AWS Archives

How to secure CI/CD pipelines without burning developer productivity to the ground

When it comes to CI/CD roles, your instinct might be to lock them down to just what it needs. Because we all want to follow the principle of least privilege. But as you will see in this post, this comes with a hefty price in terms of developer productivity, and it’s not as secure as you might think.

So instead, I prefer a more holistic approach when it comes to securing CI/CD pipelines, involving account boundaries, SCPs, ABAC and the use of permissive roles. Come in and find out how.

First impressions of CloudFormation’s IaC generator and CDK migrate

AWS, CDK, CloudFormation, SAM

AWS just announced the CloudFormation IaC Generator and added a CDK migrate command. These make it easier for you to manage manually created resources with Infrastructure as Code.

This is my first impressions of it – what worked, what didn’t and where the gaps are.

How to reprocess Lambda dead-letter queue messages on-demand

AWS, Serverless

Imagine this. You have followed AWS best practices and set up a dead-letter queue (DLQ) or an OnFailure destination for every async Lambda function.

A message arrives in your DLQ. You are alerted right away because you have alarms on all of your DLQs.

You investigate the problem and determine that it was temporary and the message should be re-processed.

But now what?

How to create private, VPC-only DynamoDB tables

AWS, DynamoDB, Security

You don’t need network security to keep your DynamoDB data safe. However, adding network security on top of IAM authentication and authorization is not a bad thing. Sometimes, it’s even necessary to meet regulatory requirements.

In this post, let’s see how to put DynamoDB in VPC so your data can only be accessed from within a VPC. We will look at what works best for feature teams and what works best for platform teams.

How to Securely let Frontend Apps to Directly Access AWS services

AWS, DynamoDB, S3, Serverless

In this post, let’s discuss a radical idea – if the API layer is not adding any value besides authentication and calling the AWS SDK, then why not just remove it and let the frontend talk to your AWS resources directly? It will be the cheapest way to build a full-stack application, and there are similar precedents in the IoT space already.

It’s not the way that I’d recommend for most of you. But it’s possible to do it safely so that a user can only access his/her data. All you need is a little bit of IAM policy and a Cognito Identity Pool.

How to perform database migration for a live service with no downtime

AWS, DynamoDB, Serverless

Performing a database migration while continuing to serve user requests can be challenging. It’s a question that many students have asked during the Production-Ready Serverless [1] workshop. So here’s my tried-and-tested approach to migrating a live service to a new database without downtime. I’m going to use DynamoDB as an example, but it should work …

How to perform database migration for a live service with no downtime Read More »

The one mistake everyone makes when using Kinesis with Lambda

AWS, Kinesis, Lambda, Serverless

AWS Kinesis and Lambda are a great combo for processing large amounts of data in real-time. However, there’s a common oversight that many developers make when integrating these two services. There are established best practices for configuring Lambda’s EventSourceMapping [1] for Kinesis: Configure an OnFailure destination for failed records. Enable BisectBatchOnFunctionError. Override MaximumRetryAttempts. Choose a …

The one mistake everyone makes when using Kinesis with Lambda Read More »

How I implemented web analytics reporting with Amazon Timestream

AWS, Serverless, Timestream

A month ago, I shared how I built an affiliate tracking system in a weekend [1]. Since then, I’ve enhanced the system by integrating analytics reporting, enabling affiliates to gauge the performance of their URLs. This post will describe how the system works and why I chose Amazon Timestream over DynamoDB. How it works 1. …

How I implemented web analytics reporting with Amazon Timestream Read More »

Serverless v4 will start charging users, but that’s a good thing

AWS, Serverless

The Serverless Framework remains a top choice for serverless development, as evidenced by the recent State of Serverless report [1]. Yet, its appeal has waned over time due to the lack of innovation in recent years, prompting users to explore other options. Recently, they announced [2] significant updates for Serverless v4: Fees will be introduced …

Serverless v4 will start charging users, but that’s a good thing Read More »

Amplify: how to share code without Lambda Layers or private NPM

Amplify, AWS, Lambda, Programming, Serverless

Sharing code efficiently across different parts of an application can be challenging with AWS Lambda, especially when using Amplify. Today, I’ll walk you through a solution to this common problem, without relying on Lambda Layers or private NPM repositories. The Context In my previous post about Lambda Layers [1], I delved into its limitations, especially …

Amplify: how to share code without Lambda Layers or private NPM Read More »