Ostensibly this is easy. Set an event rule target to a log group and it Just Works (tm). I suspect that's probably the case in the AWS UI, but with infra as code there's a missing piece: cloudwatch logs resource policies. There has to be a policy in place that allows events to delivery logs.… Continue reading How to Send AWS EventBridge Events to CloudWatch Logs
AWS Lambda has this nice graph on the monitor page for an indivdiaul lambda function that shows its success rate. Recently I had a lambda that was broken due to a failed build during a terraform apply. Terraform applied fine, but the lambda build didn't include the right dependencies. The result: 100% error rate over...… Continue reading Alarming on a High Lambda Error Rates
One small gotcha in AWS Step Functions is that the waitForTaskToken integration pattern only really works within the same AWS account (and region). You must pass task tokens from principals within the same AWS account. The tokens won't work if you send them from principals in a different AWS account. I've been prototyping a set… Continue reading Cross-Account waitForTaskToken in AWS Step Functions
This post is a follow up to Hosting a Single Page Application in AWS. It builds on that article with some specifics for the Single SPA micro frontend famework. There are couple core problems to solve here when using the recommended setup outside of just hosting the applicaiton as described in the article linked above.… Continue reading Deploying a Single SPA Application on AWS
Last year I started using Single SPA as framework for a microfrontend based single page application. Part of this was figuring out how to even host a single page application in AWS. I wanted to do this without having to run servers and instead rely on AWS services only. This is the solution I arrived… Continue reading Hosting a Single Page Application in AWS
I did this for an EC2 Client VPN Endpoint and certificate based authentication in a continuous integration environment. It might also be suitable for localhost certificates and is pretty much what Minica or Easy RSA does. But I do a lot of infrastructure work with Terraform, so here we are. Another important note: AWS has… Continue reading Create Your Own Certificate Authority with Terraform
Just hit this little fun thing. Using the rename command for SFTP seems to use the s3:CopyObject action, which attempts to copy any object tags as well as the actual object itself. The IAM Permission associated with the SFTP user must allow s3:GetObjectTagging and s3:PutObjectTagging or a rename command will get an Access Denied message… Continue reading AWS Transfer: SFTP rename Fails with Permission Denied
This week I got a chance to work on implementing AWS Transfer as an SFTP server backed by a set of S3 buckets. Authentication in this new system is handled by another, self-serve SFTP application. Users can create an manage SFTP users there and AWS Transfer uses their usernames, passswords, and public keys to authenticate… Continue reading Using AWS Transfer with a Custom Lambda Identity Provider
Like many things AWS all this information can be found in the AWS docs themselves, but scattered everywhere. This article on service policies (or resource policies) vs IAM permissions provides some background for what we'll do here. There are two pieces here: 1. The Elastic Container Repository (ECR) in one AWS account (account ID 1111111111… Continue reading How Access an AWS Container Repository from Another Account
Should applications use one S3 bucket, putting different categories of files under different directories?1 Or should an application use multiple S3 buckets -- one for each different category of files? As the title implies, the answer is many S3 buckets. While some things, like lifecycle rules, can be configured based on directories (key prefixes, really),… Continue reading Use Many S3 Buckets
Christopher Davis 