#AWS
161 posts
Fixing Lambda Cold Starts: The Cost Math of Provisioned Concurrency
Lambda cold starts and their remedies from a cost angle: how the init phase creates the latency, the near-free fixes like smaller packages and SnapStart, the two-part pricing of Provisioned Concurrency ($0.0000041667/GB-s to keep warm plus a discounted execution rate), the crossover around 60% utilization where it becomes cheaper than on-demand, scheduling, and the decision order.
AWS Data Transfer Pricing, Explained: What's Billed and What's Free
A leg-by-leg breakdown of the hardest line item to read on an AWS bill: the inbound-free, outbound-paid principle, internet egress at $0.09/GB, free same-AZ traffic versus $0.01/GB each way across AZs, cross-region transfer, the NAT Gateway and public IPv4 charges that stack on top, VPC endpoints as the bypass, and the order in which to cut the bill.
The Cost Case for CloudFront: When It Saves Money and When It Doesn't
Whether putting CloudFront in front actually lowers your bill, worked out with numbers: the rate gap between direct EC2/S3 transfer at $0.09/GB and CloudFront at $0.085/GB, the structural fact that origin-to-CloudFront transfer is free, the effect of the always-free 1TB, the trap where request fees become the main cost for small responses, and how cache hit ratio decides the outcome.
GitHub Actions #7 AWS Deploys and OIDC: Credentials Without Access Keys
We look at the leak and rotation problems of storing access keys in secrets, then explain how a workflow assumes an AWS role with short-lived tokens through OIDC, walking the token exchange flow step by step. We cover the AWS-side trust configuration and sub claim restrictions, the configure-aws-credentials action and the id-token permission, and finish with an S3 static site deploy — closing out the credential problem in the deploy pipeline.
Terraform in Practice #10 Domain, HTTPS, and Completion: Route 53, ACM Validation, CloudFront and provider alias
Connecting the Route 53 hosted zone as a data source, issuing an ACM certificate through the three-resource DNS validation idiom, and attaching an HTTPS listener with a redirect to the ALB. We cover using a provider alias to work with us-east-1 for the CloudFront certificate, then wire up a CDN serving the locked-down S3 bucket via OAC and the alias records, completing the architecture built across ten parts.
Terraform in Practice #8 Deploying on ECS Fargate: Task Definitions, Services, and the Cutover Behind the ALB
Examining the limits of the user_data approach and moving the compute layer to containers. We build an ECS cluster and a Fargate task definition, separate the execution role from the task role, create a service with an ip-type target group, and run EC2 and containers side by side behind the same ALB before cutting over with a single listener change — all in code.
Terraform in Practice #7 IAM as Code: Instance Roles, Least Privilege, and GitHub Actions OIDC
Writing trust policies and permission policies with the aws_iam_policy_document data source, then attaching a role to EC2 through an instance profile to complete SSM Session Manager access and secret reads. We narrow least privilege down to individual resource ARNs, and build the OIDC federation that lets GitHub Actions assume an AWS role without access keys — all in code.
Terraform in Practice #6 Secrets Management: SSM vs Secrets Manager and Write-Only Arguments
We compare SSM Parameter Store and Secrets Manager on cost and features to set a selection standard, then use Terraform 1.11 ephemeral resources and write-only arguments to build a configuration where the DB password appears in neither plan nor state. We also design the path where the application reads the secret at runtime, solving the plaintext problem from the last part structurally.
Terraform in Practice #5 RDS and S3: Codifying the Data Tier with Safety Guards
We place an isolated PostgreSQL RDS instance in private subnets using a DB subnet group and security group chaining, then configure gp3 storage, backups, and the prevent_destroy safety guard. We also set up an S3 bucket for static assets with public access blocked, and confirm the problem that the DB password kept temporarily in a variable stays in state as plaintext, handing it off as the task for the next part.
Terraform in Practice #4 ALB and Auto Scaling: Launch Template, Target Group, and Scaling Policy
We promote the single EC2 instance to an Auto Scaling group behind a load balancer. The instance definition moves into a launch template, the ALB, target group, and listener get wired together, and a CPU target tracking scaling policy goes on top. We also delete the verification instance from the code to walk through how resource removal works in IaC, and receive the first response in a browser.
Terraform in Practice #3 EC2 and Security Groups: SG Chaining Design and Booting with user_data
Instead of writing CIDR blocks, we connect security groups by security group reference — a chaining design across an ALB and EC2 two-tier layout. We then look up the latest AL2023 AMI with a data source and launch an EC2 instance into a private subnet that boots a web server via user_data. Also covered: why no SSH port is opened, and the plan to complete access with Session Manager.
Terraform in Practice #2 VPC Network as Code: Subnets Across Two AZs, Routing, and the NAT Gateway
We build the VPC that the myapp infrastructure stands on. Public and private subnets go across two AZs with for_each, an internet gateway and route tables define the traffic paths, and a NAT gateway carries private outbound traffic with the cost trade-off made explicit. We wrap up by organizing the network outputs so the compute layer in the next part has everything it needs.