Infrastructure (AWS)
Notes on AWS infrastructure, how to set up the various services, etc.
ACM
Amazon Certificate Manager (primarily for e.g. CDN certificates for CloudFront distributions)
CloudFront
Content Delivery Network, also used as an entry point for Deserted Chateau for security purposes
CloudFront response timeouts
If you're performing a particularly long operation (e.g. the user submitted an AJAX request to pe...
Image Download Function
Below is an example of a function you can use to set the Content-Disposition HTTP header when a U...
Outdated AWS docs for CloudFront+WAF integration
There are several outdated articles on the AWS website about how to integrate CloudFront and WAF ...
WebSockets protocol with CloudFront
While CloudFront natively supports websockets, there is one major pitfall you can end up running ...
DynamoDB
AWS NoSQL databases
EC2 (Elastic Compute Cloud)
AWS' gigantic cloud computing solution, also includes load balancers
EventBridge
Serverless task scheduling
IAM
Identity and access management - example IAM policies for various use cases
EventBridge
EventBridge scheduler role An example IAM role for EventBridge schedules is below. The main poin...
Lambda
Example permissions policy This policy grants access to create, update, delete and invoke Lambda...
S3
Example permissions policy This policy allows access to objects within a given bucket. The main...
SES
Example permissions policy { "Version": "2012-10-17", "Statement": [ { ...
Systems Manager / Parameter Store
Example permissions policy This policy grants permission to create, delete and get Parameter Sto...
Lambda
Serverless code functions
Compiling Node Binaries for ARM architecture (unused)
Note: this isn't used, as despite the lower cost, ARM has significantly lower performance for Des...
Creating Lambda layers for common functions
To save on repetitive code in your Lambda functions, you can define a custom Lambda Layer to add ...
Lambda functions and AWS API versions
Different Lambda runtimes are bundled with different AWS API versions The different runtimes, de...
Setting up Lambda for image resizing
Compiling sharp for x86_64 architecture To use Sharp for Node.js properly, we need to compile it...
Authenticating AWS service clients within Lambda functions
There are two secure ways you can give a Lambda function permission to invoke other AWS services,...
Lightsail
AWS' webserver solution
MediaConvert
AWS' video transcoding service (we do not currently use this)
RDS
Relational Database Service (Deserted Chateau uses MariaDB databases)
Database Privileges
Strictly speaking, Amazon RDS does not give you full root privileges on your database server (so ...
SQL connection pools
Connection pools take up connections even if they're not being used Your database server is goin...
The MariaDB Node.js connector
Using the batch query function When using batch queries via conn.batch, be aware that attempting...
Exporting an RDS Snapshot to S3
If for whatever reason you need to restore a snapshot of an RDS database, there are a few possibl...
RDS Configuration Notes
Warning: auto-generated passwords When creating an RDS instance, if you choose "auto-generate a...
Incorrect connection cleanup
If you fail to clean up connections properly, you can end up with functions taking a lot longer t...
Upgrading an RDS database
Minor version upgrades You can do these easily in the RDS console (be aware they will cause some...
Redis
Cache servers (ElastiCache for Redis)
S3
AWS' cloud file storage solution - example permissions policies, etc
SES
Simple Email Service, for programmatically sending emails
SES: SMTP user credentials
SMTP credentials vs. IAM Access Keys If it looks like an IAM credential, walks like an IAM crede...
Setting up SES for email sending
Setting up Amazon SES to send (but NOT receive) emails: - Register your domain in Route 53 (or t...
Setting up SES for email sending AND receiving
Setting up Amazon SES to send and receive emails: # WARNING: Amazon SES only supports receiving ...
SMTP User Notes
When using SES: - Emails sent directly via SMTP, e.g. via Monolog/PHPMailer, must be sent with t...
Template emails: rendering failures
If you have an error in one of your email templates, or any code that uses them, you may end up w...
VPC
Virtual Private Cloud
Security Group IP addresses
When adding IP addresses or CIDR blocks to VPC security groups - make sure you're using the priva...
The special Lightsail VPC
Normally when you use Lightsail, you can't connect to other AWS resources from your Lightsail ser...
Using internet-facing AWS services within VPC-enabled functions
If you're running a Lambda function within a VPC (for instance, to allow it to connect to an RDS ...
VPC Endpoints: Gateways and Interfaces
VPC Endpoints Not all AWS services can communicate with each other, as some are in a VPC and som...
WAF
Web Application Firewall, and specifics of using it with CloudFront + ALB
Enabling WAF on AWS Lightsail via CloudFront and EC2
Setting up WAF to protect Lightsail instances is a little awkward. From a technical standpoint, L...
WAF pricing: rules and rule groups
The free managed rule groups still incur a charge Be aware that, although the AWS managed rule g...
Setting up rate limiting via WAF
If your infrastructure setup is such that all of your site visitors are coming to your website th...
Setup Instructions
Specific instructions on setting up a new AWS account environment.
VPC: security groups and endpoints
Default VPC security group changes Modify the security group to allow TCP ports 3306 and 6379 (f...
IAM: users, roles and policies
IAM Policies Deserted-Chateau-Test-Lambda-Admin-Access { "Version": "2012-10-17", "St...
S3: buckets, access policies and CORS policies
deserted-chateau-test-external-site-assets Bucket Policy { "Version": "2012-10-17", "...
CloudFront & WAF: distributions and WAF rule configuration
Lambda: functions, layers and important configuration settings
See the codebase for a list of functions and layers to upload to Lambda, under the /lib/aws/ folder.
SES: Verified identities, DKIM/DMARC, and SNS/SQS setup
Verified Entities Add desertedchateau.com as a verified domain entity. See the SES chapter for c...
RDS and ElastiCache: setup and configuration
DynamoDB: tables
Systems Manager: Parameter Store credentials
/Deserted-Chateau/Credentials/BunnyAccountCredentials {"api_key": "<bunny API key>"} /Deserted-...