Multi-source AWS data ingestion architecture routes API and SFTP uploads through WAF and AWS Transfer Family into segregated S3 Bronze buckets. Client and API traffic enters a public DMZ protected by WAF, which forwards API requests to API Gateway and Lambda for processing, while SFTP clients connect directly to AWS Transfer Family for file uploads. Both ingestion paths write to dedicated S3 Bronze buckets—one for API payloads, one for SFTP files—with Lambda emitting metrics to CloudWatch for monitoring. This layered design (DMZ, private subnet, core) enforces least-privilege access, isolates ingestion logic, and enables audit trails for compliance-heavy data pipelines. Fork and customize this diagram on Diagrams.so to adapt source protocols, add transformation stages, or integrate with your data lake governance framework.