All posts
timestamptz Pitfalls: The Easy Mistakes in PostgreSQL Time Handling
A collection of practical traps in PostgreSQL time handling. The misconception that timestamptz stores a time zone, why results look different depending on the session TimeZone, the dual behavior of AT TIME ZONE that changes depending on input type, how date_trunc and daily grouping change with where midnight is anchored, why future appointments need more than timestamptz (time zone rules change), and now() versus clock_timestamp().
Entra ID Automation #5 PIM and Auditing: Killing Standing Admins, Logs, and Access Reviews
The track finale on privilege and accountability: the PIM structure that replaces standing admin rights with eligibility and time-boxed activation, Graph roleEligibilityScheduleRequests and the self-activation API, the pattern combining role-assignable groups with PIM, pulling audit and sign-in logs through the API to alert on high-risk events, automating periodic access reviews, and the adoption order for everything in this track.
Terraform in Practice #6 Secrets Management: SSM vs Secrets Manager and Write-Only Arguments
We compare SSM Parameter Store and Secrets Manager on cost and features to set a selection standard, then use Terraform 1.11 ephemeral resources and write-only arguments to build a configuration where the DB password appears in neither plan nor state. We also design the path where the application reads the secret at runtime, solving the plaintext problem from the last part structurally.
UUID vs bigint Primary Keys: What the Performance Gap Really Is, and uuidv7
Settling the perennial UUID-vs-bigint primary key debate with measurable grounds. Why bigint is the default (size, insert locality, join cost), the mechanism by which UUID v4 scatters the index and hurts writes and cache efficiency, how time-ordered uuidv7 resolves most of that and PostgreSQL 18's built-in function, uuidv7's remaining trade-offs (creation-time exposure, 16 bytes), and the internal-bigint-plus-external-UUID hybrid design.
Entra ID Automation #4 Conditional Access: Managing Policy as Code
The sign-in-moment defense line, from an automation angle: the if-then structure of signals, decisions, and enforcement, CRUD on policies through the Graph conditionalAccess endpoint, the policy-as-code flow of source control, review, and CI deployment, why every new policy must run in report-only mode first, the rule that break-glass accounts are excluded from every policy, and the 30-day restore window for accidentally deleted policies.
Terraform in Practice #5 RDS and S3: Codifying the Data Tier with Safety Guards
We place an isolated PostgreSQL RDS instance in private subnets using a DB subnet group and security group chaining, then configure gp3 storage, backups, and the prevent_destroy safety guard. We also set up an S3 bucket for static assets with public access blocked, and confirm the problem that the DB password kept temporarily in a variable stays in state as plaintext, handing it off as the task for the next part.
The N+1 Query Problem: Symptoms, Detection, and Fixes
N+1 queries, the most common culprit when ORM-backed services slow down. How lazy loading builds the structure where one listing fires 101 queries, detection via application logs and the calls column of pg_stat_statements, the three fixes (JOIN, batched IN loading, and the ORM's eager-loading options), and the prevention principle of designing for the shape of data a screen needs rather than counting queries afterward.
Working with JSON in Rust: A Practical serde Deserialization Guide
serde, Rust's standard for JSON, organized in working order: struct deserialization starting from one derive line, Option and default for real-world JSON with missing fields, rename_all to bridge camelCase APIs, feeling out unknown JSON with Value, enums with tag and untagged for responses that come in several shapes, and reading positions out of error messages.
Building Python Extension Modules with PyO3: From maturin Build to Wheel Publishing
Walking the path Polars, Ruff, and pydantic proved: rewrite only Python's bottleneck function in Rust. The project structure maturin new creates, exposing Rust functions to Python with #[pyfunction] and #[pymodule], the maturin develop cycle, the type conversion rules (str, list, dict), the fit with free-threaded Python, and wheel builds through PyPI publishing.
Entra ID Automation #3 Group Design: Dynamic Groups, Group-Based Licensing, Access Packages
Designing groups — the unit of access management — for automation: when to use security groups versus Microsoft 365 groups, dynamic groups whose membership is computed from attribute rules and their P1 licensing, rule syntax and processing delays as operational realities, group-based licensing that automates assignment and reclamation on entry and exit, the security boundary of role-assignable groups, and access packages that productize self-service access requests.
PostgreSQL Upsert Done Right: ON CONFLICT Usage and Traps
Handling "update if present, insert if not" without race conditions using ON CONFLICT. Why the SELECT-then-INSERT approach breaks under concurrency, how to use DO NOTHING and DO UPDATE, referencing new values with EXCLUDED, why the conflict target (a unique constraint) should be named explicitly, the cost of rows being locked and rewritten even when nothing changed, the relationship with MERGE, and the sequence-gap phenomenon.
Terraform in Practice #4 ALB and Auto Scaling: Launch Template, Target Group, and Scaling Policy
We promote the single EC2 instance to an Auto Scaling group behind a load balancer. The instance definition moves into a launch template, the ALB, target group, and listener get wired together, and a CPU target tracking scaling policy goes on top. We also delete the verification instance from the code to walk through how resource removal works in IaC, and receive the first response in a browser.