DynamoDB for storing only. After an article is stored in DynamoDB and stream will index it into an ES Service. Then we are quering and searching only ES. DynamoDB can't handle searching very good.

Security wise, everything is private except one Lambda that exposes a GraphQL server and is being forwarded to the public net through API Gateway. We will implement subnets and security groups very soon.