Articles

Python: Simple JSON Structured Logging

Hello! If you're setting up JSON logging in AWS lambda, check out this instead. You need some extra code to prevent duplicate log messages. Recently, I've been switching to logs structured as JSON. Using the sample command in my pattern for production-ready Python scripts, that means we replace delimited-strings like these: With JSON objects like … Continue reading Python: Simple JSON Structured Logging →

CloudWatch Logs: Preventing Orphaned Log Groups

Hello! When you need to publish logs to CloudWatch (e.g. from a lambda function), you need an IAM role with access to CloudWatch. It's tempting to use a simple policy like the one in the AWS docs. You might write a CloudFormation template like this: Obviously, the role is too permissive: arn:aws:logs:*:*:* But, there's another … Continue reading CloudWatch Logs: Preventing Orphaned Log Groups →

CloudFormation: Limited-Privilege IAM Policies With cfn-nag

Hello! This article is about security testing in CloudFormation, if you're looking for functional testing, check out this. When you write IAM policies, you should grant the smallest set of permissions that work. So, looking at this policy defined in a CloudFormation resource: The Resource: '*' looks wrong. It grants permission to make the DescribeInstances … Continue reading CloudFormation: Limited-Privilege IAM Policies With cfn-nag →

Lambda: Building Python 3 Packages

Hello! This is a guide for building lambda zip packages with pip dependencies in Python 3. It expands the AWS guide to: Build your code if it's either a single-file Python module or a pip-installable Python package (e.g. contains a setup.py). Track pip dependencies for single-file Python modules in the standard requirements.txt file. Show the file … Continue reading Lambda: Building Python 3 Packages →

CloudWatch Logs Structured as JSON with Python Lambda Functions

Hello! If you're setting up JSON logging in a script and instead of a lambda function, check out this instead. The pattern is a little simpler. Recently, I've been switching to logs structured as JSON. That means output like this: Instead of this: This way, your log processor can reference keys in a JSON object … Continue reading CloudWatch Logs Structured as JSON with Python Lambda Functions →

Simplifying Messy Conditions: Adaptive Models

Hello! Today we're getting into the thorns of programming. Beware cactus. 🌵 Years ago I found Martin Fowler's article on Adaptive Models. Adaptive models let you replace nests of conditions with a declaration of actions. That pattern has helped clean up my DevOps code a ton of times. Fowler is a better programmer than me. His … Continue reading Simplifying Messy Conditions: Adaptive Models →