DEV Community: Moya Richards

Automate Post-Deployment Tasks with `cdkTrigger` in AWS CDK

Moya Richards — Fri, 18 Jul 2025 15:40:43 +0000

Deploying infrastructure with AWS CDK is powerful — but sometimes, you want something more than just resources in place. Maybe you want to:

Seed a database after deployment
Populate an S3 bucket with default data
Kick off a workflow
Or simply validate that everything deployed successfully

That's where the cdk-triggers module comes in. In this post, we'll walk through how to use cdk.triggers.Trigger to automatically invoke a Lambda function after a successful CDK deployment.

🔧 What is `cdk.triggers.Trigger`?

The Trigger construct is part of the aws-cdk-lib.triggers module. It allows you to run a Lambda automatically after your stack is deployed — great for bootstrapping and post-deploy configuration tasks.

🧪 Example: Run a Lambda After Resources Are Created

Let’s say you’re deploying:

An S3 bucket
A DynamoDB table
A Lambda that seeds a database

You want the Lambda to run after all the resources are successfully created.

Step 1: Import Required Modules

import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as dynamodb from "aws-cdk-lib/aws-dynamodb";
import * as triggers from "aws-cdk-lib/triggers";
import { Construct } from "constructs";

Step 2: Define the Stack

export class MyStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // S3 bucket
    const bucket = new s3.Bucket(this, "MyBucket");

    // DynamoDB table
    const table = new dynamodb.Table(this, "MyTable", {
      partitionKey: { name: "id", type: dynamodb.AttributeType.STRING },
    });

    // Lambda function to run post-deploy
    const seedFunction = new lambda.Function(this, "SeedFunction", {
      runtime: lambda.Runtime.NODEJS_18_X,
      handler: "index.handler",
      code: lambda.Code.fromAsset("lambda/seed"),
      timeout: cdk.Duration.minutes(5),
      environment: {
        BUCKET_NAME: bucket.bucketName,
        TABLE_NAME: table.tableName,
      },
    });

    bucket.grantReadWrite(seedFunction);
    table.grantReadWriteData(seedFunction);

    // Create the trigger
    const cdkTrigger = new triggers.Trigger(this, "SeedTrigger", {
      handler: seedFunction,
      timeout: cdk.Duration.minutes(10),
      invocationType: triggers.InvocationType.EVENT, // async invocation
    });

    // Define dependencies – only run trigger after these resources are created
    cdkTrigger.executeAfter(bucket);
    cdkTrigger.executeAfter(table);
  }
}

🔁 How It Works

During deployment, CDK will:

Deploy your stack’s resources (bucket, table, Lambda).
Automatically invoke the seedFunction via the trigger.
Ensure it runs only once (unless you opt to re-run it).

🛠 Notes & Best Practices

The Trigger construct deploys a custom resource under the hood.
The invocationType can be:
- EVENT: Asynchronous (default and recommended for non-critical background jobs)
- REQUEST_RESPONSE: Wait for result (useful for critical tasks, but can cause stack rollback on failure)
You can use cdkTrigger.executeAfter(...) to control execution order and guarantee your resources are ready.
To re-run the trigger every deploy, set cdkTrigger.trigger.runOnUpdate = true.

🧹 Optional: Clean Up After Execution

By default, the Lambda and the trigger stay in place. If you want to clean up the Lambda after running:

cdkTrigger.applyRemovalPolicy(cdk.RemovalPolicy.DESTROY);

Or consider separating your post-deployment logic into a one-time stack.

✅ Summary

cdk.triggers.Trigger is a great way to kick off post-deployment automation in a clean, repeatable way.

Use it to:

Seed databases
Initialize state
Validate configs
Or automate any once-per-deploy logic

No need for separate scripts or manual steps — just CDK.

📁 Example Directory Structure

my-app/
├── bin/
│   └── my-app.ts
├── lib/
│   └── my-stack.ts
├── lambda/
│   └── seed/
│       └── index.ts

🧪 Want to Try It?

Make sure you have the triggers module installed:

npm install aws-cdk-lib constructs

That’s it! Happy automating with CDK! ⚙️

Fixing Lambda to Aurora PostgreSQL Connection Timeout Issues in AWS

Moya Richards — Wed, 09 Jul 2025 17:15:36 +0000

Fixing Lambda to Aurora PostgreSQL Connection Timeout Issues in AWS

"errorMessage": "connection to server at \"my-aurora-database.cluster-xxxxx.region.rds.amazonaws.com\" (10.0.0.1), port 5432 failed: timeout expired"

If you've encountered the dreaded "connection timeout" error when trying to connect your AWS Lambda function to Aurora PostgreSQL, you're not alone.
This post will guide you through the common causes and solutions to this frustrating issue.

The Error

{
  "cause": {
    "errorMessage": "connection to server failed: timeout expired",
    "errorType": "OperationalError"
  }
}

Common Causes

VPC Configuration Issues: Lambda can't reach Aurora
Security Group Misconfigurations: Missing or incorrect inbound/outbound rules
Missing VPC Endpoints: Required for proper AWS service communication
Network ACL Issues: Blocking necessary traffic

Step-by-Step Solution

1. VPC Setup

First, ensure your VPC is properly configured with CDK:

const vpc = new ec2.Vpc(this, 'MyVPC', {
  maxAzs: 2,
  natGateways: 1,
  subnetConfiguration: [
    {
      cidrMask: 24,
      name: 'Private',
      subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
    },
    {
      cidrMask: 24,
      name: 'Public',
      subnetType: ec2.SubnetType.PUBLIC,
    }
  ]
});

2. Add Required VPC Endpoints

// Add necessary VPC endpoints
vpc.addInterfaceEndpoint('SecretsManagerEndpoint', {
  service: ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER
});

vpc.addInterfaceEndpoint('RDSEndpoint', {
  service: ec2.InterfaceVpcEndpointAwsService.RDS
});

vpc.addGatewayEndpoint('S3Endpoint', {
  service: ec2.GatewayVpcEndpointAwsService.S3
});

3. Configure Security Groups

// Lambda security group
const lambdaSG = new ec2.SecurityGroup(this, 'LambdaSG', {
  vpc,
  description: 'Security group for Lambda functions'
});

// Aurora security group
const auroraSG = new ec2.SecurityGroup(this, 'AuroraSG', {
  vpc,
  description: 'Security group for Aurora'
});

// Allow Lambda to connect to Aurora
auroraSG.addIngressRule(
  lambdaSG,
  ec2.Port.tcp(5432),
  'Allow PostgreSQL access from Lambda'
);

4. Lambda Function Configuration

const lambda = new lambda.Function(this, 'MyFunction', {
  runtime: lambda.Runtime.PYTHON_3_9,
  handler: 'index.handler',
  code: lambda.Code.fromAsset('lambda'),
  vpc: vpc,
  vpcSubnets: {
    subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS
  },
  securityGroups: [lambdaSG],
  timeout: Duration.seconds(30)  // Increase from default 3 seconds
});

5. Database Connection Code

Implement proper connection handling in your Lambda:

import psycopg2
from psycopg2 import OperationalError

def get_db_connection():
    try:
        conn = psycopg2.connect(
            host="your-aurora-endpoint",
            database="your-database",
            user="your-username",
            password="your-password",
            connect_timeout=5,
            keepalives=1,
            keepalives_idle=30,
            keepalives_interval=10,
            keepalives_count=5
        )
        return conn
    except OperationalError as e:
        print(f"Connection error: {e}")
        raise

Troubleshooting Checklist

[ ] Verify Lambda and Aurora are in the same VPC
[ ] Check security group inbound/outbound rules
[ ] Confirm VPC endpoints are properly configured
[ ] Validate subnet configurations
[ ] Review Network ACL settings
[ ] Check Aurora instance status and capacity
[ ] Verify database credentials

Conclusion

Connection timeout issues between Lambda and Aurora typically stem from networking misconfigurations. By following this systematic approach to VPC setup, security groups, and connection handling, you can establish reliable connectivity between your Lambda functions and Aurora PostgreSQL database.
With these implementations, your Lambda functions should successfully connect to Aurora PostgreSQL without timeout issues.

Additional Resources

Resolving AWS Secrets Manager Access in AWS Lambda: A Tale of Two Regions

Moya Richards — Tue, 10 Jun 2025 21:12:15 +0000

Have you ever found yourself scratching your head when your AWS Lambda function works perfectly in one region but fails in another?

Recently, I encountered this exact scenario when moving a function from us-east-1 to eu-west-1.

The culprit? VPC endpoints and Secrets Manager access.

Let's dive into the problem and its solution.

The Problem

Our Lambda function, happily running in us-east-1, suddenly threw this error when deployed to eu-west-1:

An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::ACCOUNT_ID:assumed-role/ROLE_NAME is not authorized to perform: secretsmanager:GetSecretValue on resource: SECRET_ARN because no identity-based policy allows the secretsmanager:GetSecretValue action

The puzzling part? The IAM permissions were identical in both regions.

The Root Cause

After some investigation, i uncovered the core issue: VPC endpoints. In us-east-1, AWS often provides default VPC endpoints for common services, especially in older accounts or those part of organizations with pre-configured settings. However, these default endpoints don't exist in eu-west-1.

Our Lambda function, configured to run in a VPC for enhanced security, couldn't reach Secrets Manager in eu-west-1 without an explicit VPC endpoint.

The Solution

The fix involves creating a VPC endpoint for Secrets Manager in my eu-west-1 VPC. Here's how i did it using AWS CDK:

First, i modified my VPC construct to include an option for creating a Secrets Manager endpoint:

export interface VpcConstructProps extends cdk.StackProps {
    // ... other properties ...
    readonly hasSecretsManagerEndpoint?: boolean;
}

const defaultProps: Partial<VpcConstructProps> = {
    // ... other defaults ...
    hasSecretsManagerEndpoint: false,
};

Then, in the VPC construct's constructor, i added logic to create the endpoint:

constructor(parent: Construct, name: string, props: VpcConstructProps) {
    // ... existing constructor code ...

    if (props.hasSecretsManagerEndpoint) {
        const secretsManagerEndpoint = vpc.addInterfaceEndpoint("SecretsManagerEndpoint", {
            service: cdk.aws_ec2.InterfaceVpcEndpointAwsService.SECRETS_MANAGER,
        });

        // Suppress cdk-nag warnings
        NagSuppressions.addResourceSuppressions(
            secretsManagerEndpoint,
            [
                {
                    id: 'AwsSolutions-EC23',
                    reason: 'Security Group created by VPC Endpoint allows internal VPC traffic only'
                }
            ],
            true
        );
    }

    // ... rest of constructor code ...
}

Finally, when creating my VPC, i enabled the Secrets Manager endpoint:

const vpc = new VpcConstruct(this, 'MyVPC', {
    // ... other props ...
    hasSecretsManagerEndpoint: true,
});

create a vcp endpoint via AWS CLI

#create vcp endpoint via AWS CLI

# Example VPC details

VPC_ID="vpc-12345abcdef"
SUBNET_IDS="subnet-11111aaaaa subnet-22222bbbbb"
SECURITY_GROUP_ID="sg-33333ccccc"
REGION="eu-west-1"

# Create the VPC endpoint
aws ec2 create-vpc-endpoint \
    --vpc-id $VPC_ID \
    --vpc-endpoint-type Interface \
    --service-name com.amazonaws.$REGION.secretsmanager \
    --subnet-ids $SUBNET_IDS \
    --security-group-ids $SECURITY_GROUP_ID \
    --region $REGION


# To verify the endpoint was created:
aws ec2 describe-vpc-endpoints \
    --filters Name=vpc-id,Values=$VPC_ID \
    --region $REGION

The Outcome

After deploying these changes, my Lambda function in eu-west-1 could successfully access Secrets Manager, just like in us-east-1. The error disappeared, and my application worked consistently across regions.

Lessons Learned

Regional Differences Matter: Always be aware that AWS services and default configurations can vary between regions.
VPC Endpoints are Crucial: When running Lambda in a VPC, consider which AWS services you need to access and ensure appropriate VPC endpoints are in place.
Explicit is Better than Implicit: While some regions might have default endpoints, it's better to explicitly define your infrastructure needs in your IaC code.
Test in Multiple Regions: Always test your applications in all regions where you plan to deploy.

By understanding and addressing these nuances, we can build more robust, portable, and predictable cloud applications. Happy coding!

Fixing “exit code: 255” in AWS CodeBuild

Moya Richards — Mon, 09 Jun 2025 21:51:32 +0000

🚀 CDK Docker Lambda Builds: Multi-Architecture to the Rescue

If you've ever run into this Docker build error while deploying an AWS Lambda with CDK via codebuild:

ERROR: failed to solve: process "/bin/sh -c pip3 install --target \"${LAMBDA_TASK_ROOT}\" -r requirements.txt --no-cache-dir" did not complete successfully: exit code: 255
Failed to build asset EtlAuroraPostgresConstruct/ETLTaskProcessorlambdaFn/AssetImage

...and scratched your head over what was wrong, you're not alone.

After digging in, I found the culprit:

❌ AWS CodeBuild only supports x86_64 (amd64) architecture, but I was building a Lambda targeting arm64.

In this post, I’ll walk through how I fixed it using:

Docker’s ${BUILDPLATFORM} variable
CDK environment config switching
Multi-platform Dockerfile magic

💥 The Problem

If you're building Lambda functions using Docker bundling in CDK and targeting arm64, but your build infrastructure (e.g., CodeBuild) only supports x86_64, you’ll hit architecture mismatches.

Symptoms:

CDK build fails with cryptic Docker errors.
Exit code 255 from pip install.
It works locally on M1/M2 Macs or with arm64 runtimes — but fails in CI/CD.

🛠️ The Solution

✅ Step 1: Use `BUILDPLATFORM` in Your Dockerfile

To avoid architecture mismatch, set the platform explicitly in your Dockerfile:

# syntax=docker/dockerfile:1

FROM --platform=${BUILDPLATFORM} public.ecr.aws/lambda/python:3.12

RUN echo "Build platform: ${BUILDPLATFORM}" && echo "Target architecture: ${TARGETARCH}"

WORKDIR ${LAMBDA_TASK_ROOT}
COPY requirements.txt .

RUN pip3 install -r requirements.txt --no-cache-dir

COPY . .

CMD ["index.lambda_handler"]

💡 ${BUILDPLATFORM} is automatically injected by Docker when using BuildKit and --platform.

✅ Step 2: Add a CDK Architecture Config Switcher

Create a utility to determine platform & architecture based on an environment variable (CDK_LAMBDA_ARCHITECTURE):

// get-architecture-config.ts

import * as cdk from "aws-cdk-lib";
import * as dotenv from "dotenv";

dotenv.config();

export const getArchitectureConfig = () => {
  const arch = process.env.CDK_LAMBDA_ARCHITECTURE || "arm64";

  switch (arch.toLowerCase()) {
    case "arm64":
      return {
        architecture: cdk.aws_lambda.Architecture.ARM_64,
        platform: cdk.aws_ecr_assets.Platform.LINUX_ARM64,
      };
    case "x86_64":
    case "amd64":
      return {
        architecture: cdk.aws_lambda.Architecture.X86_64,
        platform: cdk.aws_ecr_assets.Platform.LINUX_AMD64,
      };
    default:
      throw new Error(`Unsupported architecture: ${arch}`);
  }
};

This allows you to dynamically select the right platform during bundling.

✅ Step 3: Use It in Your CDK Lambda Definition

In your CDK Stack, integrate the platform and architecture selection into the Lambda function:

const { architecture, platform } = getArchitectureConfig();

code: lambda.Code.fromAsset(lambdaFnPath, {
  bundling: {
    image: targetRuntime.bundlingImage,
    command: [
      "bash",
      "-c",
      "pip install --no-cache-dir -r requirements.txt --only-binary=:all: --target /asset-output/python",
    ],
    user: "root",
    platform: platform.platform,
  },
}),
architecture,

✅ Step 4: Deploy with the Right Architecture

To switch architectures on demand, pass an env variable when deploying:

DOCKER_BUILDKIT=1 BUILDX_NO_DEFAULT_ATTESTATIONS=1 CDK_LAMBDA_ARCHITECTURE="amd64" cdk deploy

✅ This forces CDK to build for x86_64, which works inside AWS CodeBuild or other amd64-only systems.

✅ Final Tips

Default to arm64 if you’re developing on an Apple Silicon machine and only override in CI/CD.
Add a .env file or use CI/CD variables to switch easily.
If you want reproducible builds, pin the base image version and dependencies tightly.

.env

export CDK_LAMBDA_ARCHITECTURE="amd64"
export DOCKER_BUILDKIT=1
export BUILDX_NO_DEFAULT_ATTESTATIONS=1

🧪 Conclusion

By using BUILDPLATFORM, environment-based architecture switching, and a bit of CDK magic, you can seamlessly build Docker-based Lambda functions for both arm64 and x86_64, even if your CI/CD platform only supports one.

This approach lets you:

Build natively for your development machine
Deploy reliably from CI/CD
Avoid architecture mismatch errors like exit code 255

Resolving Amazon Elastic Container Registry (ECR) Push Errors

Moya Richards — Sun, 12 Jan 2025 23:49:46 +0000

Step by step guide to resolving Amazon Elastic Container Registry (ECR) issues with Docker Images for CLI and DockerImageFunction

Source Code : Example CDK construct with lambda function:

https://github.com/moyarich/how-to-resolve-amazon-ecr-push-issues

Common ECR Push Errors

Here are some typical errors you might encounter when pushing images to ECR:

Issue Discussion is here: https://github.com/aws/aws-cdk/issues/31548

These are the steps I took to fix the issue below

400 Bad Request Errors - Manifest Issues:

  fail: docker push xyz.dkr.ecr.*.amazonaws.com/cdk-hnb659fds-container-assets-… exited with error code 1: failed commit on ref "manifest-sha256:" … : unexpected status from PUT request to https://xyz.dkr.ecr.*.amazonaws.com/v2/cdk-hnb659fds-container-assets.../manifests/: 400 Bad Request. Failed to publish asset

Lambda Stabilization Failures - InvalidImage:

  Resource handler returned message: "Lambda function ... reached terminal FAILED state due to InvalidImage(ImageLayerFailure: UnsupportedImageLayerDetected - Layer Digest sha256:...) and failed to stabilize" (RequestToken: ..., HandlerErrorCode: NotStabilized)

Fixing ECR Push Errors

1. Enable Docker BuildKit

Set the DOCKER_BUILDKIT environment variable to enable BuildKit

export DOCKER_BUILDKIT=1
export BUILDKIT_PROGRESS=plain

Add these variables to your shell configuration file (e.g., ~/.bashrc, ~/.zshrc, or ~/.profile) to persist the setting.

Alternatively, use `docker buildx` instead of `docker build` for extended BuildKit capabilities

To setup Docker build as a pass-through to Docker Buildx:
First make sure that you have Docker Buildx installed docker buildx version. It's included by default in new versions of Docker Desktop and in Docker Engine.

alias 'docker build'='docker buildx build'

Note: to delete alias unalias 'docker build'

Add this alias to your shell configuration file (e.g., ~/.bashrc, ~/.zshrc, or ~/.profile) to persist the setting.

2. Clean Up ECR Repositories

Prune Local Docker Images: Remove unused local Docker images with:

  docker system prune --all

Delete Empty Images: Locate and remove images with 0-byte layers from the ECR registry using the AWS Management Console or AWS CLI.

Delete empty images via AWS CLI Script

is_command_present() {
    type "$1" >/dev/null 2>&1
}

install_jq() {
    printf "\n${YELLOW}PACKAGE CHECK:${NC}Ensuring that you are up to date on the following package: ${RED}jq${NC}\n"

    printf "\n${GREEN}Checking for jq installation.${NC}\n"

    # Check for jq installation
    if is_command_present "jq"; then
        echo "jq is already installed."
    else
        brew install jq
    fi
}

install_jq

#==============================
repositories=$(aws ecr describe-repositories --region $AWS_DEFAULT_REGION --query 'repositories[*].repositoryName' --output text)

for repo in $repositories; do
    echo "\nProcessing repository: $repo"

    # Get the list of image digests in the repository
    image_ids=$(aws ecr list-images --repository-name $repo --region $AWS_DEFAULT_REGION --query 'imageIds[*]' --output json)

    echo $image_ids | jq -c '.[]' | while read -r image; do
        digest=$(echo $image | jq -r '.imageDigest')

        # Get the image details
        image_details=$(aws ecr describe-images --repository-name $repo --image-ids imageDigest=$digest --region $AWS_DEFAULT_REGION)
        #echo "image_details for $tags:\n $image_details"

        # Get all tags for this image
        tags=$(echo $image_details | jq -r '.imageDetails[0].imageTags[]' 2>/dev/null | tr '\n' ',' | sed 's/,$//')

        image_size=$(echo $image_details | jq '.imageDetails[0].imageSizeInBytes')

        echo "\nImage digest: $digest\nRepository name: $repo \nImage tags: $tags"
        # Check if the image size is 0 bytes
        if [ "$image_size" = "0" ]; then
            echo "Image is empty, deleting image with digest $digest"
            aws ecr batch-delete-image --repository-name $repo --image-ids imageDigest=$digest --region $AWS_DEFAULT_REGION

            # Run the AWS ECR delete command
            output=$(aws ecr batch-delete-image --repository-name $repo --image-ids imageDigest=$digest --region $AWS_DEFAULT_REGION)

            # Check for failures or success
            echo "$output" | jq '
            if .failures | length > 0 then
                "Deletion Failure: \(.failures[0].failureReason)"
            else
                "Success: Image deleted"
            end'
        else
            echo "Image Size: $image_size bytes\nImage not empty [image not deleted]"
        fi
    done
done

3. Create a New ECR Repository Tag for Your ECR Container Docker Image

For Lambda DockerImageFunction, AWS CDK automatically manages image tagging and pushing to Amazon ECR. The image is tagged with a hash based on its content, ensuring that changes result in a new tag.

Options to Force a New Tag in the ECR Registry

Use one of these approaches to force a new tag, repeat this step if you continue to encounter issues with stale or problematic images:

Update the Docker Build Context - IE. Modifying the Lambda Handler Source Code

Modifying files in the Docker build context (many any change to the source code) will trigger a new content-based hash and a new image tag.
Update the Dockerfile

Modifying the Dockerfile (e.g., adding or changing COPY or ENV instructions) will generate a new content hash and tag.
Change the Logical ID of the DockerImageFunction in Your CDK Stack

Renaming the logical ID in the CDK stack forces the creation of a new resource, triggering a new image tag even without content changes.

Example: Changing the Logical ID of a Lambda `DockerImageFunction`

// Old function ID
const prepareDataFn = new cdk.aws_lambda.DockerImageFunction(
  this,
  "PrepareDataLambdaV1Fn",
  {
    code: cdk.aws_lambda.DockerImageCode.fromImageAsset(
      path.join(__dirname, "path-to-docker-build-context")
    ),
  }
);

// New function ID
const prepareDataFn = new cdk.aws_lambda.DockerImageFunction(
  this,
  "PrepareDataLambdaV2Fn",
  {
    code: cdk.aws_lambda.DockerImageCode.fromImageAsset(
      path.join(__dirname, "path-to-docker-build-context")
    ),
  }
);

Example - Command-Line Docker tagging

Provide a new name for the docker tag.
Note: for the cli you tag the image after you build it

docker tag my_image_name:<this_is_my_image_name_tag_here> 241533140213.dkr.ecr.us-east-1.amazonaws.com/cdk-hnb659fds-container-assets-241533140213-us-east-1:<this_is_my_image_name_tag_here>

4. Disable Metadata Attestations

Docker Metadata Attestations Documentation
Avoid potential registry configuration issues by disabling provenance and Software Bill of Materials (SBOM) generation:

Option 1: Use the `BUILDX_NO_DEFAULT_ATTESTATIONS` Environment Variable

export BUILDX_NO_DEFAULT_ATTESTATIONS=1

Option 2: Pass build arguments during the Docker build process to avoid metadata issues during image push

Set sbom to false.
Set the provenance build argument to false.

Example Command-Line Build

DOCKER_BUILDKIT=1 docker build -t my_image_name --provenance=false --sbom=false .

Modify Lambda Function Build Settings in CDK to remove metadata

If using AWS CDK for Lambda deployments, include the provenance and sbom arguments in the buildArgs for your DockerImageFunction.

import * as path from "path";
import * as cdk from "aws-cdk-lib";

const prepareDataFn = new cdk.aws_lambda.DockerImageFunction(
  this,
  "PrepareDataLambdaV1Fn",
  {
    code: cdk.aws_lambda.DockerImageCode.fromImageAsset(
      path.join("../../", "etl/prepare_data"),
      {
        platform: cdk.aws_ecr_assets.Platform.LINUX_ARM64,
        file: "Dockerfile",
        buildArgs: {
          provenance: "false",
          sbom: "false",
        },
      }
    ),
    architecture: cdk.aws_lambda.Architecture.ARM_64,
    description: `Prepare/Clean data - [${cdk.Stack.of(this).stackName}]`,
    timeout: cdk.Duration.minutes(15),
    memorySize: 1024,
  }
);

Automating the Deployment

Automate your deployment process using a package.json configuration to:

Automatically log into ECR
Automatically set DOCKER_BUILDKIT=1

`package.json configuration`

Note: Example package.json [Works on mac/linux, uses sh]:

{
  "scripts": {
    "predeploy": "aws ecr get-login-password | docker login --username AWS --password-stdin $(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com",
    "deploy": "DOCKER_BUILDKIT=1 sh -c 'cd my_cdk_stacks && npm run cdk deploy -- -c stack_name=\"${STACK_NAME:-}\" --all --require-approval never'",
    "destroy": "npm run cdk destroy -- -c stack_name=\"${STACK_NAME:-}\" --all"
  }
}

CDK Deployment Command:

BUILDKIT_PROGRESS=plain CDK_VPC_ID=vpc-09f66ffff5d2773de STACK_NAME=MoyaTestStack npm run deploy

Example Shell Script for Building and Pushing Docker Images to ECR

# Set variables
IMAGE_NAME="moya_test_image"
TAG="moya_test_image_tag"

REGION=$(aws configure get region --profile "${AWS_PROFILE}")
ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)

REPOSITORY_NAME="cdk-hnb659fds-container-assets-${ACCOUNT_ID}-${REGION}"

REGISTRY="${ACCOUNT_ID}.dkr.ecr.${REGION}.amazonaws.com"
FULL_IMAGE_NAME="${REGISTRY}/${REPOSITORY_NAME}:${TAG}"

echo "${FULL_IMAGE_NAME}"

# Build, tag, and push the Docker image

echo "Building Docker image ${IMAGE_NAME}..."

#ECR Issue Discussion - https://github.com/aws/aws-cdk/issues/31549
docker build -t "${IMAGE_NAME}" --provenance=false .

echo "Tagging image as ${FULL_IMAGE_NAME}..."
docker tag "${IMAGE_NAME}" "${FULL_IMAGE_NAME}"

# Login to ECR
echo "Logging into Amazon ECR..."
aws ecr get-login-password | docker login --username AWS --password-stdin $(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.${REGION}.amazonaws.com

echo "Checking if repository ${REPOSITORY_NAME} exists in ECR..."

# Use aws CLI to check if the repository exists
if aws ecr describe-repositories \
    --repository-names "${REPOSITORY_NAME}" \
    --region "${REGION}" \
    --profile "${AWS_PROFILE}" > /dev/null 2>&1; then
    echo "Repository ${REPOSITORY_NAME} already exists."
else
    echo "Repository ${REPOSITORY_NAME} does not exist in ECR."
fi

echo "Pushing image to ECR..."
docker push "${FULL_IMAGE_NAME}"

Example Code

package.json

{
  "name": "project-root",
  "version": "0.0.1",
  "scripts": {
    "deploy": "DOCKER_BUILDKIT=1 sh -c 'cd my_cdk_stacks && npm run cdk deploy -- -c stack_name=\"${STACK_NAME:-}\" --all --require-approval never'",
    "predeploy": "aws ecr get-login-password | docker login --username AWS --password-stdin $(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com",
    "destroy": "cd my_cdk_stacks && npm run cdk destroy -- -c stack_name=\"${STACK_NAME:-}\" --all",
    "predeploy.moya.test": "aws ecr get-login-password | docker login --username AWS --password-stdin $(aws sts get-caller-identity --query 'Account' --output text).dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com",
    "deploy.moya.test": "DOCKER_BUILDKIT=1 sh -c 'echo \"moyas--$DOCKER_BUILDKIT\" && cd my_cdk_stacks && npm install && cdk deploy --all --require-approval never --app \"npx ts-node src/moya-test-stack.ts\" --context \"stack_name=${STACK_NAME}\"'",
    "destroy.moya.test": "cd my_cdk_stacks && npx cdk destroy --app \"npx ts-node src/moya-test-stack.ts\" -c stack_name=\"${STACK_NAME:-}\" --all"
  }
}

NPM build Command

CDK_VPC_ID=vpc-09f66ffff5d2793de STACK_NAME=MoyaTestStack npm run deploy.moya.test

DockerFile

directory: etl/prepare_data/DockerFile

FROM public.ecr.aws/lambda/python:3.12

# Set the working directory inside the container to Lambda's task root
WORKDIR ${LAMBDA_TASK_ROOT}

# Copy requirements.txt first to leverage Docker's layer caching
COPY requirements.txt .

# Install the specified packages into the Lambda task root
RUN pip3 install --target "${LAMBDA_TASK_ROOT}" -r requirements.txt --no-cache-dir

# Copy the rest of the application code to the Lambda task root
COPY . .

# Set the CMD to the Lambda handler
CMD [ "index.lambda_handler" ]

moya-test-stack.ts

import * as path from "path";
import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import { AwsSolutionsChecks } from "cdk-nag";
import { NagSuppressions } from "cdk-nag/lib/nag-suppressions";

import * as dotenv from "dotenv";
// Load environment variables from a .env file
dotenv.config();

export interface MoyaTestStackProps extends cdk.StackProps {
  vpc?: cdk.aws_ec2.IVpc;
}

export class MoyaTestStack extends cdk.Stack {
  props: MoyaTestStackProps;

  constructor(scope: Construct, id: string, props: MoyaTestStackProps) {
    super(scope, id, props);
    this.props = props;

    const vpc = props?.vpc ?? this.retrieveVpc();

    const backendPythonProjectRoot = path.join(
      __dirname,
      "../../backend/python"
    );

    const prepareDataFn = new cdk.aws_lambda.DockerImageFunction(
      this,
      "PrepareMoyaDataLambdV3FnV1",
      {
        code: cdk.aws_lambda.DockerImageCode.fromImageAsset(
          path.join(backendPythonProjectRoot, "etl/prepare_data"),
          {
            platform: cdk.aws_ecr_assets.Platform.LINUX_ARM64,
            file: "Dockerfile",
            cmd: ["index.lambda_handler"],
            buildArgs: {
              // Issue Discussion: https://github.com/aws/aws-cdk/issues/31548
              // Fix for ECR push error - [Failed to push image: failed commit on ref, unexpected status from PUT request, 400 Bad Request]
              provenance: "false",
              sbom: "false",
            },
          }
        ),

        architecture: cdk.aws_lambda.Architecture.ARM_64,
        description: `Prepare/Clean data - [${cdk.Stack.of(this).stackName}]`,
        timeout: cdk.Duration.minutes(15),
        memorySize: 1024,
        vpc: vpc,
        vpcSubnets: vpc.selectSubnets({
          subnetType: cdk.aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
        }),
      }
    );

    this.suppressNags();
  }
  /**
   * Retrieves the VPC (Virtual Private Cloud) based on the provided VPC ID.
   * Throws an error if the VPC ID is not provided via the environment variable CDK_VPC_ID.
   *
   * @returns {cdk.aws_ec2.IVpc} The VPC object retrieved from AWS CDK.
   * @throws {Error} Throws an error if CDK_VPC_ID environment variable is not set.
   */
  retrieveVpc() {
    const stack = cdk.Stack.of(this);
    const env = stack.node.tryGetContext("env");
    const vpcId = process.env.CDK_VPC_ID || env?.vpcId;

    if (!vpcId) {
      throw new Error("CDK_VPC_ID environment variable not set");
    }

    const vpc = cdk.aws_ec2.Vpc.fromLookup(this, "Vpc", {
      vpcId: vpcId,
    });

    return vpc;
  }
  private suppressNags(): void {
    const stack = cdk.Stack.of(this);

    // Suppressions for AWS CDK Nag tool
    NagSuppressions.addStackSuppressions(
      stack,
      [
        {
          id: "AwsSolutions-IAM4",
          reason: "AWS managed policies are permitted for demo purposes",
          appliesTo: [
            // Specify the AWS managed policies allowed in this CDK stack.
            // These policies must be specific and non-overly permissive.
            // For example, avoid policies like AmazonS3FullAccess, AmazonSageMakerFullAccess.
            "Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
            "Policy::arn:<AWS::Partition>:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
          ],
        },
      ],
      true
    );
  }
}

//-----------------------------
// CDK deploy
//-----------------------------

const app = new cdk.App();
const stackName = app.node.tryGetContext("stack_name") || "MoyaTestStack";
const account =
  app.node.tryGetContext("account") ||
  process.env.CDK_DEPLOY_ACCOUNT ||
  process.env.CDK_DEFAULT_ACCOUNT;
const region =
  app.node.tryGetContext("region") ||
  process.env.CDK_DEPLOY_REGION ||
  process.env.CDK_DEFAULT_REGION;

const moyaTestStack = new MoyaTestStack(app, stackName, {
  env: {
    account: account,
    region: region,
  },
});

cdk.Aspects.of(app).add(
  new AwsSolutionsChecks({ logIgnores: true, verbose: true })
);
app.synth();

The dreaded AWS error : Cannot find version xx.x for postgres

Moya Richards — Thu, 17 Mar 2022 02:52:10 +0000

When creating an AWS stack containing a postgres database table, you might received this error:

Error

Cannot find version 12.3 for postgres (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterCombination

Cannot find upgrade path from 14.2 to 12.3. (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterCombination

Erroneous code

const engine = DatabaseInstanceEngine.postgres({ version: PostgresEngineVersion.VER_12_3 });

Now this error code : InvalidParameterCombination, and the the message: Cannot find version 12.3 for postgres is not very explicit and doesn't explain what the real issue is.

What the error really means is that version 12.3 for postgres is depreciated and any reference to that version, or any version you are having an issue with, should be removed from your code and replaced with a supported version.

The real issue

AWS requires that you specify the version number for the database when it is being created. However, AWS doesn't keep all versions of that database around indefinitely.

AWS depreciates certain versions, so at some point in the future you will have to change the code to use a supported version of that database.

How to fix the error?

Specify a supported version of the database

Fixed code: version 1

| Simple code|

const engine = DatabaseInstanceEngine.postgres({ version: PostgresEngineVersion.VER_14_2 });

Fixed code: version 2

Use version 2 of the fix, if you don't like to hardcore values in your code that are expected to change.

| Superior code fix|


/**
* Store values in environment variables
* @see https://www.npmjs.com/package/dotenv
*/
const postgresFullVersion = process.env.POSTGRESFULLVERSION ?? "14.2";
const postgresMajorVersion = process.env.POSTGRESMAJORVERSION ?? "14";

/**
* Generate the postgres engine version from the values in the environment variable
*/

const engine = DatabaseInstanceEngine.postgres({
    version: PostgresEngineVersion.of(
      postgresFullVersion,
      postgresMajorVersion,
    ),
  });

How to know which versions of the database is Depreciated and supported

Visit the AWS website

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_PostgreSQL.html


Image: Depreciated 12.x versions of postgres

or Run the AWS CLI code below

After running the command, scroll all the way to the end of the list to see the most recent version of the database supported by AWS

aws rds describe-db-engine-versions --engine postgres --output table


Image: AWS CLI view of current version of postgres

AWS stack creation code (contains error)

import { Stack, StackProps, CfnOutput } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Vpc, InstanceType, InstanceSize, InstanceClass } from 'aws-cdk-lib/aws-ec2';
import { DatabaseInstance, DatabaseInstanceEngine, PostgresEngineVersion } from 'aws-cdk-lib/aws-rds';


class CdkRdsStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const vpc = new Vpc(this, 'TestVpc', {
      cidr: '10.192.0.0/16',
      maxAzs: 2,
      natGateways: 1,
      enableDnsHostnames: true,
      enableDnsSupport: true
    });

    //Erroneous Line 
    //--------------------------
    const engine = DatabaseInstanceEngine.postgres({ version: PostgresEngineVersion.VER_12_3 });
    //--------------------------

    const dbInstance = new DatabaseInstance(this, 'Test_Postgres_CDK', {
      engine,
      vpc,
      iamAuthentication: true,
      instanceType: InstanceType.of(
        InstanceClass.BURSTABLE3,
        InstanceSize.MICRO
      ),
      databaseName: 'test_postgres'
    });

    new CfnOutput(this, 'dbEndpoint', {
      value: dbInstance.instanceEndpoint.hostname,
    });
  }
}

AWS stack creation code (fixed code)

import { Stack, StackProps, CfnOutput } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { Vpc, InstanceType, InstanceSize, InstanceClass } from 'aws-cdk-lib/aws-ec2';
import { DatabaseInstance, DatabaseInstanceEngine, PostgresEngineVersion } from 'aws-cdk-lib/aws-rds';


class CdkRdsStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    const vpc = new Vpc(this, 'TestVpc', {
      cidr: '10.192.0.0/16',
      maxAzs: 2,
      natGateways: 1,
      enableDnsHostnames: true,
      enableDnsSupport: true
    });

    //--- Erroneous Line 
    //const engine = DatabaseInstanceEngine.postgres({ version: PostgresEngineVersion.VER_12_3 });


    //simple fix : version 1
    //const engine = DatabaseInstanceEngine.postgres({ version: PostgresEngineVersion.VER_14_2 });

    //--------------------------
    //--- start : superior code fix , version 2
    const postgresFullVersion = process.env.POSTGRESMAJORVERSION ?? "14.2";
    const postgresMajorVersion = process.env.POSTGRESENGINEVERSION ?? "14";


    const engine = DatabaseInstanceEngine.postgres({
        version: PostgresEngineVersion.of(
          postgresFullVersion,
          postgresMajorVersion,
        ),
      });
    //--- end : superior code fix
    //--------------------------
    const dbInstance = new DatabaseInstance(this, 'Test_Postgres_CDK', {
      engine,
      allowMajorVersionUpgrade: true,
      vpc,
      iamAuthentication: true,
      instanceType: InstanceType.of(
        InstanceClass.BURSTABLE3,
        InstanceSize.MICRO
      ),
      databaseName: 'test_postgres'
    });

    new CfnOutput(this, 'dbEndpoint', {
      value: dbInstance.instanceEndpoint.hostname,
    });
  }
}

Zsh - install git plugin and theme

Moya Richards — Thu, 18 Nov 2021 16:31:43 +0000


Want your terminal to display information about GIT? If the answer is `YES`, let's get to it.

Check if Zsh is installed

Every new Mac uses the Z shell (Zsh) by default, but if it is not available to your system install it using Homebrew.



echo $SHELL

Expected result of the echo $SHELL command : /bin/zsh

Install zsh using Homebrew(if it is not installed):



brew install zsh

# Set zsh as your default shell
chsh -s $(which zsh)

Install Oh My Zsh

Open terminal, run the command



sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

Modify your Oh My Zsh settings

The configuration file for zsh is called .zshrc and lives in your home folder (~/.zshrc).

locate that file and open it



open ~/.zshrc

Modify your Plugins

Add plugins to your shell by adding the name of the plugin to the plugin array in the ~/.zshrc file. Separate the names of plugins with a space



plugins=(git)

Change your Theme

Changing theme is as simple as changing a string in your configuration file. The default theme is robbyrussell. Just change that value to the change theme, and don't forget to .



ZSH_THEME=pygmalion

Apply your changes

To apply the changes you have made to the theme or plugins you need to either

start a new shell instance
reload the configuration for the current shell



#reload configuration
source ~/.zshrc

Install fonts:

You must select a font in the Terminal Preferences, under Profiles, for your zsh theme to display properly

Most Zsh themes use the powerline fonts, so let's install them.

** Install powerline fonts **



# clone
git clone https://github.com/powerline/fonts.git --depth=1
# install
cd fonts
./install.sh
# clean-up a bit
cd ..
rm -rf fonts

Change Font in the Mac OS X Terminal


Image of Terminal without font

Open Terminal, then navigate to Terminal Preferences > Profiles > Font , then click the Change button.
Select Ubuntu Mono derivative Powerline and set the font size to your liking.
Close preferences, and quit Terminal.


Expected Result: Image of Terminal with font

Change Font for Terminal in Visual Studio Code?


Image of Terminal in Visual Studio Code without font

Open settings.json in VSCode

Press command + shift + p in your VSCode window. Then, search for settings.json and open it.

Add this line to the settings.json :



{
  "terminal.integrated.defaultProfile.osx": "zsh",
  "terminal.integrated.fontFamily": "Ubuntu Mono derivative Powerline",
  "terminal.integrated.fontSize": 12
}


Image of Terminal in Visual Studio Code with font

How to find the storage location of Docker images and containers on a mac

Moya Richards — Wed, 17 Mar 2021 00:20:49 +0000

Finding the location of docker images is a chore on a mac. Usually on most systems, you can see where the images and containers are located by running the command docker info but no, that does not work on a mac. You see that command will tell you that the root directory is located at /var/lib/docker , which on a mac is a non-existent directory.

There are two primary ways to get to this directory. Try option 1 first, if it does not work try option 2

Here is a little background information on the docker directory

On a mac our docker files are located inside of a virtual machine which is located in our user library directory: ~/Library/Containers/com.docker.docker/

This directory is easy to get to from the terminal, but if you try to get there via the finder you might notice that com.docker.docker does not appear visually under that directory name. When you navigate to ~/Library/Containers you will see the folder name Docker instead. Take note, that is the com.docker.docker directory

Now to get to the root directory /var/lib/docker we must access the docker virtual machine being used on our mac.

Option 1

Use the terminal application screen.



screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty

You should see a screen, where you can enter the command



cd /var/lib/docker

Option 2

Now if you are unlucky and you get a permission denied error, you will need to try to access the docker virtual machine through a docker image:

To get around this error, we will install a debian docker image, run it, then enter the container with the nsenter tool



docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh

This will open the debian image and allow us to browse around the docker files via the sh shell

Now that the shell is available. let's type the command



cd /var/lib/docker

If the default storage driver overlay2 was used, then your Docker images are stored in the directory /var/lib/docker/overlay2

To get a detailed explanation of the docker run flags, type docker run --help command in the terminal.

Sources

Learn more about nsenter linux tool on the redhat linux website.

Getting path and accessing persistent volumes in Docker for Mac by Tim Kamanin

Github : docker can't access volume with screen
docker

Simplifying: Stacks and Queues

Moya Richards — Tue, 09 Jun 2020 22:36:03 +0000

Stacks and queues: this is how I remember them:

Stacks: I picture something vertical: a pile of plates,a bottle.

Queues: I picture something horizontal: a pipe, a line (I join first, I get served first).

Stacks - LIFO:  you can only add(append, push) and remove(pop) from the back(top,end).
Queues - FIFO : add (enqueue,append) to the back(rear), only remove(dequeue,popleft) from the front .

LIFO : Last in, first out.
FIFO : first in, first out.

If you are JavaScript developer, you are unconsciously working with stacks and queues everyday:

You use stacks every time you run your code: "function call stack".
You use queues every time you run asynchronous code: "The event queue" of the event loop.

Here are some examples of stacks and queues in the real world:

Stack:

Your favorite text editor: undo/redo feature.
Backtracking: your browsers "back" button.
Reverse : try to reverse your name.

Queue:

Order processing: you stand 6 feet apart from everyone as you wait in line to place your order with a cashier.
Message processing: your long SMS messages are stored in a queue( messages are sent in the order they are received). Test this feature out on twitter by exceeding your 143 character limit

Now, how have you used stacks and queues consciously in your career?

Let's talk about your usage of these data structures or concepts in your projects.

I coded a Java paint application to draw shapes on a canvas : https://github.com/moyarich/JPaint.
I used the open source bull queue manager in my project to control the pace at which I send data to a API. Each subsequent item is sent to the API, after it connects to my webhook url. I wrote this custom function(https://gist.github.com/moyarich/4d6735b8d417c5e2f7e5f03469d32fb7)to get bull queue to manually process only one job in the queue on demand.

What style have you picked up from another developer that you are still using?

Moya Richards — Thu, 16 Apr 2020 19:06:02 +0000

Good coding style is like correct punctuation: you can manage without it, butitsuremakesthingseasiertoread. – The Tidyverse Style Guide by Hadley Wickham

What style have you picked up from another developer that you are still using?

I picked up a style for renaming a thing that I want to archive such as a file, a folder, a database file, etc.

This pattern is zxYYYYMMDD_name

it starts with zx so that when I order the list alphabetically it will always appear at the bottom.

Yes, I have been brainwashed, so now everything I manually archive starts off that way.

For example, I have an Oracle MySQL database called example_db that I want to make major changes. Before I mess with it I copy it, then label the copy.

zx20200416_example_db

Chances are that if you have ever asked me to help you with code and I have had to touch your files, you have seen me do this.

And another thing: how often do you randomly read style guides on the internet to improve the quality of your code?

Here are some fun ones:
Google JavaScript Style Guide: https://google.github.io/styleguide/jsguide.html#file-name

Sql Style Guide : https://www.sqlstyle.guide/

#codingstorytime

How to connect Node.js to IBM DB2 database - Linux

Moya Richards — Tue, 25 Feb 2020 18:26:52 +0000

Operation system: Centos OS

Install ODBC driver on Linux

Install instructions taken from here: https://github.com/IBM/ibmi-oss-examples/blob/master/odbc/odbc.md

To get the driver, visit the IBM i Access - Client Solutions page and select Downloads for IBM i Access Client Solutions. After logging in and redirected to the IBM I Access Client Solutions Download page, select the Download using http tab then scroll down and download the ACS Linux App Pkg.

In this package, there is a README that will help explain how to install the driver with either with RPMs or DEBs, depending on your Linux distribution. Just know that when you install the driver, it should pull in all of the packages you need to create an ODBC connection to Db2 for i from your Linux system.

Install unixODBC package to access databases

To get ODBC working we need to install the unixODBC package

The unixODBC package can be used to access databases through the ODBC
drivers.

Install unixODBC-devel rpm package:

# yum install unixODBC-devel

To verify whether unixODBC is installed, execute the following commands:

# which odbcinst
# which isql

configure odbcinst.ini

Verify the driver data stored in odbcinst.ini

file location: /etc/odbcinst.ini
The location of this file can also be found by running

# odbcinst -j

The odbcinst.ini file maps all of the files needed for the driver to operate properly. The odbcinst.ini usually looks like this. If your copy is missing information about IBM go ahead and add it

odbcinst.ini

[PostgreSQL]
Description=ODBC for PostgreSQL
Driver=/usr/lib/psqlodbcw.so
Setup=/usr/lib/libodbcpsqlS.so
Driver64=/usr/lib64/psqlodbcw.so
Setup64=/usr/lib64/libodbcpsqlS.so
FileUsage=1

[MySQL]
Description=ODBC for MySQL
Driver=/usr/lib/libmyodbc5.so
Setup=/usr/lib/libodbcmyS.so
Driver64=/usr/lib64/libmyodbc5.so
Setup64=/usr/lib64/libodbcmyS.so
FileUsage=1

[IBM i Access ODBC Driver]
Description=IBM i Access for Linux ODBC Driver
Driver=/opt/ibm/iaccess/lib/libcwbodbc.so
Setup=/opt/ibm/iaccess/lib/libcwbodbcs.so
Driver64=/opt/ibm/iaccess/lib64/libcwbodbc.so
Setup64=/opt/ibm/iaccess/lib64/libcwbodbcs.so
Threading=0
DontDLClose=1
UsageCount=1

[IBM i Access ODBC Driver 64-bit]
Description=IBM i Access for Linux 64-bit ODBC Driver
Driver=/opt/ibm/iaccess/lib64/libcwbodbc.so
Setup=/opt/ibm/iaccess/lib64/libcwbodbcs.so
Threading=0
DontDLClose=1
UsageCount=1

Configure odbc.ini

create ODBC.ini

File location for the SYSTEM DATA SOURCES:
*/etc/odbc.ini *

The name of the DSN should be placed within the [] brackets
The name of the driver specified in the Driver keyword must match the name of a driver defined in the odbcinst.ini.

vi /etc/odbc.ini

Copy and paste details below
press the "Esc" key, then type ":wq"

ODBC.ini

[usrProd]
Description            = IBM i Access for Linux ODBC data source
Driver                 = IBM i Access ODBC Driver
System                 = 192.168.1.225
Naming                 = 0
DefaultLibraries       = usrsadbtst
TrueAutoCommit         = 1
UserID                 = username1
Password               = password1

Test the database connection

Create node application

mkdir -p /var/www/node-apps/obdc_test
cd /var/www/node-apps/obdc_test
npm init -y

Install node ODBC package

npm install odbc


vi /var/www/node-apps/obdc_test/app.js

copy and paste details below
press the "Esc" key, then type ":wq"

const odbc = require("odbc");

const cn = "DSN=usrProd;UID=username1;PWD=password1";

odbc.connect(cn, (error, connection) => {
  connection.query(
    "SELECT * FROM QIWS.QCUSTCDT FETCH FIRST 6 ROWS ONLY",
    (error, result) => {
      if (error) {
        throw error;
      }
      console.log(result);
    }
  );
});

Run node application:

node /var/www/node-apps/obdc_test/app.js

If installing SSL certificate on an Nginx webserver - don't forget this step

Moya Richards — Mon, 24 Feb 2020 17:15:12 +0000

STUPID BROWSERS ...
I spent way too long troubleshooting an SSL certificate error.
My issue, PostMan would not work, but the URL worked when I visited it using a browser.
Imagine troubleshooting something where there are no useful error messages.

Ok, so how did I fix the problem?

Well, I figured out that I missed a step when I installed the SSL certificate on Nginx. I didn't concatenate the SSL certificate with the intermediate certificate bundle.

I received no useful error messages from the browsers because they have their own certificate bundles. If your server does not provide one, the browser will default to using its own.

How did I find my error, well I had the smart idea to run the URL through an SSL checker. I found the digicert SSL checker, and you know what it told me?

Intermediate certificate missing.

The SSL checker at sslshopper.com, gave me this scary message:

The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate. Learn more about this error. You can fix this by following DigiCert's Certificate Installation Instructions for your server platform. Pay attention to the parts about Intermediate certificates.

Why didn't the browser say that? jeez.

The quickest fix on the planet for fixing something that took me a while to troubleshoot

cat ssl_certificate.crt IntermediateCA.crt >> certbundle.pem

--------- POSTMAN error--------------------------------
Could not get any response
There was an error connecting

Why this might have happened:

The server couldn't send a response: Ensure that the backend is working properly
Self-signed SSL certificates are being blocked: Fix this by turning off 'SSL certificate verification' in Settings > General
Proxy configured incorrectly: Ensure that proxy is configured correctly in Settings > Proxy
Request timeout: Change request timeout in Settings > General

Don't do this in your Nginx virtual hosts file:

server {
ssl_certificate /etc/ssl/ssl_certificate.crt;
}

Do this instead:

Step 1: locate your SSL Certificate and bundle file

For example: ssl_certificate.crt, IntermediateCA.crt

Step 2: You need to combine the Server certificate (ssl_certificate.crt) file and the Intermediate CA Certificate (intermediateCA.crt) into a single concatenated file

To get a single concatenated file out of the Intermediate CA and the SSL Certificate run the following command:

cat ssl_certificate.crt IntermediateCA.crt >> certbundle.pem

Step 2: Now edit the Nginx virtual hosts file by adding the line below:

ssl_certificate /etc/ssl/certbundle.pem;

Basic Sample of an Nginx virtual hosts file

server {
  listen 443;

  ssl on;
  ssl_certificate /etc/ssl/[concatenated file];
  ssl_certificate_key /etc/ssl/[private key file];

  server_name your.domain.com;
  access_log /var/log/nginx/nginx.vhost.access.log;
  error_log /var/log/nginx/nginx.vhost.error.log;
  location / {
    root /home/www/public_html/your.domain.com/public/;
    index index.html;
  }
}

DEV Community: Moya Richards

Automate Post-Deployment Tasks with `cdkTrigger` in AWS CDK

🔧 What is cdk.triggers.Trigger?

🧪 Example: Run a Lambda After Resources Are Created

Step 1: Import Required Modules

Step 2: Define the Stack

🔁 How It Works

🛠 Notes & Best Practices

🧹 Optional: Clean Up After Execution

✅ Summary

📁 Example Directory Structure

🧪 Want to Try It?

Fixing Lambda to Aurora PostgreSQL Connection Timeout Issues in AWS

Fixing Lambda to Aurora PostgreSQL Connection Timeout Issues in AWS

The Error

Common Causes

Step-by-Step Solution

1. VPC Setup

2. Add Required VPC Endpoints

3. Configure Security Groups

4. Lambda Function Configuration

5. Database Connection Code

Troubleshooting Checklist

Conclusion

Additional Resources

Resolving AWS Secrets Manager Access in AWS Lambda: A Tale of Two Regions

The Problem

The Root Cause

The Solution

create a vcp endpoint via AWS CLI

The Outcome

Lessons Learned

Fixing “exit code: 255” in AWS CodeBuild

🚀 CDK Docker Lambda Builds: Multi-Architecture to the Rescue

💥 The Problem

🛠️ The Solution

✅ Step 1: Use BUILDPLATFORM in Your Dockerfile

✅ Step 2: Add a CDK Architecture Config Switcher

✅ Step 3: Use It in Your CDK Lambda Definition

✅ Step 4: Deploy with the Right Architecture

✅ Final Tips

.env

🧪 Conclusion

Resolving Amazon Elastic Container Registry (ECR) Push Errors

https://github.com/moyarich/how-to-resolve-amazon-ecr-push-issues

Common ECR Push Errors

Fixing ECR Push Errors

1. Enable Docker BuildKit

Set the DOCKER_BUILDKIT environment variable to enable BuildKit

Alternatively, use docker buildx instead of docker build for extended BuildKit capabilities

2. Clean Up ECR Repositories

Delete empty images via AWS CLI Script

3. Create a New ECR Repository Tag for Your ECR Container Docker Image

Options to Force a New Tag in the ECR Registry

Example: Changing the Logical ID of a Lambda DockerImageFunction

Example - Command-Line Docker tagging

4. Disable Metadata Attestations

Option 1: Use the BUILDX_NO_DEFAULT_ATTESTATIONS Environment Variable

Option 2: Pass build arguments during the Docker build process to avoid metadata issues during image push

Example Command-Line Build

Modify Lambda Function Build Settings in CDK to remove metadata

Automating the Deployment

package.json configuration

Example Shell Script for Building and Pushing Docker Images to ECR

Example Code

package.json

NPM build Command

DockerFile

moya-test-stack.ts

The dreaded AWS error : Cannot find version xx.x for postgres

Error

Erroneous code

The real issue

How to fix the error?

Fixed code: version 1

Fixed code: version 2

How to know which versions of the database is Depreciated and supported

AWS stack creation code (contains error)

AWS stack creation code (fixed code)

Zsh - install git plugin and theme

🔧 What is `cdk.triggers.Trigger`?

✅ Step 1: Use `BUILDPLATFORM` in Your Dockerfile

Alternatively, use `docker buildx` instead of `docker build` for extended BuildKit capabilities

Example: Changing the Logical ID of a Lambda `DockerImageFunction`

Option 1: Use the `BUILDX_NO_DEFAULT_ATTESTATIONS` Environment Variable

`package.json configuration`

Want your terminal to display information about GIT? If the answer is `YES`, let's get to it.