Skip to content

AWS

  • in AWS
  • 2 min read

Useful flags for Go Lambda functions

Last week AWS published a blog post advising that the go1.x Lambda runtime will be deprecated and people should migrate to provided.al2. I was already using the newer runtime, but I also learned from the blog post that AWS SAM can now build Go Lambda functions for the newer runtime - no more Makefiles required!

I switched from BuildMethod: makefile to BuildMethod: go1.x and noticed that my Lambda packages were now twice the size. This means slower cold starts and slower deployments - especially from my laptop in Australia. I also noticed that my CI pipelines were slower because every commit was causing Lambda updates, even when no code had changed.

Improve GitHub Actions OIDC security posture with custom issuer

GitHub Actions has supported using OIDC tokens for about 15 months now. It is a much better way of providing AWS credentials to workflows than creating IAM users and storing long-lived access keys in GitHub Actions secrets.

One issue holding back larger organisations from adopting this solution is the lack of useful granular controls. I touched on this in an earlier article AWS IAM OIDC IDPs need more controls.

  • in AWS
  • 4 min read

Centralised logging: from CloudWatch to Kinesis Firehose

AWS CloudWatch Logs supports automatic forwarding of logs to AWS Kinesis Data Streams and AWS Kinesis Data Firehose. These destinations are can even be in a different AWS account and region. This is very handy for aggregating logs from thousands of log groups and forwarding them to a single place, like Axiom, Datadog, Splunk, etc.

  • in AWS
  • 1 min read

Lambda extension environment variables

Here are the environment variables available to an AWS Lambda extension in the provided.al2 runtime. This is really just some context for myself so I don't have to write code to sanity-check myself each time.

  • in AWS
  • 2 min read

CloudFront and Lambda function URLs

In April 2022, AWS Lambda announced the launch of function URLs - a way to invoke websites powered by Lambda functions without needing API Gateway. A common complaint was the lack of support for custom domains: it only supported the URLs it would generate that look like lprqaxgvt4f6ab3dbj3ixftr640uzgie.lambda-url.ap-southeast-2.on.aws.

But that's where CloudFront comes in useful. Not only can it provide us with custom domain functionality, but we get caching, WAF support, etc as well.

  • in AWS
  • 5 min read

Cheap serverless containers using API Gateway

Sometimes I need to run a long-lived app. In those cases I reach for AWS ECS Fargate instead of AWS Lambda. You can run a container on Fargate for as little as $9/month, or $2.70/month if you're happy to roll the dice with Fargate Spot (I usually do!)

If you have a web app, you almost certainly use a load balancer in front of your containers. And this is where the cost goes from "fun side project" to "oh, I'm not sure I'm willing to spend that much money on this." The load balancer by itself is at least $16.40/month - you could run six containers for that price!

  • in AWS
  • 1 min read

openrolesanywhere - an IAM Roles Anywhere client

Update: AWS now has an open source implementation of a Roles Anywhere credential_process provider - and it even supports PKCS#11. I'll keep the following project online for historical purposes, but there's not much need for it.

I just published a proof-of-concept CLI tool named openrolesanywhere. It lets you assume a role in AWS using IAM Roles Anywhere and a private key stored in your SSH agent - rather than on-disk as required by the official client. It implements AWS4-X509-RSA-SHA256, AWS4-X509-ECDSA-SHA256 via a forked copy of the SigV4 signer in the AWS SDK for Go.