Cloud Backup & Media-Sharing Platform

A client with a 30 TB on-premises server full of movies, music, photos, and private documents wanted two things: an automatic offsite backup, and a simple way to share parts of the library with family and friends without exposing the rest. I designed the end-to-end AWS architecture, modeled what it would cost to run, and built a working prototype. The final build is pending client sign-off.

The problem

What the client asked for:

• Selective, folder-level sync from the server to the cloud.
• Tiered sharing: friends can stream media, family can also see photos, and no one but the owner can reach private or business files.
• A simple website that works on a phone or a desktop, with nothing to install.

The constraints that shaped the design: the on-premises server could not accept inbound connections, the people using the system are not technical, and ongoing cost had to stay at household scale.

Architecture

Data flows top to bottom, and each layer has one job.

1. On-premises · 30 TB server

   All inbound ports closed. The sync agent only ever talks outward.

   • Media libraryMovies and music. Selected folders only.
   • PhotosFamily photo library with its own permissions.
   • Private dataPersonal and business documents. Backup only, no web access.
   • Sync agentAWS DataSync or rclone. Watches folders, pushes over outbound HTTPS.
2. ↓ encrypted sync · TLS · outbound only

3. S3 object storage · us-west-2

   Encrypted at rest (SSE-S3), multi-AZ redundancy built in, no hardware to manage.

   • Media bucketCredentialed access only. Lifecycle to Glacier Instant Retrieval after 90 days.
   • Photos bucketSeparate permission scope. Same lifecycle policy.
   • Private bucketNo public endpoint, ever. Versioning on, managed by AWS Backup.
4. ↓ an access-control layer sits between storage and users

5. Access control & delivery

   Who can see what, and how content reaches a device.

   • Amazon CognitoUser accounts with three tiers: owner, family, media guest. Revoking access means disabling one account.
   • IAM rolesLeast-privilege, per-bucket permissions for each tier.
   • CloudFront CDNEdge caching for fast streaming. The private bucket has no distribution.
6. ↓ requests pass through the API layer before touching storage

7. Web interface & API

   Works on any phone or computer over HTTPS on a custom domain.

   • Static website (S3)Owner, family, and guest views, plus a sync-health dashboard.
   • API Gateway + LambdaGenerates a time-limited pre-signed link per request, so buckets stay private.
   • Route 53 + ACMCustom domain and a free TLS certificate. HTTP redirects to HTTPS.
8. ↓ monitoring watches every layer

9. Monitoring & backup

   Automatic alerts if something breaks, and point-in-time recovery for private files.

   • CloudWatchAlarms on sync failures and unusual data egress.
   • SNSPlain-language email alerts when an alarm fires.
   • AWS BackupDaily backup of private documents with a 30-day restore history.
10. ↓ end users reach the system through the web interface only

11. End users · browser & mobile

    HTTPS only, Cognito login required, and each role sees only what it is permitted to see.

    • OwnerAll three buckets, an admin panel, and user management.
    • FamilyMovies, music, and photos. No access to private documents.
    • Media guestsMovies and music only. Credentialed per person, removable at any time.

Key decisions

• Outbound-only sync. The agent pushes selected folders to S3 over TLS while every inbound port on the server stays closed, so there is nothing to attack from outside.
• Three isolated buckets. Media, photos, and private data each get their own bucket, so permissions map cleanly to data types. The private bucket has no public endpoint and no CloudFront distribution at all.
• Pre-signed URLs, not public buckets. API Gateway and Lambda issue a time-limited link each time someone presses play. The buckets are never directly public.
• Roles instead of per-file rules. Cognito's three tiers map to IAM roles scoped to specific buckets, and removing someone's access is a single account change.
• Glacier Instant Retrieval after 90 days. Older content is about 83% cheaper to store and still opens in milliseconds, so there is no restore step to explain to a non-technical user. The tradeoff is a per-GB retrieval fee, covered in the cost model below.
• Backups where they matter. AWS Backup covers only the irreplaceable private documents, not the full media library.
• A website, not an app. A browser-based interface meant nothing to install or keep updated.

Cost model

I modeled three usage scenarios against us-west-2 list pricing as of October 2026: light (about 3 TB synced), moderate (about 8 TB), and heavy (about 15 TB), each paired with a matching amount of streaming. These are steady-state monthly estimates:

What the numbers showed:

• Storage and retrieval are the bill. Together they are roughly three-quarters to nine-tenths of each scenario.
• The archive tier saves on storage but charges to read. Glacier Instant Retrieval stores data for $0.004/GB-month instead of $0.023, but retrieving it costs $0.03/GB. Because most of what gets watched has aged into the archive, retrieval is about a third of the moderate scenario's bill.
• Streaming is partly free. CloudFront includes 1 TB of outbound data each month, roughly 200 movie streams, and charges $0.085/GB beyond that. Light use pays nothing for it.
• Most services cost nothing at this scale. Cognito, Lambda, API Gateway, CloudWatch, SNS, and the HTTPS certificate all fit within free tiers, so adding security and monitoring did not add cost.

Assumptions

• The library is mostly older content: 85%, 90%, and 95% of stored data has aged into the archive tier.
• Streaming delivers about 0.5, 1.1, and 1.4 TB a month, drawn from the library in proportion to its makeup.
• Unit prices: S3 Standard $0.023/GB-month; Glacier Instant Retrieval $0.004/GB-month plus $0.03 per GB retrieved; CloudFront $0.085/GB after the free 1 TB.
• “Everything else” is a Route 53 hosted zone ($0.50), AWS Backup for 30, 60, and 100 GB of private documents ($0.05/GB-month), and S3 request fees.
• Not included: the first ~90 days, before the lifecycle rule starts archiving, when storage runs higher (roughly $70, $190, and $350 a month while everything sits in Standard), and one-time costs for the initial upload and archive transitions.

What I'd revisit

Archive retrieval is the line to change. An age-based lifecycle rule archives files whether or not anyone is still watching them, and every stream from the archive tier incurs a retrieval fee. If I rebuilt this, I'd evaluate S3 Intelligent-Tiering, which moves content back to the standard tier when it's accessed and charges no retrieval fees.

These are estimates based on list pricing at the time, and AWS prices change.

Status

Delivered: the architecture diagram, the cost analysis, and a working prototype. Pending: the final build, awaiting client sign-off.