Practical AWS Projects

// The part of the task definition that carries the two roles and
// the injected secret — the piece most first attempts get wrong.
{
  "family": "orders-web",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],

  // Used by the ECS agent: pull the image, fetch the secret,
  // write the logs. Not available to your code.
  "executionRoleArn": "arn:aws:iam::111122223333:role/orders-exec",

  // Used by your code: S3, SQS, anything the app calls.
  "taskRoleArn": "arn:aws:iam::111122223333:role/orders-task",

  "containerDefinitions": [{
    "name": "web",
    "image": "111122223333.dkr.ecr.eu-west-1.amazonaws.com/orders:sha-9f2c1d",
    "command": ["gunicorn", "config.wsgi", "--bind", "0.0.0.0:8000"],
    "portMappings": [{ "containerPort": 8000 }],

    // The value never appears here. Only the ARN does.
    "secrets": [
      { "name": "DATABASE_URL",
        "valueFrom": "arn:aws:secretsmanager:eu-west-1:111122223333:secret:orders/db-AbC123" }
    ],

    "environment": [{ "name": "DJANGO_SETTINGS_MODULE", "value": "config.settings.production" }],

    "healthCheck": {
      "command": ["CMD-SHELL", "curl -f http://localhost:8000/internal/health || exit 1"],
      "interval": 15, "timeout": 5, "retries": 2, "startPeriod": 30
    },

    "logConfiguration": {
      "logDriver": "awslogs",
      "options": {
        "awslogs-group": "/ecs/orders-web",
        "awslogs-region": "eu-west-1",
        "awslogs-stream-prefix": "web"
      }
    }
  }]
}

# The handler: do the fast part, publish the rest, return.

import json
import os
import boto3

ddb = boto3.resource("dynamodb").Table(os.environ["ORDERS_TABLE"])
events = boto3.client("events")

def handler(event, context):
    body = json.loads(event["body"])
    order_id = body["order_id"]

    # Fast, synchronous, inside the timeout: one write.
    ddb.put_item(
        Item={"pk": f"ORDER#{order_id}", "sk": "META", "status": "received", **body},
        ConditionExpression="attribute_not_exists(pk)",   # idempotent create
    )

    # Slow work does not belong here. Publish a fact and stop.
    events.put_events(Entries=[{
        "EventBusName": os.environ["BUS_NAME"],
        "Source": "orders.api",
        "DetailType": "OrderReceived",
        "Detail": json.dumps({"order_id": order_id}),
    }])

    return {"statusCode": 202,
            "body": json.dumps({"order_id": order_id, "status": "received"})}

# 202, not 200. The order is accepted and not yet complete, and
# saying so in the status code is what lets the email, the search
# index update and the billing call all happen after the response
# without the client waiting for any of them.

# The worker. Two details carry the whole idempotency story.

import os
import boto3

s3 = boto3.client("s3")
OUT_BUCKET = os.environ["OUTPUT_BUCKET"]

def output_key(input_key: str) -> str:
    # DERIVED, not generated. Same input → same output key, so a
    # second run overwrites the first instead of adding a file.
    # A uuid here would create a duplicate on every retry.
    name = input_key.removeprefix("input/").rsplit(".", 1)[0]
    return f"output/{name}.processed.json"

def handle(record: dict) -> None:
    bucket = record["s3"]["bucket"]["name"]
    key = record["s3"]["object"]["key"]

    body = s3.get_object(Bucket=bucket, Key=key)["Body"].read()
    result = process(body)

    s3.put_object(Bucket=OUT_BUCKET, Key=output_key(key), Body=result)
    # The message is deleted only after this returns. A crash
    # before it means the file is processed again — and because
    # the key is derived, that is a no-op rather than a duplicate.

# Sizing the visibility timeout, with the real numbers:
#   p99 processing time      : 90 s
#   safety factor            : ×3
#   visibility timeout       : 300 s
#   Lambda function timeout  : 240 s   (must be under the above)
#   maxReceiveCount          : 3, then the DLQ

-- Row-level security, which is the backstop that makes a
-- forgotten filter safe rather than catastrophic.

ALTER TABLE orders ENABLE ROW LEVEL SECURITY;
ALTER TABLE orders FORCE ROW LEVEL SECURITY;   -- applies to the owner too

CREATE POLICY tenant_isolation ON orders
  USING (tenant_id = current_setting('app.tenant_id')::uuid);

-- The application sets it once per request, on the connection
-- it has checked out, before any query runs:
--   SET LOCAL app.tenant_id = '3f0c…';

-- Now the difference that matters:
--   SELECT * FROM orders WHERE id = 42;
-- returns the row only if it belongs to the current tenant, and
-- returns zero rows otherwise. The developer who forgot the
-- tenant filter has written a bug, not a breach.

-- Two things this does not do, and both need their own answer:
--   1. It does nothing if the pooler hands the connection to
--      another request without resetting the setting. SET LOCAL
--      inside a transaction is what makes this safe.
--   2. It does not cover the cache, S3, or the search index.
--      Those need their own tenant scoping.

# The three drills, with the numbers they are supposed to produce.

DRILL 1 — ZONE LOSS                          quarterly
  Method   remove eu-west-1b subnets from the ALB target group,
           and set the ASG's desired capacity for that zone to 0
  Measure  time to full capacity in eu-west-1a; error count
  Pass     errors return to baseline within the stated objective,
           and the remaining zone serves peak without saturation
  Found    ASG maximum was 4; peak needs 3 per zone, so a single
           zone could only reach 4 of the 6 required. Raised to 8.

DRILL 2 — RESTORE                            quarterly
  Method   restore the production database to a point in time
           into a new instance, in a non-production account
  Measure  wall-clock from initiating to accepting queries
  Pass     under the agreed RTO for the data tier
  Found    22 minutes for the restore, then 40 more to reconfigure
           the application. The real RTO was 62 minutes, not 22 —
           and only the drill would ever have shown the second part.

DRILL 3 — REBUILD FROM THE REPOSITORY        twice a year
  Method   deploy the whole environment into an empty account
  Measure  whether it completes, and what had to be done by hand
  Pass     it completes with no manual step outside the runbook
  Found    an ACM certificate created in the console two years
           ago, a Route 53 zone owned by nobody, and a KMS key
           policy naming a role that only exists in production.

The third drill is the one people skip and the one that finds
the most, because it is the only test of the claim that the
repository actually describes the system.