Blog by Max Ivanov, Software Engineer / Cloud Architect. I write about Azure, AWS, Serverless, DevOps, fullstack TypeScript, peppered with thoughts on dev life.
Any decently sized Node.js project depends on multiple 3rd party NPM packages . In turn, each of those may have dependencies as well. Which leaves you with a ton of code that you didn't write, that you don't control and don't have much visibility over during package updates. It may take one compromised package in that dependency graph to steal secrets from your production environment. The package…
You may need to put your Lambda function into a VPC (Virtual Private Cloud) for the function to have access to the resources in the private network. Common use case is accessing an RDS instance not reachable from the Internet. Running Lambda in a VPC has some downsides: Networking limitations at scale. There are soft and hard limits to the number of ENIs (virtual network cards) shared by compute…
Imagine you're starting a new project. You want to leverage existing solutions and cloud infrastructure to move fast. Users should be able to create accounts in the application you're about to build, so you're thinking about a managed user directory . It has to be reliable, secure and scalable. Not something you can build yourself overnight! AWS Cognito is a great service that can help you push…
For a step by step guide on provisioning cloud resources needed to run Azure Functions, check Deploy Azure Functions with Terraform . This post focuses on how you can publish code to a function app with Terraform. Here, the deployed app is a hello-world Node.js function, but the process is language-agnostic. Using a package file is the recommended way to run Azure Functions. When new code is…
Github Actions is awesome and you can automate so much with it. One lacking feature though is support for code reuse in workflow yaml files. One particular use case where it would be useful is continuous deployment workflow that publishes latest code to the remote system. Deployment target is dictated by the git branch that receives the update. E.g. pushes to dev branch should deploy to the…
It may happen that you need to make a copy of an IAM role in AWS. Maybe you want to experiment with changing role's permission scope but you don't want to touch the role that is currently in use. One way to approach it is to duplicate the existing role along with all its policies , make the needed change on the new role and run your tests. There's no aws iam copy-role command though... So your…
In AWS Cognito, the default method of sending emails and SMS messages is AWS' own services: SES and SNS correspondingly. Usually it makes sense, you're already in the AWS ecosystem anyway... But what if you have a requirement to use a 3rd party ESP (Email Service Provider) , like Twilio Sendgrid or Mailgun/Sendinblue/Mailchimp? Some of the reasons could be: Designers need easy access to the email…
This is a post in the series on Node.js security best practices. Each post covers one security best practice in detail. Problem → Example attack → Solution → Implementation in Node.js → Implications Code for this post's vulnerable demo project . Today's topic is the HTTP Strict Transport Security (HSTS) policy. It's 2021 now, and serving websites and APIs over a secure (SSL/TLS) channel is the…
If you haven't touched your function app for a while there's a chance it's running an older version of Node.js. You may consider upgrading to benefit from new features, performance improvements and security fixes. As we're approaching March 2021, Node.js 12 is the recommended version in Azure Functions and version 14 is in preview. You may want to upgrade when it reaches the GA status. How do you…
Below is a quick overview of common scenarios where you may need to redirect visitors to another domain/url and how you can implement such redirection with Cloudflare. The answer to all of the scenarios is either Page Rules or Workers. Note both require the domain where you forward from to be proxied by Cloudflare (orange cloud enabled on the DNS tab). You can have up to 3 page rules and process…
DEV.to is a great place for a technical blog. The website feels lightweight and easy to navigate and the community is welcoming. Still, you may want to publish your content under your own domain first which you have full control of. You then may want to cross-post to DEV with a link to the canonical URL. When I started writing initially my workflow was like this: Write a blog post in the comfort…
You're viewing a project's code on your machine, and the code is hosted in Github. Imagine couple scenarios: You stumble upon a branch you don't recognize. You want to see how does this branch differ from the primary main branch. You're about to merge a branch into your main branch without making a pull request. Once again you want to see the changes before merging. The answer to both scenarios is…
If you're reading this, probably you manage your infrastructure with Terraform. Or even better, to keep resource definitions DRY you use Terragrunt . One day you realize one of the Terragrunt modules you maintain became too large. Plan and apply operations are slow. It's hard to navigate within the module and it's easy to make a mistake. You want to refactor the module and extract some resources…
If you run multiple Docker container with interactive shells (sh, bash, zsh) in them, it always take a moment to distinguish one terminal window from the other. It may help if you could see the docker container name right in the shell prompt. Below, cognito-jwt-verifier and azure-functions-apim-aad-auth are the names of 2 containers I'm running at the moment: Here's how to do it for popular…
Memory you purchase with your Apple iMac 2020 model is 2-7 times more expensive than what can find in computer peripherals stores. As an example, average price for 2x16gb DDR4 memory modules I found online was ~110€. At the same time, if you decide to upgrade an iMac 27 inch to a 32GB RAM while ordering on the Apple website (Portugal), that's +690€ to the cost. Holy crap! It takes 5 minutes to…
Recently I had a task of enforcing a usage quota on an API hosted in Azure Functions. API Management was a natural choice in the Azure ecosystem as it supports quota management natively. APIM instance was configured to make sure clients meet the quota requirements before requests are forwarded to the function app. But the function app was still open to the Internet and anyone could make requests…
<TLDR> Add application settings causing configuration drift to ignore_changes lifecycle hook in function app resource configuration in Terraform. </TLDR> The problem You define your cloud infrastructure as code with Terraform and provision all resources. One of the resources is a Function App, based on Linux running in Consumption plan. You deploy your application code with Azure Functions Core…
<TLDR> Add structured data (JSON-LD) annotations to enable rich snippets in Google search results. Github repo . </TLDR> What is structured data? It's a specially formatted code used to describe properties of a page it's added to. Popular formats are RDF, microdata and JSON-LD. Latter is easier to integrate on a page because it's a plain <script> tag with JSON in it. The other 2 formats would…
<TLDR> Starter kit + guide for a Serverless GraphQL API on top of PostgreSQL and external APIs; with migrations, infrastructure-as-code, CI and tests. Github repo with code . </TLDR> GraphQL and Serverless became big trends in the last few years. Let's see how we can combine them! The stack idea evolved on what was originally inspired by Ben Awad's comprehensive Fullstack React GraphQL TypeScript…
<TLDR> Want to add a custom domain to your APIM instance? Using Cloudflare? Generate a free SSL certificate in minutes. </TLDR> When new API Management instance is created it's reachable with a default hostname from Azure: your-apim-name.azure-api.net . If you add a CNAME record pointing to that hostname (e.g. api.your-company.com ) and query the cname, you will get the HTTP Error 503. The service…
<TLDR> Visual overview of Azure API Management service: what it is, how it works and how it can be useful to you. </TLDR> API Management (APIM for short) is a managed API Gateway service in Azure coming with a rich set of features. If you're not familiar with the concept you can think of an API Gateway as a middleman that operates between clients (web apps, mobile clients, other APIs) and your…
<TLDR> You may want to follow these periodic reports from experts to help you choose technologies to learn and use next. </TLDR> I'm sure you noticed - the world is changing fast. Technology industry as a whole and software engineering specifically evolve at pace never seen before. If you're a backend developer, you may remember how physical servers were purchased or rented to start a new project.…
<TLDR> A practical, step by step guide on how to deploy an Azure Function with Terraform. No prior experience is required. Final code is in the tutorial repo . </TLDR> I love how quickly you can log in to a cloud provider UI and create a few resources for some random test. But unfortunately this approach is neither scalable nor reproducible. Unless I know this is going to be a one-time experiment…
<TLDR> Use curl to make GraphQL queries and mutations in remote shells and to troubleshoot request problems </TLDR> Do you know and use all of the best-for-the-job tools available to us developers? I certainly don't! I'm trying to stay up to date with multiple mailing lists, blog posts, tweets and press releases. I'm sure you know that feeling of drinking from a firehose. And I must admit, until…
<TLDR> CI pipelines are supported natively in Github Actions. Add a single workflow definition file to your repository and run automated tests, security and code style checks on every pull request. Full code and configuration in the repo </TLDR> I encourage you to take a moment and appreciate the great time we live and work in. Imagine what it would take to set up a Continuous Integration pipeline…
<TLDR> Testing an Azure Function is no different than testing any Javascript module exporting an async function. Passing a mocked Azure context is tricky so use an npm module for that. Mock parts of your code making network calls. Function app full code before tests Function app full code with tests Diff with only Jest config and tests Below is a step by step guide on how to add Jest tests to an…
<TLDR> If your DNS provider is Cloudflare, you can use its Workers feature to add password protection on top of the existing website or API. You don't need to make any changes to the web server configuration or application code. You can enable password protection either manually via Cloudflare dashboard or define it as Infrastructure-as-Code with Wrangler. </TLDR> Why? # Sometimes you don't want…
Edit 2020: I'm not sure this is even relevant anymore, looks like project's Github is dead. This is here for history purposes. Following is about redis-faina: a query analysis tool for Redis . It's a tool from the team at Instagram to analyze commands coming to your Redis server. You may have couple (hundred (thousands)) requests at your Redis server you completely forgot about. It will be nice to…