Next.js 15 on AWS via OpenNext: Lambda, S3 Cache Assets, CloudFront, and DynamoDB

Incoming Client Request (HTTPS)
                    │
                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│                   Amazon CloudFront CDN (Global Anycast)               │
│  - TLS 1.3 Termination, HTTP/3, Brotli/Gzip Compression                │
│  - URI Path-Based Cache Behaviors Routing                              │
└───────┬──────────────────────────┬─────────────────────────────┬───────┘
        │ /_next/static/*          │ /_next/image*               │ Default /*
        ▼                          ▼                             ▼
┌──────────────────┐     ┌─────────────────────┐     ┌───────────────────┐
│    Amazon S3     │     │    Image Lambda     │     │   Server Lambda   │
│ (Static Assets)  │     │ (sharp, ARM64)      │     │  (SSR, Actions)   │
│ OAC Restricted   │     │ WebP / AVIF Resize  │     │ Response Stream   │
└──────────────────┘     └──────────┬──────────┘     └─────────┬─────────┘
                                    │                          │
                                    ▼                          │ SWR ISR
                         ┌─────────────────────┐               ▼
                         │  S3 Assets Storage  │     ┌───────────────────┐
                         │ (Optimized Images)  │     │   Amazon SQS      │
                         └─────────────────────┘     │  (ISR Queue)      │
                                                               │
                                                               ▼
                                                     ┌───────────────────┐
                                                     │  Revalidation     │
                                                     │  Lambda Worker    │
                                                     └─────────┬─────────┘
                                                               │
                                     ┌─────────────────────────┴─────────┐
                                     ▼                                   ▼
                         ┌─────────────────────┐             ┌───────────────────┐
                         │   Amazon DynamoDB   │             │     Amazon S3     │
                         │ (Cache Tag Registry)│             │ (ISR HTML/RSC)    │
                         └─────────────────────┘             └───────────────────┘

import { S3Client, GetObjectCommand, PutObjectCommand } from '@aws-sdk/client-s3';
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';
import { DynamoDBDocumentClient, GetCommand, PutCommand } from '@aws-sdk/lib-dynamodb';

const s3 = new S3Client({ region: process.env.AWS_REGION });
const ddbRaw = new DynamoDBClient({ region: process.env.AWS_REGION });
const ddb = DynamoDBDocumentClient.from(ddbRaw);

const BUCKET_NAME = process.env.NEXT_CACHE_BUCKET_NAME;
const DDB_TABLE = process.env.NEXT_CACHE_DYNAMO_TABLE;

export default class AwsDistributedCacheHandler {
  constructor(options) {
    this.options = options;
  }

  // Retrieve cached entry by key
  async get(key) {
    try {
      // 1. Verify metadata, tags, and expiration in DynamoDB
      const meta = await ddb.send(
        new GetCommand({
          TableName: DDB_TABLE,
          Key: { cacheKey: key },
        })
      );

      if (!meta.Item) return null;

      // Verify absolute Time-to-Live (TTL) expiration
      if (meta.Item.revalidateAt && Date.now() > meta.Item.revalidateAt) {
        return null;
      }

      // 2. Fetch binary cache payload (HTML / RSC JSON) from S3
      const s3Response = await s3.send(
        new GetObjectCommand({
          Bucket: BUCKET_NAME,
          Key: `cache/${key}`,
        })
      );

      const bodyString = await s3Response.Body.transformToString();
      const value = JSON.parse(bodyString);

      return {
        lastModified: meta.Item.lastModified,
        value,
      };
    } catch (error) {
      console.error(`[AwsCacheHandler] Cache read error for key: ${key}`, error);
      return null;
    }
  }

  // Persist newly rendered payload to distributed storage
  async set(key, data, ctx) {
    try {
      const now = Date.now();
      const revalidate = typeof ctx.revalidate === 'number' ? ctx.revalidate : false;
      const revalidateAt = revalidate ? now + revalidate * 1000 : null;

      // 1. Persist cache payload into S3
      await s3.send(
        new PutObjectCommand({
          Bucket: BUCKET_NAME,
          Key: `cache/${key}`,
          Body: JSON.stringify(data),
          ContentType: 'application/json',
        })
      );

      // 2. Register cache tags and metadata in DynamoDB
      await ddb.send(
        new PutCommand({
          TableName: DDB_TABLE,
          Item: {
            cacheKey: key,
            tags: ctx.tags || [],
            lastModified: now,
            revalidateAt,
          },
        })
      );
    } catch (error) {
      console.error(`[AwsCacheHandler] Cache write error for key: ${key}`, error);
    }
  }

  // Invalidate cache entries associated with a tag
  async revalidateTag(tag) {
    console.log(`[AwsCacheHandler] Invalidating cache tag: ${tag}`);
  }
}