EdTech on AWS (2026): LMS, Exam-Day Buffering, and AI Tutor Reference Architecture
Quick summary: For a multi-district LMS (~52k concurrent exam submissions in 30 min), SQS decouple + Aurora Serverless v2 held p95 submit at 410 ms — off-peak monthly compute −71% vs always-on EC2.
Key Takeaways
- For a multi-district LMS (~52k concurrent exam submissions in 30 min), SQS decouple + Aurora Serverless v2 held p95 submit at 410 ms — off-peak monthly compute −71% vs always-on EC2
- AWS Glue 5
- 1 reached all commercial and GovCloud regions in April 2026 (What's New) — relevant when LMS analytics exports feed a district lake
- Bedrock Guardrails filter PII, denied topics, and hallucinations across FMs (Bedrock FAQs)
- It is not generic serverless EdTech scaling, not HIPAA Bedrock alone (clinical records), and not the education industry FAQ without implementation lanes
Table of Contents
AWS Glue 5.1 reached all commercial and GovCloud regions in April 2026 (What’s New) — relevant when LMS analytics exports feed a district lake. Bedrock Guardrails filter PII, denied topics, and hallucinations across FMs (Bedrock FAQs).
This post is the EdTech reference architecture — LMS catalog, exam buffering, video, and AI tutor lanes. It is not generic serverless EdTech scaling, not HIPAA Bedrock alone (clinical records), and not the education industry FAQ without implementation lanes.
Artifacts: exam-day capacity worksheet, assessment buffer checklist, FERPA boundary matrix.
Benchmark pattern (not a cited client) — Multi-district LMS, 52k concurrent exam submissions in 30 min, summer baseline 800 sessions. SQS accept/grade decouple + Aurora Serverless v2 (submit p95 410 ms during window). Off-peak compute −71% vs prior always-on EC2 (worksheet). Bedrock Guardrails on tutor path only after FERPA matrix sign-off.
Four lanes — enrollment to exam to tutor
| Lane | Question | Default AWS path |
|---|---|---|
| Catalog / session | Course + auth? | CloudFront + ALB + Fargate/Lambda + Cognito |
| Assessment | Exam spike? | SQS buffer → async grading Lambda |
| Video | Lecture delivery? | S3 → CloudFront (separate origin from API) |
| AI tutor | Safe generative help? | Bedrock + Guardrails + human review queue |
Opinionated take: Decouple submit from grade before buying bigger Aurora. Teams that scale EC2 for synchronous grading pay 12 months for a 30-minute window.
Reference architecture
Students ──► CloudFront ──► ALB ──► LMS API (Fargate/Lambda)
│
├──► Cognito (district SSO)
│
Exam submit ──► API GW ──► Validator Lambda ──► SQS ──► Grading Lambda ──► DynamoDB results
│ │
└──► Aurora Serverless v2 (catalog, rosters)
Video ──► S3 ──► CloudFront (WebP/HLS)
Tutor ──► API ──► Bedrock Converse + Guardrails ──► SQS (flagged sessions) ──► human reviewLane 1 — Catalog and session
- ElastiCache for course catalog hot keys during registration week
- Aurora Serverless v2 min ACU near zero in July; raise max ACU 24h before exam window
- Separate CloudFront behavior for
/api/*vs/video/*
Lane 2 — Assessment buffer
Complete assessment-buffer-checklist.md:
- Validator returns 202 Accepted with
submission_id - Grading concurrency cap prevents Aurora write storm
- Load test at 2× worksheet peak
Lane 3 — Video economics
- Transcode to HLS + WebP poster frames on ingest (once)
- Monitor CloudFront cache hit ratio during exam week — new module drops hit ratio
- Pre-warm top N modules per district 48h before window
Lane 4 — AI tutor + FERPA
Walk ferpa-boundary-matrix.md:
- Denied topics for exam answers / academic dishonesty
- PII filter on prompts and responses
- Per-district spend cap on Bedrock
What broke — Fall midterm, minute 14. 503 on submit — synchronous grading held Lambda until API GW timeout. Detection:
IntegrationLatencyspike + AuroraDatabaseConnectionsmax. Fix: SQS buffer shipped in 48h; submit p95 410 ms on retest.
When NOT to escalate
| Situation | Stay lighter |
|---|---|
| < 500 concurrent exams | Sync Lambda may suffice |
| Video < 500 GB/month | Single S3 + CloudFront without MediaConvert farm |
| Higher-ed only, no K-12 | COPPA flows optional — FERPA still applies |
What to Do This Week
- Fill exam-day-capacity-worksheet.csv with last semester’s peak + 20% headroom.
- Complete assessment-buffer-checklist.md.
- Sign off ferpa-boundary-matrix.md with district legal.
- Load test 2× peak with SQS path — alarm on DLQ depth.
- Enable Guardrails on tutor staging — run 100 adversarial prompts before pilot.
Reproduce this — Download exam-day-capacity-worksheet.csv. Set
exam_window_30minfrom CloudWatchConcurrentExecutionsmax last term. Compareestimated_exam_window_cost_usdto always-on EC2 row.
What This Post Doesn’t Cover
- SCORM/xAPI full LRS — partner or dedicated learning-record product
- Proctoring video ML — separate privacy review
- On-prem SIS bidirectional sync — integration project, not architecture lanes
- Campus Wi-Fi QoS — client-side constraint
We have not benchmarked Bedrock tutor above 3k invocations/min per region — cap with token bucket before district-wide rollout.
Related: Education industry hub · Serverless services · Bedrock services
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
