Recent content on Matt Bacchi
Lots of folks use the Claude IDE, or the Claude Code VSCode extension. Unfortunately, your prompts and completions are used (by default) to train Claude models. [0] 
 AWS Bedrock, on the other hand, doesn’t use your prompts and completions to train any AWS models or give them to 3rd parties. [1] 
 For these reasons (privacy, data sovereignty) I’m more inclined to use Bedrock as…
Firecracker is an open source virtualization technology created by Amazon Web Services (AWS) which underpins their AWS Lambda Functions as a Service (FaaS) serverless product. 
 Firecracker was open sourced in 2018 [0] , making it possible for anyone to use this extremely fast and reliable system for their own projects and use cases. 
 I’ve been researching the ecosystem lately and…
A short post discussing the installation of Nvidia Datacenter GPU Manager on Amazon Linux 2023. I recently had to figure this out using sketchy documentation, so I’m hoping this helps some folks out there doing similar head scratching.
 NOTE : This blog post does not include all steps to install Nvidia drivers. I assume you already have driver package(s) required for your application…
Terraform is a flexible, cloud agnostic infrastructure as code (IaC) tool. As it constructs infrastructure resources, it builds a ledger used to track resources that have successfully been created as well as additional metadata (such as id .) Terraform stores this state in a binary formatted file with the extension .tfstate . 
 What is the Terraform S3 Backend
 The Terraform state file…
As we bring 2024 to a close, and after an invigorating week at AWS re:Invent, many will be writing their year in review summaries. I’ve decided to dedicate those column inches to the state of serverless sustainability today. The observant among us are quite aware of how the artificial intelligence (AI) craze has wormed it’s way into every product, industry and conversation over the…
EC2 Image Builder Lifecycle Policies is a fairly new AWS feature that enables automatic cleanup of old EC2 Image Builder pipeline artifacts. If you haven’t used EC2 Image Builder, it’s quite handy for creating customized AWS Machine Images (AMIs) for your EC2 deployments. 
 This could be a really valuable tool that simplifies the AMI build process. But there are a number of…
There’s been a recent uptick in the number of S3 buckets that have become “hijacked” or “taken over”. 
 How can an attacker take over your S3 bucket? What can you do to prevent this on your buckets? 
 We’ll answer these questions and provide details on how you can neutralize the threat of S3 bucket takeovers. 
 What is Hijacking?
 How can your S3…
Imagine you have a security group that needs to allow all IP addresses of AWS EC2 instances. Or imagine you have to allow IP addresses of Github Actions runners so that only your CI workers connect to your VPC. Both of those IP address ranges change regularly, and need to be updated (usually by hand.) 
 If we want to automate these security group updates, how could you figure out when these IP…
A couple years ago I shared a
 post that detailed various
tech industry job search resources. There are a number of more modern sites
available today that have remote tech roles and the ability to filter the
results more effectively than places like LinkedIn. 
 Ventureloop
 Ventureloop is a job site that lists primarily venture capital startups who are
looking for…
Recently the Lambda Go runtime has changed from using the Go 1.x managed runtime
to using the provided
runtimes 
which have been historically used for custom runtimes (i.e. Rust.) The former
 go1.x runtime is being deprecated on January 8, 2024 (quite soon) and the new
runtimes provided.al2023 or provided.al2 are expected to be used. 
 With the introduction of these new…
You’ve probably heard of AWS Lambda and serverless by now. But what is Lambda
all about? The short definition of AWS Lambda is a “Functions as a Service”
(FaaS) technology. The longer and more complicated answer is that Lambda is a
lightweight runtime that requires no infrastructure to be defined by the
developer.
FaaS allows developers to build software…
Networking can sometimes be quite complicated. Despite the oft repeated joke
that “It’s always DNS”, sometimes your problem is even more difficult to
diagnose than DNS. 
 According to Wikipedia, Classless Inter-Domain Routing (or
 CIDR ) “is the
method for allocating IP addresses and for IP routing” on the internet and on
private networks. If…
Over the last few years I’ve provided information on how to approach a job
search to friends and coworkers. I typically send an email with this
information, but I think it’s useful to a broader audience, so I’ll provide it
here in a blog post. 
 This is certainly not meant to be an exhaustive discussion of every aspect of
job searching. There are many other…
This will be the first in a series of posts describing Tweets I’ve sent with the
hashtag #awswishlist. Tweets to this #awswishlist hashtag come from anyone who
uses AWS and is frustrated with the AWS user experience in some way. These
Tweets are often responded to by AWS Support staff on Twitter, indicating
they’ll be passing the feedback on to the team responsible for…
Recently I moved my personal blog from GitHub Pages to AWS Amplify. While it was
fairly easy to setup the Amplify project and CI/CD pieces, the DNS configuration
for Custom
Domains 
was less straightforward. The following observations are what I found to be less
than ideal while using Amplify for the first time. 
 AWS Amplify DNS instructions
 One problem that I found…
Discourse is used for a number of purposes, but their forum software is quite
popular. I’ve been looking at how to us the Discourse
API to automate creating posts. This blog post
describes how to setup a local Discourse instance and perform API calls against
it. 
 Setup Discourse Container
 This step is fairly straightforward thanks to Bitnami’s Discourse…
I’ve been attempting to learn more about Lambda@Edge and how to use functions at
the AWS edge locations, so I wrote up this demo. It isn’t performing a very
realistic operation, but it did allow me to understand the Lambda@Edge and
Cloudfront cache relationship (aka “event model”) and how to intercept CDN cache
requests and modify responses in a Lambda…
Security minded users often run Docker to create an additional sandbox around an
untrusted application running on their system. Web Browsers are among the most
untrusted applications we run today. Here’s how to setup the Brave Browser to
run in Docker. 
 To paraphrase T.S. Eliot, ‘good coders borrow and great coders steal.’ So I’ll
be borrowing from Jess…
Inlets is a fairly new project that
allows you to setup reverse proxy, websocket tunnels, or other endpoints to the
public internet, it is similar to ngrok . The video
overview from Alex Ellis shows how simple it
makes setting up the environment. 
 Also, there are scripts in the Inlets repository to provision DigitalOcean
droplets. Let’s setup an AWS EC2 instance,…
We have all become accustomed to services on the internet being reliable and
available approximately 100% of the time. Many services obviously have outages,
recently GitHub, Cloudflare, Twitter, Facebook have all had widespread service
disruptions. Some apps affect downstream processes and services that rely on
them. This is a story about how I found the official Python images on…
There are many examples available for how to return an error from an AWS Lambda
function through API Gateway to a client in Node.js, but relatively few for how
to do so using the Python runtime. Here we will try to give some basic info
using Python with a POST action. 
 Prereqs
 This assumes you already have an AWS account, have configured your AWS access
credentials or…
Git doesn’t have the concept of a per user global hook. It would be nice if you could create hooks in your home directory that could be executed in all repositories that you work with. Instead, it does allow you to write hooks that reside in a user specific template directory to then be copied into any repositories that you clone or create from scratch. 
 After following this guide to…
Working on AWS CodeCommit today, I setup SSH access to the repository. During
the initial configuration I provided the SSH public key in the AWS Console, but
then couldn’t connect to my repository. In the brief instructions on the IAM
Console page they tell you how to update your ~/.ssh/config file, but the
example doesn’t explicitly say what the IdentityFile is…
While writing a Python library 
that performs scanning of Git repositories similar to AWS Labs'
 git-secrets , I was surprised by some
3rd party scanning services randomly scanning my repository for AWS credentials.
I had included deactivated AWS credentials in my repository so that I could test
my library. My plan was to replace these credentials with a randomly…
While using AWS Lambda SAM
Local to test
Lambda functions locally, I encountered an error writing to the current
directory where the function was running in the container (/var/task/). I’m not
claiming a best practice of writing to the filesystem while running a Lambda
function, but that’s part of my learning process for the moment, and I will
investigate other…
Even if you’re not involved in the Python community, you might have heard about
 this security
incident 
a while back. This is a not uncommon scenario where developers who may not be
Github or distribution tooling (or security) experts make a mistake and breed
mistrust in their project as well as the distribution medium itself. 
 But setting up your environment to…
Here’s another ‘for posterity’ type post. 
 I forgot I had configured my WiFi router to ignore certain MAC addresses and
when I tried to put that machine on the Network today I had a rude awakening.
Using the asuswrt-merlin firmware on my RT-AC66U router, I had configured things
to allow 2 machines to be served DHCP from another PC so that I could run
Cobbler…
I’ve been trying to learn more about AWS Lambda, at the same time learning some
web development. For a newcomer to web application development, there is the
question of whether you work on leveling up with traditional server based apps
or “serverless”, aka FaaS, aka Lambda. I wanted to try converting a simple Flask
app to Lambda, this is how I did it. 
 What…
I spent a little time with Zappa today
which is an AWS Lambda (aka “serverless”) framework for Python. Its not hard to
create a very basic Flask application, then invoke Zappa to perform the many
manual steps of creating a Lambda function, resulting in a URL where your
application is running. 
 First, I verified I was using Python 3.6, then I created a Python…
Another common error is that the docker daemon cannot connect to the outside
world to download anything during build time. This can be corrected in a number
of ways, but I have done it thusly.
The error is commonly encountered as you are trying to build a docker image, the
warning "[Warning] IPv4 forwarding is disabled. Networking will not work." 
tells you that you need to…
I always forget this when trying to run docker as a non-root user, so documenting
it for posterity. 
 If you get an error connecting to the docker daemon as a standard user, such as: 
 
 
 1
 2
 
 
 [ mbacchi@centos7 ~ ] $ docker ps
 Cannot connect to the Docker daemon. Is the docker daemon running on this host?
 
 
 And you’re sure your…
I was interested in a job description a company posted via Twitter, but I
couldn’t view the text and didn’t understand why. This wasn’t the first time
this happened so decided to dig into the problem and determine if it was an
issue with my environment or the website.
My initial assumption was there was some problem with the company’s website. But
they…
Docker can be used to quickly create and serve many services, one such example
is serving RPMs via Yum in an ad hoc manner. Have you ever wanted to create a Yum
repository consisting of some RPMs very quickly to be used for testing
purposes? I did this week. I could have created the repo and installed a web
server on any machine. But what if we had the RPMs and the Yum…
After upgrading to Fedora 25 yesterday, Vagrant 1.8.5 in the updates repo was
unusable with VirtualBox for 2 reasons: 
 
 The newest centos/7 box didn’t use vbox guest additions for shared folders, forcing the use of NFS 
 Vagrant issue 8138 which is not fixed in the newest RPM from Vagrant means I had to install from source. 
 
 This required two workarounds in my…