Building ReLoop: A Secure Industrial Waste Exchange with Amazon S3 and Amazon SES
Industries often throw away by-products that another industry could use as raw material. This post shows how our team built a B2B marketplace to connect them, using Amazon S3 with pre-signed URLs for private document storage, Amazon SES for match and deal alerts, boto3 for integration and IAM for least-privilege access, plus the lessons we learned along the way.
The problem: one industry's waste is another's raw material
Sugar mills produce tons of bagasse. Thermal power plants produce fly ash. Paper, biofuel, cement and brick units can use these by-products as raw material. But most industries never find each other, so the waste goes to landfill or is sold cheaply through middlemen. That means more pollution, higher disposal costs and lost income.
For this hackathon, our team built ReLoop, a B2B platform where verified industries list their by-product waste and other industries discover, negotiate and buy it directly. Each listing gets a QR "waste passport", buyers see a match score and a transport cost estimate, and every deal moves through tracked stages with a digital manifest PDF.
In this post we explain how we used AWS for the two parts that needed the most care: secure document storage and notifications.
Meet Team Root Code
ReLoop was built by four teammates who split the work by strength:
- Tharsan (team lead): architecture, database, security, integration and the demo video.
- Sharugesh: FastAPI backend. Matching, deal workflow, notifications and the AWS integrations.
- Surendar: React frontend. Listings, search with map, chat and the deal tracker.
- Ananthi: research and development. Problem research, feature scope, matching rules, documentation and pitch.
Architecture at a glance
- Frontend: React + TypeScript
- Backend: FastAPI (Python)
- Database and auth: Supabase (PostgreSQL with row-level security, MFA)
- AWS: Amazon S3 for private document storage, Amazon SES for email alerts, boto3 as the SDK, IAM for access control
The FastAPI backend is the only component that talks to AWS. The browser never receives AWS credentials.
Why Amazon S3 for documents
ReLoop handles sensitive files: GST certificates, licences, lab reports and deal manifests. Three requirements shaped the design:
- Files must never be publicly accessible.
- Only the owning industry and admins may download them.
- Stored files must be encrypted.
New S3 buckets have Block Public Access and default encryption turned on, which gave us a secure starting point.
Uploading from FastAPI
Python
import boto3, hashlib, uuids3 = boto3.client("s3", region_name=settings.AWS_REGION)def upload_document(file_bytes: bytes, industry_id: str, filename: str, content_type: str):sha256 = hashlib.sha256(file_bytes).hexdigest()key = f"industries/{industry_id}/{uuid.uuid4()}-{filename}"s3.put_object(Bucket=settings.S3_BUCKET,Key=key,Body=file_bytes,ContentType=content_type,ServerSideEncryption="AES256",)return key, sha256
We validate the file type and size first, then store the SHA-256 hash in the database so we can detect tampering or the same document being reused across different accounts.
Sharing files with pre-signed URLs
Instead of building our own file-serving layer, we used pre-signed URLs. After the API checks that the user is allowed to see the file, it generates a link that expires in five minutes:
Python
def get_download_url(key: str) -> str:return s3.generate_presigned_url("get_object",Params={"Bucket": settings.S3_BUCKET, "Key": key},ExpiresIn=300,)
The bucket stays fully private, and access control lives in one place: our API.
Why Amazon SES for notifications
Buyers need to know the moment a matching waste listing appears, and both sides need updates as a deal moves from negotiation to delivery. Amazon SES gave us transactional email with a single API call:
Python
ses = boto3.client("ses", region_name=settings.AWS_REGION)def send_email(to: str, subject: str, html: str):ses.send_email(Source=settings.SES_SENDER,Destination={"ToAddresses": [to]},Message={"Subject": {"Data": subject},"Body": {"Html": {"Data": html}},},)
We wrapped this behind a small notification interface, so the app can fall back to logging when SES is not configured, and an SMS provider can be added later without touching business logic.
IAM: least privilege from day one
We created a dedicated IAM user for the backend with only the permissions it needs:
-
s3:PutObjectands3:GetObjectonarn:aws:s3:::my-bucket/*
-
s3:ListBucketonarn:aws:s3:::my-bucket
-
ses:SendEmailfor the verified sender identity
Credentials come from environment variables and are never committed to the repository.
What we learned about the AWS services
- S3 needs two resource ARNs. Bucket-level actions use
arn:aws:s3:::bucket, while object-level actions usearn:aws:s3:::bucket/*. Mixing them up gives a genericAccessDenied. [Add the exact error you saw, or delete this bullet.]
- SES sandbox mode limits recipients. You can only send to verified addresses until you request production access, so we verified a few test addresses for the demo. [Add the exact error, for example MessageRejected: Email address is not verified, or delete this bullet.]
- Region matters. SES identities are region-specific, so the region in boto3 must match where you verified your email. [Add if this happened to you, or delete.]
- Pre-signed URLs keep things simple. Keeping the bucket private and letting the API issue short-lived links removed the need for any custom file-serving code.
Our hackathon journey: learning and growth
This hackathon was one of the most enjoyable things we have worked on. We started with a simple question: why does an industry's waste end up in landfill when another industry could use it? Turning that question into a working platform in a short time taught us a lot.
What we learned
- Research first. Ananthi's research into real industrial symbiosis cases, like bagasse to paper and fly ash to cement, gave the matching rules a real-world base instead of guesses.
- Scoping matters. We began with a long feature list and had to cut it down to the features that tell a clear story: verification, listings, matching, chat, deals and the impact dashboard.
- Security is a design decision, not a final step. Thinking about row-level security, private storage, short-lived access links and least-privilege permissions from day one saved us from rework.
- Cloud services save time. Using Amazon S3 and Amazon SES let us focus on the exchange logic instead of building storage and email from scratch.
- Teamwork needs clear ownership. Splitting research, frontend, backend, and database/security work let us build in parallel, and regular integration check-ins caught problems early.
What we enjoyed most
- Seeing the first end-to-end flow work: a listing created, a match found, an email alert received.
- Debugging IAM and SES sandbox issues together and finally getting it right.
- Building something with a real-world environmental purpose, not just a demo.
What's next
ReLoop currently runs these AWS integrations from the backend. Our next steps are:
- Add AWS KMS for customer-managed key encryption of documents
- Host the web app with Amazon CloudFront and the API on AWS App Runner
- Use Amazon EventBridge for scheduled jobs such as listing expiry and fraud scans
- Add AWS WAF to protect the API
Final thoughts
Using S3 and SES let us spend our time on the core exchange features instead of building storage and email infrastructure from scratch. If you are building anything that handles sensitive files or needs reliable notifications, this combination is a practical, secure place to start.
Code and README: [paste your GitHub link]
#aws #s3 #ses #python #fastapi #hackathon #sustainability
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article