A

AWS-ssm

A fully private file-upload system on AWS: a VPC with no internet gateway or NAT, a static site served from S3, a private API Gateway + Lambda that mints presigned S3 upload URLs, a second Lambda that reacts to what lands in the uploads bucket, and an EC2 instance that's the only way in — reachable purely through AWS Systems Manager, with no open inbound ports anywhere.