High-Level Design

ServiceOne-sentence explanation
CloudFront	Caches `GET /pastes/{id}` responses at edge locations so popular pastes load faster and cached reads may continue during temporary backend degradation.
API Gateway	Receives HTTP requests, exposes the paste endpoints, and routes each request to the correct Lambda function.
CreatePaste Lambda	Validates the request, generates an unguessable paste ID, scans the content with Bedrock, stores the text and metadata, and returns the shareable URL.
GetPaste Lambda	Checks the paste status and expiration in DynamoDB, retrieves the text from S3, and returns it to the client.
DeletePaste Lambda	Verifies that the authenticated user owns the paste, deletes or deactivates its metadata and content, and invalidates the cached response when necessary.
Amazon Bedrock	Moderates submitted text before the paste becomes active and publicly accessible.
Amazon S3	Stores the actual paste text as durable and low-cost object storage, with lifecycle cleanup for expired objects.
Amazon DynamoDB	Stores paste metadata such as owner, status, visibility, creation time, expiration time, idempotency key, and S3 object key.
Amazon Cognito
Handles user registration, login, authentication tokens, and identity for paste creation, history, and deletion.

WAF for preventing spam