End-to-end CI/CD pipeline separating vendor responsibility (CodeBuild with SAST, dependency, and image vulnerability scanning) from AWS-managed deployment (CodePipeline and CodeDeploy to ECS Fargate). Source code flows through security gates into ECR, then deploys across multi-AZ ECS Fargate tasks behind CloudFront, WAF, and ALB. RDS Primary/Standby and DynamoDB provide stateful persistence with high availability. This architecture enforces shift-left security scanning before production deployment while maintaining infrastructure isolation across public, private app, and private data subnets. Fork and customize this diagram to match your organization's CI/CD gating policies, security scanning tools, and multi-region requirements.