AceMyCareer
A container-native career coaching platform on AWS ECS, EKS, and RDS.
Overview
What it is
A résumé-aware career platform: candidates upload a résumé, AWS Textract extracts structure, a Python service scores it against a target role, and the results are surfaced through a Next.js UI. The workload runs on ECS Fargate for the API, EKS for the analysis workers, RDS PostgreSQL for user data, and SQS to decouple ingestion from processing.
- Résumé ingestion Lambda drops jobs onto SQS; Python workers on EKS pick them up.
- ECS Fargate serves the customer-facing API behind an ALB.
- Terraform provisions VPC, ECS/EKS clusters, RDS, and ECR from scratch.
- Textract handles PDF and image résumés without managing an OCR stack.
- Next.js frontend deployed as a container, running side-by-side with the API.
Architecture
How it's wired
Architecture at a glance
Grouped view of the stack while the real diagram is prepared
Compute
- EKS
- ECR
- Lambda
- Next.js
- Python
Data
- RDS PostgreSQL
- Textract
Messaging
- SQS
Delivery & Ops
- Docker
Other
- AWS ECS
Challenges
Problems worth solving
Challenge
Balancing ECS vs. EKS for two very different workloads.
Solution
Kept the customer API on ECS Fargate for simplicity, and used EKS for the CPU-heavy scoring workers where finer-grained scheduling paid off.
Challenge
Textract calls were slow and bursty enough to time out the API.
Solution
Moved ingestion behind SQS. The API returns immediately; workers process on their own schedule and update the DB when done.
Challenge
Keeping RDS credentials out of container images.
Solution
Task and pod definitions read credentials from Secrets Manager at start-up; nothing sensitive lives in the image.
Engineering
Decisions I made
- Split ingestion and processing so a slow OCR call cannot break the request path.
- Chose RDS PostgreSQL over DynamoDB because the data is relational and query-heavy.
- Standardized on Docker multi-stage builds for every service.
Security
How it stays safe
- Private subnets for all compute and RDS; no direct public access.
- IAM roles for service accounts (IRSA) on EKS for scoped AWS access.
- S3 buckets for résumé uploads are encrypted and lifecycle-expired.
- All ingress terminates at an ALB with TLS from ACM.
CI/CD
How it ships
- GitHub Actions builds Docker images and pushes to ECR on merge.
- Terraform plan/apply for infra changes gated behind PR review.
- ECS service updates roll out with health-check-based deploys.
- EKS workers updated with kubectl set image and monitored via CloudWatch Container Insights.
Retro
What I'd tell myself in week one
- You do not need Kubernetes to be serious. Use ECS unless you know why EKS earns its keep.
- Async ingestion is a huge reliability win — worth the extra queue.
- One Terraform repo per environment scales badly; workspaces + modules scale much better.
Next
Future improvements
- Add HPA on EKS workers based on SQS queue depth.
- Introduce Karpenter for smarter node autoscaling.
- Wire OpenTelemetry across the API, workers, and Postgres.