Automating AWS Community Onboarding with Lambda, GitHub Actions, and Cognito
How Golden Jackets Brazil onboards new members in under 60 seconds — from form submission to live member card — with zero manual intervention.
On the second week of Golden Jackets Brazil, I received 8 member applications in a single day. Each one meant: create the HTML card, upload the photo to S3, create a Cognito user, send a
welcome email, update the map pins, deploy. Two hours gone. I looked at my screen and thought: "I'm a TAM. I automate things for clients every day. Why am I doing this manually?"
welcome email, update the map pins, deploy. Two hours gone. I looked at my screen and thought: "I'm a TAM. I automate things for clients every day. Why am I doing this manually?"
So I built a pipeline. And honestly, the first version was terrible.
What I was dealing with
Golden Jackets Brazil is a community of professionals who hold all 12 active AWS certifications. We launched three weeks ago and grew to 40 members fast — way faster than I expected. The
website is a static site on S3 + CloudFront, and every member gets a card with their photo, name, location, and LinkedIn.
website is a static site on S3 + CloudFront, and every member gets a card with their photo, name, location, and LinkedIn.
The problem was simple: I couldn't keep up. Every new member was 15-20 minutes of manual work, and I was doing this after work hours.
The pipeline I built
The idea: member fills a form on the website, and everything else happens without me touching anything. I just approve a PR.
Here's what happens when someone applies:
Step 1 — The form hits a Lambda (gj-apply)
This Lambda talks to the GitHub API. It creates a branch, uploads the photo, generates the member card HTML, injects it into index.html, and opens a Pull Request. It also pings me on
Discord and sends an SNS notification.
Discord and sends an SNS notification.
The card generation was the tricky part. I needed to insert HTML in the right place without breaking the page. My first approach was searching for specific strings in the HTML — something
like "find the closing </section> tag and insert before it." This broke every single time someone changed the layout. Every. Single. Time.
like "find the closing </section> tag and insert before it." This broke every single time someone changed the layout. Every. Single. Time.
The fix was embarrassingly simple: HTML comments as anchors.
html
<!-- END_GOLDEN_JACKETS -->
<!-- END_CHALLENGERS -->
<!-- END_ALUMNI -->
<!-- END_GOLDEN_JACKETS -->
<!-- END_CHALLENGERS -->
<!-- END_ALUMNI -->
The Lambda inserts new cards right before these comments. Layout changes? Doesn't matter. The comments never move.
Step 2 — I approve the PR
This is the only manual step. I look at the PR, check the photo looks right, and hit merge. Takes 10 seconds.
Step 3 — GitHub Actions takes over
Two workflows fire on merge:
deploy.yml does the obvious stuff (sync to S3, invalidate CloudFront, run smoke tests). But it also does something I'm proud of: auto-numbering. Each member card has a sequential number (#
1, #2, #3...). Instead of making the Lambda figure out the next number (which caused race conditions when two people applied at the same time), the deploy step scans the HTML, finds cards
without numbers, and assigns the next one. Simple, reliable, no conflicts.
1, #2, #3...). Instead of making the Lambda figure out the next number (which caused race conditions when two people applied at the same time), the deploy step scans the HTML, finds cards
without numbers, and assigns the next one. Simple, reliable, no conflicts.
create-user.yml creates the Cognito account and sends the welcome email. But here's a detail that took me a failed onboarding to learn: it waits 30 minutes before sending the email. Why?
Because CloudFront propagation takes time. If the member gets the email immediately and clicks the link, their card might not be live yet. Awkward. The 30-minute delay fixes that.
Because CloudFront propagation takes time. If the member gets the email immediately and clicks the link, their card might not be live yet. Awkward. The 30-minute delay fixes that.
Security (because I'm paranoid)
I'm a TAM. I've seen what happens when people skip security. So:
- API Gateway has rate limiting (10 req/s). Nobody's DDoSing my community form.
- The Lambda validates everything: name length, LinkedIn URL format, email regex, member type whitelist. It strips HTML tags from inputs.
- WAF blocks common attacks (XSS, SQLi, scrapers).
- GitHub Actions uses OIDC federation — no static AWS credentials anywhere.
- Admin endpoints require a valid Cognito JWT.
Is it overkill for a community site? Maybe. But it costs nothing extra and I sleep better.
What it actually costs
| What | Cost |
|---|---|
| Lambda invocations | $0.0000002 per onboarding |
| API Gateway | $0.000001 per request |
| S3 storage | $0.02/month total |
| CloudFront | $0.50-2.00/month |
| Cognito | Free tier (< 50k users) |
| Total monthly | ~$8 |
Eight dollars. For a fully automated, secure, scalable onboarding system. I spend more on coffee in a day.
What I'd do differently
If I started over:
- I'd use the HTML comment markers from day one instead of wasting a week debugging fragile string matching.
- I'd never put counter logic in the Lambda. JavaScript on the frontend counts the cards dynamically — the Lambda doesn't need to know how many members exist.
- I'd add the 30-minute email delay from the start instead of after a confused member messaged me asking why their card wasn't showing.
What's next
We're launching Golden Jackets Poland soon — same pipeline, different country. The code is open source, so any chapter can fork and deploy their own version. The dream is a global network
of Golden Jacket communities, all running on the same automated infrastructure.
of Golden Jacket communities, all running on the same automated infrastructure.
I know SAM or CDK would be the "proper" way to manage this. But honestly? For a volunteer community project that I maintain in my spare time, raw Lambda + GitHub Actions gets the job done
without the overhead. Maybe I'll migrate to IaC when we hit 10 countries. For now, it works.
without the overhead. Maybe I'll migrate to IaC when we hit 10 countries. For now, it works.
43 members. 3 weeks. 1 manual step. $8/month.
If you want to see the code: github.com/ricardogulias/golden-jackets-brazil
If you want to join: goldenjacketsbrazil.com
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article