Skip to content

2021

  • in AWS
  • 2 min read

CloudWatch EMF in Honeycomb

The CloudWatch embedded metric format (EMF) is a convenient way to publish metrics to CloudWatch from your apps running in AWS - especially Lambda functions. You just need to emit logs in the right JSON format and CloudWatch Logs will automatically publish them to CloudWatch Metrics.

This is okay for basic use cases where you have zero or few dimensions on your metrics and those dimensions are low cardinality. If they're high cardinality, Amazon advises that you instead do not create dimensions and instead treat the metrics as logs and query them using CloudWatch Log Insights. So you have to make a trade-off between something useful, something affordable and something easy to use.

  • in AWS
  • 1 min read

No need for AWS IAM users

It's long been considered "best practice" to avoid having IAM users in AWS. Where possible IAM roles are preferable as role session credentials are short-lived. As far as I can tell, the only justification for AWS IAM users that I hear nowadays is for usage on non-interactive systems outside of AWS (so AWS SSO won't work), e.g. a Raspberry Pi in your closet.

I created a proof-of-concept project cloudkey to show that even that scenario can avoid IAM users. It uses the little-known iot:AssumeRoleWithCertificate functionality to avoid that.

  • in AWS
  • 3 min read

Two approaches to cross-account EventBridge

Since November 2020, EventBridge has supported two methods of creating cross-account event subscriptions. Both require a level of indirection in the form of an "intermediary" bus in the subscriber's account. Here are examples of how they work. We will refer to the account whose bus has interesting events as account B. We will refer to the subscriber account as account S.

  • in AWS
  • 1 min read

AWS SigV4 caching

Say you find yourself doing silly things with AWS APIs on a lazy Sunday afternoon. And you are getting an inexplicable error when using perfectly valid credentials.

  • in AWS
  • 2 min read

Nested Express Step Functions

AWS Step Functions are cool. Express Step Functions have always felt like they had the potential to be cool, but were missing some key features when they launched. I think they're worth revisiting in light of recent releases.

AWS federation comes to GitHub Actions

At the time of writing, this functionality exists but has yet to be announced or documented. It works, though!

EDIT: Here is the functionality on the GitHub roadmap.

GitHub Actions has new functionality that can vend OpenID Connect credentials to jobs running on the platform. This is very exciting for AWS account administrators as it means that CI/CD jobs no longer need any long-term secrets to be stored in GitHub.