Keith is an architect by day, blogger by night. He’s responsible for all the content on this blog, and irresponsible for everything else.

Latest stories

The Drudgery of Servers

T

As much as I love Serverless architectures, I find myself ‘locked-in’ to a server-ed WordPress blog. It’s a mixture of too much legacy content to migrate, lack of easy migration tools, and just the fact that WordPress for all it’s faults — just works! So rather than spend countless hours trying to migrate content, I decided to keep paying the $5/mo to DigitalOcean so...

Keith’s Adventures in DynamoDB Land

K

After reading the awesome DynamoDBBook from Alex DeBrie, I was prompted to fix a long running design issue with Klayers (a separate project I maintain). Like everybody else that dives into DynamoDB headfirst, I made the mistake of using multiple tables, one for each data entity. After all, a single database consists of multiple tables — so DynamoDB would logically involve multiple DynamoDB...

Access Keys in AWS Lambda

A

Let’s look at AWS Access Keys inside a Lambda function, from how they are populated into the function’s execution context, how long they last, how to exfiltrate them out and use them, and how we might detect an compromised access keys. But before that, let’s go through some basics. Lambda functions run on Firecracker, a microVM technology developed by Amazon. MicroVMs are like...

Contact Tracing Apps: they’re OK.

C

I thought I’d write down my thoughts on contact tracing apps, especially since a recent BFM suggested 53% of Malaysians wouldn’t download a contact tracing app due to privacy concerns. It’s important for us to address this, as I firmly believe, that contact tracing is an important weapon in our arsenal against COVID-19, and having 54% of Malaysians dismiss outright is concerning...

Sharding SQS

S

Potassium40 was a project I started to see how fast Lambda could really go. The project attempts to download the robots.txt files from 1 million websites as fast as it can. I chose robots file because — well it’s supposed to be downloaded by robots anyway, so this was both great fun, but also completely ethical as I wasn’t scraping people’s websites. The goal is still to...

Logging within AWS Lambda Functions (python edition)

L

This post covers how to perform logging within AWS Lambda. Lambda has built-in integration to Cloudwatch logs, making it a default choice for logs, but the way a distributed system like lambda performs logging, is quite different from how you’d do in a monolithic app. For the brave folks still reading this — let’s dive in. Lambda Logging: 101 When building lambda functions...

Playing with files within the memory of Lambda function

P

A lambda function is a like a little island, surrounded by network. Unlike Fargate containers, of EC2 instances, they do not have EFS, EBS or some other fast storage support. Everything that goes into a lambda, goes in via the network interface (and network only). And hence, since Lambda’s are ephemeral, everything going in and out of the lambda has to transverse that network...

My experience with AWS Certified Security – Specialty

M

Last week I took the AWS Certified Security – Specialty exam — and I passed with a score of 930 (Woohoo!!) In this post I cover why I took it, what I did to pass, my overall exam experience, and some tips I learnt along the way. So let’s go. Why? Why would anybody pay good money, subject themselves to hours of studying, only to end up sitting in a cold exam room for hours...

Run serverless on GitHub actions

R

GitHub actions is the new kid on the workflow block. It allows users to orchestrate workflows using familiar git commands like push & pull requests, and un-familiar GitHub events like gollum, issue creation and milestone closures. In this post, we’ll use GitHub actions to orchestrate a build pipeline that will deploy lambda functions using the Serverless framework. There’s a lot...

Lambda functions in a VPC

L

In my honest (and truly humble) opinion, VPCs don’t make much sense in a serverless architecture — it’s not that they don’t add value, it’s that the value the add isn’t worth the complexity you incur. After all, you can’t log into a lambda function, there are no inward connections allowed. And it isn’t a persistent environment, some functions may...