DEV Community: Ivan Bliskavka

10x API Start-up Boost

Ivan Bliskavka — Mon, 04 Mar 2024 22:55:18 +0000

I while ago I optimized my Screen Saver Gallery API by loading a flat data file into lambda memory. A nightly job selects a random subset of the database and stores it in S3, and the API uses that file for the next 24 hours.

This simplified my code, reduced costs, and improved performance.

The average API calls took 50-100ms! ...but the start-up time was 5 seconds!!!

I was using a lambda warmer, so most clients didn't hit the 5-second latency, but I wondered if I could reduce it.

Before

A nightly process reads data from Dynamo DB and generates a zip file that looks like this:

cache.zip
- tableA.json
- tableB.json

The zip file is stored in S3
When the lambda starts, it loads the zip file from S3, and loads it into memory (Duration: 4-5 seconds)

   let cache: Record<string, ITable>;

All future requests are served from the in-memory cache (50-100ms)

Attempt 1

Instead of loading from S3, store the zip file in a lambda layer, and rebuild the layer every night.

Result: This reduced the start-up by 1 second.

Attempt 2

The layer improved the load time, so it was a good start, but I felt like it should be faster.

I added some basic timers to my warmup function and discovered that almost 3 seconds were spent parsing the 217 files from the zip file.

I updated the code to parse the table files in parallel but it only shaved off 500ms.

Attempt 3

Armed with the timing information, I understood that my load issue was computationally constrained - decompressing zip files requires CPU cycles.

I refactored my lambda layer cache to be a single cache.json file that looks like this

{
  "tableA": [],
  "tableB": []
}

The lambda can load the data using readFileSync('/opt/cache.json') and parse it immediately.

Presto: Start-up load time is 500ms - a 10x improvement!

Conclusion

If your data is relatively static you can cache it as a flat file in a Lambda layer to reduce app complexity, costs, and startup times. Use a Lambda to periodically query a new data set and publish a new Lambda Layer Version.

When using layers, your maximum package size is 250MB. By compressing your data files you can cache A LOT of data, but you will experience decompression latency.

Dynamic AWS IAM Policies

Ivan Bliskavka — Sat, 02 Mar 2024 12:27:50 +0000

We maintain a CloudFormation custom resource provider for Amazon Connect. The provider has grown organically, and as new features were added, the default role policy has become large.

The provider can do simple low-security tasks like associateLambda, or complex tasks like createInstance, which requires access to security-sensitive resources like kms and iam.

During a recent security review, we discovered that the same role policy was being used across all provider instances. This meant that if we used a low-security operation, such as associateLambda, the role would be granted access to high-security resources like kms and iam.

Solution 1 - Inject a Pre-Built Role

For the current project, we resolved the issue by introducing an optional role prop. This allowed the developer to select specific IAM permissions.

// PSEUDO-CODE

class ConnectProvider {
  role: IRole;

  constructor(props: {role?: IRole}){
    if(!props.role){
      // Configures the default (overly permissive) permissions
      this.role = new Role(...);
    } else {
      // Uses the injected role
      this.role = props.role;
    }

    // Custom resource handler
    this.handler = new Function(... {role: this.role})
  }
}

const role = new Role(...);
role.addToPrincipalPolicy(
  new PolicyStatement({
    effect: Effect.ALLOW,
    actions: [
      'connect:AssociateLambdaFunction',
      'connect:DisassociateLambdaFunction'],
    resources: [instanceArn]
  })
);
const provider = new ConnectProvider({role});
provider.associateLambda(...)

Pros

We were able to quickly patch the current app

Cons

Each dependent app would have to be updated manually. We have A LOT!
The app developer must know exactly which IAM permissions are required.

Solution 2 - Dynamically Generate the Role

I updated the custom resource constructs to dynamically build up the policy based on which resources are used, so I could roll out the update in a backward-compatible way.

// PSEUDO-CODE

class ConnectProvider {
  role: IRole;

  constructor(props: {role?: IRole}){
    if(!props.role){
      this.role = new Role(...);
    } else if (props.role instanceof Role){
      // Convert to IRole to avoid manipulating the role
      this.role = Role.fromArn(props.role.roleArn)
    } else {
      this.role = props.role;
    }

    // Custom resource handler
    this.handler = new Function(... {role: this.role})
  }

  // Users call helper functions to create the custom resource
  associateLambda(id, instanceArn, lambda){
    if(this.role instanceof Role){
      // Dynamically update self-managed role
      this.role.addToPrincipalPolicy(
        new PolicyStatement({
          effect: Effect.ALLOW,
          actions: [
            'connect:AssociateLambdaFunction',
            'connect:DisassociateLambdaFunction'],
          resources: [instanceArn]
        })
      );
    }

    return new CustomResource({
      serviceToken: this.handler.functionArn,
      properties: {
        instanceArn,
        functionArn: lambda.functionArn
      }
    });
  }
}

Pros

No manual intervention is needed for dependent apps. Simply upgrade the NPM package and redeploy.

Cons

Resource deletion does not work properly.
- If you had a custom resource like associateLambda, everything works fine because the role policy is updated before the resource is created.
- But if you remove the custom resource in a future release, CloudFormation will update the role policy first (and remove the associated permission) before cleaning up the resource.
- As a result, you encounter a permission error when cleaning up the associateLambda resource
Circular dependencies
- If you used the provider to createInstance and then used the instance ARN in another construct like associateLambda you will encounter a circular reference
- Details
- Invoke createInstance and get instance ARN
- Invoke associateLambda using instance ARN
  - Instance ARN is used in the dynamic policy, resulting in a circular reference

Solution 3 - Mix of both

In the end, I decided to use a combination of both solutions. I created a ConnectProviderRoleBuilder to make it easier for developers to build the role.

Additionally, I also updated the ConnectProvider to automatically use the builder if a role is not provided.

This means that we can update existing apps without any manual intervention. If the app encounters the issues described in Solution 2 during ongoing development, the team can use the ConnectProviderRoleBuilder to generate an appropriate role quickly.

// PSEUDO-CODE

class ConnectProviderRoleBuilder {
  role: IRole;

  /**
    * Tracks if the provider was used to create an instance.
    * If so, we cannot limit role permissions to a specific instance
    * due to circular dependency.
    */
  private createdInstance: boolean = false;

  constructor(props: {existingRole?: IRole}){
    if(!props.role){
      this.role = new Role(...)
    } else if(props.role instanceof Role){
      // Ensures role is not manipulated by the builder
      this.role = Role.fromArn(props.existingRole.roleArn)
    } else {
      this.role = props.existingRole;
    }
  }

  /**
  * Create an instance ARN for permission filtering
  * If the provider was used to create the instance the ARN will be
  * `instance/*` to avoid circular dependency error
  * Assumes this provider will operate on a single instance.
  */
  instanceArn(instanceId: string): string {
    if (this.createdInstance) {
      // We can't reference the instanceId (circular ref)
      return `arn:aws:connect:${region}:${account}:instance/*`;
    } else {
      return `arn:aws:connect:${region}:${account}:instance/${instanceId}`;
    }
  }

  allow(actions, resources){
    if(this.role instanceof Role){
      // Only add permissions if the role is being managed by the construct.
      this.role.addToPrincipalPolicy(
        new PolicyStatement({
          effect: Effect.ALLOW,
          actions,
          resources
        })
      );
    }
  }

  // Helpers to add policy statements
  allowAssociateLambda(instanceId, ...functionArns){
    this.allow([
      'connect:AssociateLambdaFunction',
      'connect:DisassociateLambdaFunction'],
      [this.instanceArn(instanceId)]
    );

    // Update lambda resource policy to allow connect invoke

    // ...
  }
  allowCreateInstance(){
    this.createdInstance = true;
    this.allow(...)
    // ...
  }
  // ...
}

class ConnectProvider {
  builder: ConnectProviderRoleBuilder;
  role: IRole;
  constructor(props: {role?: IRole}){
    this.builder = new ConnectProviderRoleBuilder({role: props.role})
    this.role = this.builder.role;

    this.handler = new Function(... {role: this.role})
  }

  associateLambda(instanceId, lambda){
    this.builder.allowAssociateLambda(instanceId, lambda.functionArn)
    return new CustomResource({
      serviceToken: this.handler.functionArn,
      properties: {
        instanceId,
        functionArn: lambda.functionArn
      }
    })
  }
}

const myLambda: IFunction;

// Pre-build the role
const builder = new ConnectProviderRoleBuilder()
builder.allowAssociateLambda(instanceId, myLambda.functionArn)

const provider = new ConnectProvider({role: builder.role})
provider.associateLambda(instanceId, myLambda)

Conclusion

The simplest solution would have been to simply force the developer to inject a role but it would have created unnecessary developer friction because:

"My app used to deploy fine, but now I have to manually create a new role".
"I have no idea what is happening under the hood and which permissions are required", resulting in even more friction.

This solution was certainly more work, but it solved the problem with the least effort from the downstream developers.

No, go build secure and elegant tools!

Resolution error: PolicySynthesizer at 'PolicySynthesizer' should be created in the scope of a Stack, but no Stack found

Ivan Bliskavka — Fri, 16 Feb 2024 15:47:00 +0000

We occasionally have a client who does not allow us to create IAM roles in their AWS account. In this scenario we must define the roles in CloudFormation, they create them, and we inject the role ARNs into the app.

In the CloudFormation days, this would have been a significant overhaul if your app was not already set up for it. But with CDK, this is pretty easy with the Role.customizeRoles method.

While working on such a project, we bumped into this weird error:

Error: Resolution error: Resolution error: PolicySynthesizer at 'PolicySynthesizer' should be created in the scope of a Stack, but no Stack found.
Object creation stack:
  at stack traces disabled.
Object creation stack:
  at Execute again with CDK_DEBUG=true to capture stack traces
    at _lookup (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/stack.js:1:3005)
    at _lookup (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/stack.js:1:3178)
    at Function.of (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/stack.js:1:2736)
    at Object.produce (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resource.js:1:4264)
    at Reference.resolve (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resource.js:1:4877)
    at DefaultTokenResolver.resolveToken (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resolvable.js:1:1401)
    at resolve (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:2711)
    at Object.resolve [as mapToken] (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/private/resolve.js:1:1079)
    at TokenizedStringFragments.mapTokens (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/string-fragments.js:1:1475)
    at DefaultTokenResolver.resolveString (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resolvable.js:4:362)

The above error doesn't provide any meaningful info, but if you follow the instructions like so:

CDK_DEBUG=true npm run cdk -- synth

You get a much more meaningful error

Error: Resolution error: Resolution error: PolicySynthesizer at 'PolicySynthesizer' should be created in the scope of a Stack, but no Stack found.
Object creation stack:
  at new Intrinsic (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/private/intrinsic.js:1:942)
  at new Reference (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/reference.js:1:599)
  at new <anonymous> (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resource.js:1:4806)
  at mimicReference (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resource.js:1:4802)
  at CacheTable.getResourceArnAttribute (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/resource.js:1:4185)
  at new Table (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/aws-dynamodb/lib/table.js:1:18313)
  at new CacheTable (/home/ibliskavka/git/data-lakedata/packages/caching/src/constructs/CacheTable.ts:20:5)
  ... (truncated)
Object creation stack:
  at Function.string (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/core/lib/lazy.js:1:953)
  at CacheTable.combinedGrant (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/aws-dynamodb/lib/table.js:1:13211)
  at CacheTable.grantReadWriteData (/home/ibliskavka/git/data-lakedata/node_modules/aws-cdk-lib/aws-dynamodb/lib/table.js:1:6157)
  ... (truncated)

The CacheTable.grantReadWriteData stack trace deals with permissions (which we are customizing), so I traced it down to this bit of code

export class CachingLambdaRole extends Role {
  constructor(scope: Construct, id: string, props: CachingLambdaRoleProps) {
    super(scope, id, {
      assumedBy: new ServicePrincipal('lambda.amazonaws.com'),
    });
    props.table.grantReadWriteData(this);
  }
}

When I replaced props.table.grantReadWriteData(this) with policy statements in the role inlinePolicy the error went away and I was able to deploy.

TL;DR;

Enable CDK_DEBUG
Check if your stack trace uses the grant API. If so, try replacing it with policy statements.

More Info

I was able to find only a few articles about this error message and none of them dealt with customizeRoles. I suspect this may be a bug in the CDK code because my app uses the grant API elsewhere in the code and it works as-is.

TechHub Hackathon 2023

Ivan Bliskavka — Mon, 02 Oct 2023 14:27:04 +0000

We pulled together a team on Friday night, built an app on Saturday, and presented on Sunday. Not a win, but what a great experience!

The Team

Project Description

Habitat for Humanity, a renowned non-profit organization dedicated to building homes and better communities, faces several operational challenges that your hackathon team can help address:

Targeting New Audiences/Real-Time Inventory Management : Implement a solution that updates the online inventory in real-time, ensuring that customers are aware of available items and reducing discrepancies.

Background

Before starting any design work, our team decided to take a field trip to the Broward ReStore, which was 30 minutes away.

The store manager Mark, was very gracious and spent 30 minutes talking about the store, the mission, the volunteers, and the amazing items that pass through his store.

Some Interesting Points

Each store operates like a franchise and typically manages its own outreach, website, etc.
Mark just came back from a conference with other ReStores where they shared ideas and approaches.
Some stores (Los Angeles) have an excellent social media presence including viral videos on TikTok.
Independent stores can have their own website, but there is no central platform for posting or managing inventory.
The Broward store does not have a website, but they have a Facebook page.
They move a lot of furniture, and the entire sales floor is typically replaced in a couple of weeks. Because each item is unique, maintaining a website inventory is a lot of overhead.

Donation Receiving

Mark said that 54% of donations are corporate. Typically the item is scratched, dented, or discontinued.

He typically uses Google Lens to scan the item to get a feel for what the item sells for. From this price, he discounts about 50%.

Proposal

A SaaS-like platform that is owned and managed by the Habitat for Humanity “Corporate”
Each store is a “tenant” on the platform and can manage its own inventory.
The inventory is streamlined using a web app, on a mobile phone
- Receiving takes a photo and adds a quality rating.
- The app uploads a photo to the cloud and uses image recognition to identify the product.
- If the product is IDed, meta-data and trending price is returned to the app.
- Price is automatically discounted based on quality rating: 3-50%, 2-60%, 1-70%
- If the item is not IDed, the app prompts for metadata and price.
- Idea: If the current user is not the manager, the item will need to be approved by the manager.
- Once approved, the item automatically shows up on the website and in the Point of Sale system.
- A QR Code sticker is printed and attached to the item. (Bluetooth printer)
- When the item is sold, the sticker is scanned, and it is automatically removed from the website.
The SaaS platform dynamically builds a storefront for each tenant
- Adds the ability to search all stores in the vicinity.
- Customers can buy online and pick up in the store.
- Orders not picked up within X days are a donation.
- Online customer contact data can be imported into Outreach programs.

Technical Architecture

With 900 stores across the country and hundreds of thousands of customers, we need to consider scalability. We chose to build using managed services in the cloud for resilience, durability, and scalability.

Result

Unfortunately, we didn’t win. Here are some presentation takeaways for future reference.

~~Going first was a disadvantage. We didn’t know what to expect, and probably the judges didn’t either.~~
- Even if our presentation was a 10/10, there is no way a judge would assign that to the first presentation without seeing all the other stuff. And there is no way they remembered ours after 16 presentations.
- [Correction 10/3/23]: Going first was a challenge, we were up for it, and we did great!
We should have figured out how to screen share an iPhone. Seeing it on a phone would be more impressive.
Personally, I was more focused on the practicality of the idea and our ability to execute (in 8-12) hours
- Since only 2 of the judges were asking technical questions, I assume the others were more business-minded. They weren’t judging on “can these people do it”, they were judging on “as described, will this idea impact a lot of people?”
- TL;DR; Go for the big idea - not on the technical feasibility.
Currently, AI is all the rage. Reverse Image Search uses an AI model, we should have emphasized that more in the presentation.

Interview Pointers for Bootcamp Grads

Ivan Bliskavka — Wed, 05 Apr 2023 20:05:00 +0000

I met Todd Albert, the founder of Boca Code at an AWS networking event hosted by CloudHesive. He got a kick out of the fact that I was a plumber before I got into IT, so he invited me to speak to the 9th cohort of the Boca Code Developer Bootcamp.

It was a great experience! The facility is cozy and everyone was super friendly. They also had great coffee and an awesome selection of laptop stickers!

I spoke about my journey from being a plumber to being a Sr. Architect at the leading Amazon Connect integrator, there were jokes, laughter, and most importantly - questions!

Questions

How long did it take before you finally felt confident as a developer?

About 3 years - but you can get there sooner! The first 2 years I worked alone and didn’t have anyone to compare to, so I assumed I wasn't very good but I kept studying and kept at it.

The 3rd year I worked with a team of sub-contractors on a project that got scrapped - so I figured that wasn't a very good metric.

In my fourth year I moved to another company with a full internal dev team - and I realized that in many respects I was ahead of guys with 10-15 years of experience. They knew A LOT, but much of that tech was already dead. I knew a lot MORE than them about the current tech.

Don't forget that as a bootcamp graduate your education may be more current than the other devs. You still have to get experience, but I promise you are doing much better than your imposter syndrome is telling you.

What makes a good impression for new employees?

Typically the onboarding material includes reading, and assignments to get you familiar with the toolset. If you are spinning your wheels for 2 days on something - and the answer is in the reading, this is a strong negative.

You did not read the assignment and you just wasted 2 days because you are afraid to ask for help.
I would rather you do the reading, do some googling, and when you are stuck for 4-8 hours, reach out for help. This work requires communication - maybe the requirements were unclear - being able to clear that up on your own initiative is very impressive!

Corollary - don’t ask for help for every little thing. Do your due diligence. Also, take notes - don’t ask the same thing over and over again.

What type of questions do you usually ask at an interview?

I like to gauge a candidate's skill level, and then dive a little deeper based on their response.

For a Jr role I may ask what is the difference between an RDBMS and a NoSQL db.
- Followup: When would you choose one over the other and why?
For a mid role I would ask them to name the 3 types of testing (Unit, Integration, Manual).
- What is the difference?
- How would you design your code to make testing easier? (expecting mocks & dependency injection)
For a senior role I would have a conversation about design patterns.
I always love to ask about personal or favorite projects. You have to love this work to be exceptional at it. If you don’t have any code you are proud of - it’s a turn-off.
What is the most impactful project you have participated in? What was the impact - social, financial, etc? You have to be able to speak about your work in terms of return on investment

What tips do you have for interviewing?

Be collaborative. If you are asked design questions they may be intentionally vague - ask the interviewer clarifying questions.

If the question requires a succinct factual response, and you don't know the answer immediately, you can ask questions to get partial credit.

For example:

I am not familiar with the term X, would you provide a short description and I may be able to able to answer the rest of the question?
I have never used that in my work, but I think I know what it does based on your description - can I try to guess?

Remember not to B.S. during a technical interview. I prefer someone who says honestly "I don't know the answer, but am willing to try anyway if you give me some hints".

In the real world you will rarely have all the facts. You will have to reach out to the client who reported the bug and ask them to do a screen share so that you can see what is happening. Asking good questions is part of the job.

Would you recommend I get cloud certs?

I work in an AWS shop. I would take an AWS certified bootcamp grad over a non-certified grad any day. It's probably less relevant if the company is not using AWS, but it still shows personal initiative and a willingness to learn.

If you are applying to work for an AWS Partner, they have to have a minimum amount of AWS Certified engineers to maintain their partner status. Having a cert in this case is extremely useful.

Understanding your job economics

During my talk I mentioned a couple of concepts and a student asked me to elaborate on them.

Understanding the economics of your business

I work in the call center space - for each minute a customer is on a call it costs the company $1. If you have thousands of agents, and tens of thousands of calls per month, these figures start to add up!

Reducing the average call handle time for a call by 1% for a sufficiently large business can reduce costs by millions over several years. If I can contribute that improvement consistently - my career is made.

Understanding the economics of your position

Typically IT is a cost center, not a profit center. You cost money. If you are doing right, you cost a lot of money (per hour).

You should NOT be doing work that a computer can do faster, better, and more consistently. For this reason you should be on the lookout for automation, devops, scripts, or processes that reduce the amount of repetitive/manual work that you do, so you can focus on real innovations.

Example: If some nightly job runs for 3 hours - don't bother spending 3 days speeding it up. It starts at 12:00, finishes by 3:00, and the first person that needs it is at 8:00. There is a 5-hour buffer - but you just cost the company 3 days for no economic benefit.

Not everything needs to be a script. If some work only happens once a month and takes 15 minutes - a How-To guide may be more appropriate. Next time you have to do the task, you can do it in 10 minutes, or simply hand it off to the new guy :)

If you can make yourself (and others) more productive through automation and/or documentation you will also go far.

Conclusion

It was fun to reflect on my journey and share some personal experiences with budding new developers!

Boca Code is an intense 40/hrs a week, for 10 weeks, software development bootcamp. Having spoken with the class and founders - I highly recommend them!

CDK package.json Scripts

Ivan Bliskavka — Wed, 05 Apr 2023 19:49:00 +0000

I found the following package.json scripts very convenient when managing a complex CDK app. The key is the -- operator, which allows us to append additional parameters to a script.

{
  "scripts": {
    "build": "tsc --noEmit",
    "cdk": "npm run build && cdk",
    "cdk:pipeline": "npm run build && cdk --app 'npx ts-node --prefer-ts-exts bin/pipeline.ts'",
    "test": "jest",
    "diff": "npm run cdk -- diff",
    "synth": "npm run cdk -- synth --quiet",
    "deploy": "npm run cdk -- deploy --all --require-approval never",
    "deploy:pipeline": "npm run cdk:pipeline -- deploy --all --require-approval never"
  }
}

This configuration allows us to create convenient scripts like deploy/diff/synth, but we still have the ability to pass in additional parameters like:

npm run deploy -- --no-rollback --profile default

I can also define multiple entry points

cdk: Interact with the stack directly.
cdk:pipeline: Deploy a CDK Pipeline which is able patch the CDK app when new changes are pushed.

A pipeline execution can be slow, so being able to circumvent the pipeline in a dev/sandbox environment is extremely useful.

Synth CDK app to Custom Bucket

Ivan Bliskavka — Mon, 07 Feb 2022 22:50:32 +0000

Some AWS customers don't use the CLI, and will not grant an external contractor CLI access. Trying to get access is a waste of time and resources. Do not fear, there is a solution!

Summary

Create a client specific staging bucket
Share the bucket with the client account via Bucket Policy
Synth the stack to the staging bucket
Share template URL with client
Client can install using the URL in CloudFormation web console with their own user credentials

App Staging Bucket Policy

{
  "Sid": "MyClient",
  "Effect": "Allow",
  "Principal": {
      "AWS": [
          "arn:aws:iam::DEV_ACCOUNT_ID:root",
          "arn:aws:iam::PROD_ACCOUNT_ID:root"
      ]
  },
  "Action": [
      "s3:GetObject",
      "s3:GetObjectVersion"
  ],
  "Resource": "arn:aws:s3:::app-staging-bucket/*"
}

Usage

Install CDK Assets npm i -D cdk-assets

Customize the stack synthesizer to use your custom staging bucket

const app = new cdk.App();

new MyApp(app, 'template', {
  someParam: 'someValue',
  synthesizer: new DefaultStackSynthesizer({
    fileAssetsBucketName: 'app-staging-bucket',

    // Use a custom role which has access to the asset bucket
    fileAssetPublishingRoleArn: 'my-client-staging-role',

    // Consider using a build date or version
    bucketPrefix: '2.4.1',

    // The client account does not need to be bootstrapped
    generateBootstrapVersionRule: false,
  }),
});

app.synth();

Run cdk synth to generate your assets.
Modify cdk.out/template.assets.json to make the template file name more predictable
- find entry with sourcePath=template.template.json
- modify its objectKey to something like 2.4.1/template.json
- (you should probably write some code to automate this)
Run cdk-assets -v -p ./cdk.out/template.assets.json publish
Share your template URL with the client. It will look something like:

https://app-staging-bucket.s3.amazonaws.com/2.4.1/template.json
Client can install the app using the CloudFormation web console.

Simpler Template Output

Not sure what the side-effects of these are, but this produces a simpler template with less CDK metadata.

cdk synth --path-metadata false --version-reporting false

cdk.json

{
  "context": {
    "@aws-cdk/core:newStyleStackSynthesis": false,
  }
}

Conclusion

This has been very helpful for creating installers that are accessible to non-developers and usable in beginner AWS environments. I hope it save you some head-scratching!

Originally posted on my blog

AWS Athena SAM Policies

Ivan Bliskavka — Fri, 24 Dec 2021 17:04:07 +0000

AWS Athena provides SQL queries over S3 data. The service depends on S3, Glue, and Athena itself so getting permissions set up can be tricky. Here is what worked for me.

StartQueryFunction:
  Type: AWS::Serverless::Function
  Properties:
    Handler: src/lambda/search.start
    Policies:
      - S3ReadPolicy:
          BucketName: !Ref DataBucket
      - S3CrudPolicy:
          BucketName: !Ref AthenaResultsBucket
      - AthenaQueryPolicy:
          WorkGroupName: !Ref AthenaWorkGroup
      - Statement:
        - Effect: Allow
          Action:
          - glue:GetTable
          Resource:
          - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:catalog
          - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:database/${GlueDatabase}
          - !Sub arn:aws:glue:${AWS::Region}:${AWS::AccountId}:table/${GlueDatabase}/*

GetResultFunction:
  Type: AWS::Serverless::Function
  Properties:
    Handler: src/lambda/search.results
    Policies:
      - S3CrudPolicy:
          BucketName: !Ref AthenaResultsBucket
      - AthenaQueryPolicy:
          WorkGroupName: !Ref AthenaWorkGroup

Cheers!

Async Array Filter

Ivan Bliskavka — Fri, 22 Oct 2021 13:04:33 +0000

private asyncFilter = (arr, predicate) => {
  return Promise.all(arr.map(predicate))
    .then((results) => arr.filter((_v, index) => results[index]));
}

Fargate + EFS Permissions using CDK

Ivan Bliskavka — Thu, 21 Oct 2021 21:16:20 +0000

I struggled WAY too long trying to sort out the permissions for EFS. Turns out, there are 2 layers. The IAM role, and the Posix permissions. Both throw a similar looking access denied. Finally!

Don't judge me on the single AZ. I am running a single task in Fargate and only need one instance.

const {vpc, az, region, account} = props;

const fileSystem = new FileSystem(this, 'Efs', {
  vpc,
  performanceMode: PerformanceMode.GENERAL_PURPOSE,
  vpcSubnets: {
    subnetType: ec2.SubnetType.PUBLIC,
    onePerAz: true,
    availabilityZones: [az]
  }
});

const accessPoint = new AccessPoint(this, 'AccessPoint', {
  fileSystem: fileSystem,
});

const task = new ecs.FargateTaskDefinition(this, 'Task', {
  cpu: 256,
  memoryLimitMiB: 512
});

const volumeName = 'efs-volume';

task.addVolume({
  name: volumeName,
  efsVolumeConfiguration: {
    fileSystemId: fileSystem.fileSystemId,
    transitEncryption: 'ENABLED',
    authorizationConfig:{
      accessPointId: accessPoint.accessPointId,
      iam: 'ENABLED'
    }
  }
});

const container = task.addContainer('Container', {
  image: ecs.ContainerImage.fromAsset('./container'),
  portMappings: [{hostPort: 80, containerPort: 80}],
});

container.addMountPoints({
  containerPath: '/mount/data',
  sourceVolume: volumeName,
  readOnly: false
});

task.addToTaskRolePolicy(
  new iam.PolicyStatement({
    actions: [
      'elasticfilesystem:ClientRootAccess',
      'elasticfilesystem:ClientWrite',
      'elasticfilesystem:ClientMount',
      'elasticfilesystem:DescribeMountTargets'
    ],
    resources: [`arn:aws:elasticfilesystem:${region}:${account}:file-system/${fileSystem.fileSystemId}`]
  })
);

task.addToTaskRolePolicy(
  new iam.PolicyStatement({
    actions: ['ec2:DescribeAvailabilityZones'],
    resources: ['*']
  })
);

I hope this save someone a headache!

Originally posted on my blog

Help: Logical ID Changed in my CDK App

Ivan Bliskavka — Fri, 17 Sep 2021 15:52:42 +0000

I recently came across a weird error in a private package CDK deploy:

{dynamo table name} already exists in stack {current stack arn}

Upon further investigation it turned out that one of our internal CDK modules for building the dynamo tables has changed how it was naming the construct, resulting in a different CloudFormation Logical ID. Since we were explicitly naming the table, the stack update could not complete, because the table already exists.

This app is a self-contained NPM module, so I wasn't able to modify the construct, but I came up with a workaround.

Back up the dynamo table data
Copy the raw stack yaml from CloudFormation and save it on your computer
Delete the table resource and references from the template
Update the stack with the new template using the CloudFormation web console
Verify that the table was deleted (and not retained) by CloudFormation
Redeploy the CDK app, which will create a new table
Restore the table data

Missing Amplify UI Styles in Electron App

Ivan Bliskavka — Wed, 15 Sep 2021 18:57:28 +0000

I recently discovered the Electron React Boilerplate project and wanted to use the AWS Amplify Authenticator. Lo and Behold: its ugly...

I had used the typical index.tsx import and I could see the CSS output, but for some reason it did not work.

// index.tsx
import "@aws-amplify/ui/dist/style.css";

After much Googling, it turns out that Electron React Boiler plate does some webpack-ing magic under the hood.

The correct way to add the css is to import it in App.global.css:

/* App.global.css */
@import '~@aws-amplify/ui/dist/style.css';

Originally posted on my blog

DEV Community: Ivan Bliskavka

10x API Start-up Boost

Before

Attempt 1

Attempt 2

Attempt 3

Conclusion

Dynamic AWS IAM Policies

Solution 1 - Inject a Pre-Built Role

Pros

Cons

Solution 2 - Dynamically Generate the Role

Pros

Cons

Solution 3 - Mix of both

Conclusion

Resolution error: PolicySynthesizer at 'PolicySynthesizer' should be created in the scope of a Stack, but no Stack found

TL;DR;

More Info

TechHub Hackathon 2023

The Team

Project Description

Background

Some Interesting Points

Donation Receiving

Proposal

Technical Architecture

Result

Links

Interview Pointers for Bootcamp Grads

Questions

How long did it take before you finally felt confident as a developer?

What makes a good impression for new employees?

What type of questions do you usually ask at an interview?

What tips do you have for interviewing?

Would you recommend I get cloud certs?

Understanding your job economics

Understanding the economics of your business

Understanding the economics of your position

Conclusion

CDK package.json Scripts

Synth CDK app to Custom Bucket

Summary

App Staging Bucket Policy

Usage

Simpler Template Output

cdk.json

Conclusion

AWS Athena SAM Policies

Async Array Filter

Fargate + EFS Permissions using CDK

Help: Logical ID Changed in my CDK App

Missing Amplify UI Styles in Electron App