# User prompt

Create an AWS document processing architecture. A document intake client submits documents through API Gateway to a Lambda intake handler, which stores originals in an input S3 bucket and queues jobs in SQS. The jobs queue is consumed by two Fargate workers in two Availability Zones, each in a private subnet of one VPC. Both workers read input S3, write processed files to output S3, update DynamoDB status, and publish completion to SNS. The client downloads outputs through CloudFront, with request flow client -> CloudFront -> output S3 origin. Failed jobs move to a dead-letter queue after the maximum attempts; an operations user inspects the dead-letter queue and DynamoDB and can redrive messages from the DLQ to the jobs queue. SNS sends completion notifications to operations. Keep clients outside AWS and managed services outside the VPC. Show one cloud, one region, one VPC, two AZs, and one private subnet group per AZ. Add no other services.