aws deployment

Limiting Cross-stack References in CDK

Several years ago I wrote CloudFormation Tips and Tricks, in which I gave the advice to “use outputs lavishly, exports sparingly.” The reason is that when you export a value from one stack and import it into another you bind those stacks tightly together, and can’t change that exported value. For example, you might create … Read More

Three Approaches to Deploying Lambdas

“Traditional” deployment patterns separate the application from its infrastructure. Lambda deployments turn this model on its head, binding the infrastructure tightly to the running code. This can be a challenge, especially when developing in a team: it is all too easy for one developer to accidentally overwrite another’s work. In this post I look at several deployment options, and how they impact a development team.

RDS Database Authentication with Spring Boot: Part 2, IAM Authentication

Frequent database password changes are a best practice, because they reduce the “blast radius” if compromised. However, restarting your applications in order to pick up the latest password can be onerous in a large deployment. This post describes how to implement a custom Postgres datasource that calls on IAM to generate a password whenever your application opens a connection to the database.

RDS Database Authentication with Spring Boot: Part 1, Secrets Manager

Frequent database password changes are a best practice, because they reduce the “blast radius” if compromised. However, restarting your applications in order to pick up the latest password can be onerous in a large deployment. This post describes how to use AWSLabs database driver that retrieves the current password from Secrets Manager whenever your application opens a connection to the database.