Building a Serverless Tailgating Detection System with AWS Computer Vision
Learn how to prevent secure-door piggybacking by combining physical access thresholds with Amazon Rekognition and AWS Lambda to automatically detect and alert on tailgating incidents.
Rather than relying solely on card readers that cannot verify if multiple people pass through an entryway, an AWS Lambda function acts as the triage layer to evaluate person-counts and threshold breaches during a badge-swipe event.
Below is a Python Lambda function that filters out casual hallway traffic and isolates high-priority access breaches (e.g., tailgating or piggybacking behind an authorized employee):
Below is a Python Lambda function that filters out casual hallway traffic and isolates high-priority access breaches (e.g., tailgating or piggybacking behind an authorized employee):
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
import json
import os
import boto3
# Initialize AWS clients
sns_client = boto3.client('sns')
dynamodb = boto3.resource('dynamodb')
# Environment variables for routing
ALERT_TOPIC_ARN = os.environ['ALERT_TOPIC_ARN']
INCIDENTS_TABLE = os.environ['INCIDENTS_TABLE']
def lambda_handler(event, context):
table = dynamodb.Table(INCIDENTS_TABLE)
for record in event['Records']:
payload = json.loads(record['kinesis']['data'])
person_count = 0
# Count high-confidence persons within the entryway threshold frame
for detection in payload.get('DetectedObjects', []):
label = detection.get('Object', {}).get('Name')
confidence = detection.get('Object', {}).get('Confidence', 0)
if label == 'Person' and confidence >= 85.0:
person_count += 1
# Trigger alert if more than one person is detected during a single valid entry
if person_count > 1:
timestamp = payload.get('InputInformation', {}).get('KinesisVideoStream', {}).get('ServerTimestamp')
stream_arn = payload.get('InputInformation', {}).get('KinesisVideoStream', {}).get('StreamArn')
incident_data = {
'IncidentId': f"TAILGATE-{timestamp}",
'StreamArn': stream_arn,
'PersonCount': person_count,
'Status': 'AWAITING_REVIEW'
}
table.put_item(Item=incident_data)
alert_message = (
f"SECURITY ALARM: Tailgating detected. {person_count} individuals in secure threshold.\n"
f"Stream: {stream_arn}\nTimestamp: {timestamp}"
)
sns_client.publish(
TopicArn=ALERT_TOPIC_ARN,
Subject="ACCESS CONTROL ALERT - Tailgating Detected",
Message=alert_message
)
return {'statusCode': 200, 'body': 'Entryway triage complete'}
Storage, Encryption, and Evidence Handling:
In access control, maintaining an audit trail and strict evidence integrity is non-negotiable for internal HR investigations and compliance reporting.
In access control, maintaining an audit trail and strict evidence integrity is non-negotiable for internal HR investigations and compliance reporting.
Data Encryption at Rest & In Transit:
Entryway video streams ingested by KVS and archived in Amazon S3 are encrypted using AWS Key Management Service (AWS KMS) customer-managed keys. TLS 1.3 is enforced on all streaming endpoints in transit.
Granular Access Control:
AWS IAM policies restrict live door-camera access strictly to authenticated security personnel using temporary credentials via AWS STS.
Cost-Optimized Lifecycles:
High-resolution tailgating footage is retained in S3 Standard for 30 days for immediate dispute resolution, then automatically transitioned to S3 Glacier Flexible Retrieval using S3 Lifecycle rules to optimize storage costs.
Practical Lessons Learned from the Ops Room:
Threshold Polygons vs. Flat Counting: Blanket person-counting catches employees walking casually in the background hallway. Leveraging Rekognition's bounding boxes inside Lambda to check if multiple people physically intersect with a strict "doorway polygon" drops false alerts by over 80%.
Fail-Secure Escalation Protocols:
If the automated verification pipeline experiences a network bottleneck, the architecture fails secure at the edge, temporarily locking the secondary vestibule doors and triggering a manual guard verification to ensure zero unlogged entries.
Pre-Buffering Media Fragments:
Security operators need 10 seconds of context to see who initiated the badge swipe. Using GetMedia on KVS allows the monitoring interface to fetch the video clip starting 10–15 seconds prior to the event timestamp stored in DynamoDB.
Conclusion:
By coupling physical access control workflows with AWS serverless services, security teams can transform passive door cameras into an automated anti-tailgating pipeline. This architecture drastically reduces unauthorized facility access, enforces accountability through CloudWatch and KMS, and ensures dispatch operators focus where they matter most: responding to genuine perimeter breaches in real time.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article