Clean serverless data layer
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.
Press Run. The stack loaded here fails in a way worth seeing.
▸What the engine finds4 findings
Not examples — Clean serverless data layer was run through the real engine when this page was built, and this is what it returned.
▸ 4 informational findings — the work queue, table has point-in-time, every queue encrypts
The work queue has a dead-letter queueINTENT
Table has point-in-time recovery enabledINTENT
Every queue encrypts messages at restINTENT
Table encrypts data at restINTENT
Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.