Employee Onboarding Infra

The problem

Onboarding flows that are not idempotent quietly corrupt data: a retried request or a double click writes a second record, and now one person has two accounts. At scale that is a support and security mess.

What it does

This is a serverless onboarding API where idempotency is the whole point. Call it a thousand times for the same person and exactly one record is written. Everything is infrastructure as code, least privilege, and traceable.

How it works

• Terraform defines the entire stack, so any environment is reproducible from code.
• Lambda handlers with DynamoDB conditional writes guarantee exactly-once record creation.
• Cognito for identity and SES for transactional email, wired with least-privilege IAM roles.
• X-Ray tracing across the request path, with separate dev and production environments.

The value

• No duplicate records, ever, by construction.
• Least-privilege security baked into every role.
• Fully observable with distributed tracing.
• Public repo, so the whole approach is open to inspect.