. Lambda fanout publishes wildcard IoT message
• 4. Every door controller receives simultaneously (QoS 2)
• 5. SNS alerts all staff (SMS + email)
• 6. Two-person rule enforced for FULL lockdown
• 7. Auto-release after 4h without renewal

Cell Transfer — Atomic Write

• 1. Operator selects source + destination
• 2. Lambda runs DynamoDB TransactWriteItems
• 3. Both cells updated or neither — no partial state
• 4. IoT opens source door, then destination door
• 5. Escort officer notified via AppSync

▸ What This Actually Costs

AWS Bill — Monthly

• NAT gateway: $96 (prod, 3 AZs)
• NAT data processing: ~$45 (cut sharply by VPC endpoints)
• Lambda: ~$38
• Fargate: ~$74
• Kinesis Video: ~$110
• Rekognition: ~$180 (sampled — would be ~$18,000 if every frame analyzed)
• Transcribe: ~$40
• DynamoDB: ~$52
• S3 + Object Lock: ~$48
• KMS (5 keys): ~$8
• CloudWatch: ~$47
• Total prod: ~$738 / month
• Total dev: ~$82 / month (no cameras, 1 NAT)

What It Costs to Build

• Architecture + compliance scoping: 4–8 weeks
• Reference implementation: 3–6 months
• Integration with existing cameras, doors, PBX: 2–4 months
• Typical range: $250k – $600k one-time

What It Costs to Run

• AWS bill (per env): ~$1k/yr dev, ~$9k/yr prod
• 24/7 monitoring + IR: $80k – $200k/yr
• Compliance audits (PREA/HIPAA): $20k – $50k/yr
• Firmware + integration maintenance: $40k – $120k/yr

The Honest Shortcut

The AWS bill is not the expensive part. It is roughly 5% of annual cost of ownership. The rest is people, compliance, and physical integration with forty-year-old hardware.

▸ Compliance & Controls

PREA (Prison Rape Elimination Act)

• All incident records immutable (Object Lock COMPLIANCE, 7 years)
• Every access to inmate records logged with actor identity
• Auditor role has read-only, cannot mutate operational state

HIPAA (Medical Records)

• HealthLake is FHIR-compliant, covered under AWS BAA
• Medical records encrypted with a dedicated KMS key
• Access restricted to medical role via Cognito group
• Every access logged — no PHI exposed to non-medical roles

Attorney-Client Privilege

• Attorney allowlist is the FIRST check in the phone pipeline
• Privileged calls are never transcribed, never analyzed
• Allowlist maintained by legal team, not engineering
• Fail-closed: if allowlist unavailable, no transcription happens

Two-Person Rule

• Unlock requires supervisor OR two operators within 10s window
• Lockdown requires two distinct confirmations
• Enforced in Lambda, not in UI — a UI bypass cannot bypass the rule
• Denials are themselves auditable events

Audit Immutability

• Audit ledger encrypted with a separate KMS key
• Compute role has PutItem — can append, cannot read back
• Reader role is separate, assumed only by auditor group
• CloudTrail alarm on kms:PutKeyPolicy against audit key

Network

• No public compute — everything in private subnets
• VPC endpoints for S3, DynamoDB, KMS, Secrets Manager
• WAF default-block on operator API (allow-list facility CIDRs)