---
title: "AWS"
description: "205 posts about AWS, summarised, each linking to the original."
---

# AWS
> 205 posts about AWS, summarised, each linking to the original.

## Articles

### [How do I store inventory data in my Stripe application](https://yomu.fyi/post/how-do-i-store-inventory-data-in-my-stripe-application.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Ben Smith
- Published: Dec 16, 2024
- Type: Tutorial

The DevRel Swag Store uses Stripe payments and AWS services to keep product inventory accurate and visible in near real time. Stripe products retain core payment information, while Amazon DynamoDB stores inventory and other attributes, keyed by Stripe product ID and store ID; EventBridge routes payment events to Lambda, which atomically decrements stock and publishes updates through AWS IoT Core to the frontend. DynamoDB condition expressions prevent decrements when stock is insufficient, while post-payment validation and refunds address the delay before a Stripe Payment Link is disabled, although Stripe fees may be non-refundable. A custom Payment Intent flow can check stock before payment, authorize funds with manual capture for up to seven days, update inventory after payment success, and then capture the charge.


### [Enhance your monitoring by integrating Stripe events with AWS CloudWatch Log Groups](https://yomu.fyi/post/enhance-your-monitoring-by-integrating-stripe-events-with-aws-cloudwat.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Andrew Robinson
- Published: Dec 9, 2024
- Type: Tutorial

Stripe events notify account owners about changes such as successful charges, failed invoice payments, and available reconciliation reports. Because Stripe retains events for 13 months but exposes older events than 30 days only as summaries, Amazon EventBridge can route them into an AWS account and Amazon CloudWatch Log Groups can provide longer-term monitoring and analysis. The setup uses CloudWatch metric filters to match event types such as invoice.payment\_failed, convert matches into custom metrics, and support alarms, Amazon SNS notifications, dashboards, and Logs Insights queries. For example, a failed-invoice alarm can use a five-minute observation period, Sum statistics, and a threshold based on expected failure volume or anomaly detection. The resulting setup supports near-real-time visibility into successful charges and failed payments, historical trend analysis, troubleshooting, and responses to unusual activity.


### [Data access patterns for simple Stripe integrations](https://yomu.fyi/post/data-access-patterns-for-simple-stripe-integrations.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Ben Smith
- Published: Nov 27, 2024
- Type: Explainer

The article examines how applications should store and access product data in simple Stripe integrations as requirements for security, performance, and scalability evolve. It compares using Stripe’s built-in product fields with a separate database, while explaining that publishable API keys cannot retrieve product details and that secret or restricted keys must remain server-side. A web backend or serverless function can proxy requests securely, while CloudFront caching reduces repeated calls and latency but requires an appropriate refresh cadence. For richer metadata, inventory, variants, or custom attributes, the article describes combining DynamoDB with Lambda and Stripe, using Event Destinations or webhooks to synchronize changes and weighing that flexibility against database overhead.


### [Managing multiple Stripe test environments from your AWS-hosted application](https://yomu.fyi/post/managing-multiple-stripe-test-environments-from-your-aws-hosted-applic.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: James Beswick
- Published: Nov 26, 2024
- Type: Explainer

Stripe sandboxes provide isolated test accounts that let teams manage multiple environments from one account. Unlike legacy test mode, each sandbox has separate data, its own API keys, and configurable user access, while up to five sandboxes can exist per account. They support simulated external events, fake balances, Test Payouts with API v2 keys, and CLI or SDK access by changing keys. For AWS-hosted applications, the recommended pattern stores sandbox and production keys in AWS Secrets Manager, using secret names as environment-neutral aliases rather than embedding environment logic in code. Teams can combine Stripe sandbox permissions with AWS IAM resource policies and directory groups to restrict which users or accounts can retrieve keys and prevent accidental production access.


### [How we reduced initialisation time of Product Configuration Management SDK](https://yomu.fyi/post/how-we-reduced-initialisation-time-of-product-configuration-management.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Ram Dilip Pradhan
- Published: Nov 22, 2024
- Type: Benchmark

GrabX, Grab’s central product configuration management platform, provides an SDK whose eventually consistent updates take about a minute to reach clients, but initialisation took roughly four minutes for services loading around 400 MB. The SDK’s sequential workflow downloaded subscribed-service and common data from AWS S3 to disk and memory before initialising dependent modules, creating cold-start pressure and possible throttling when new instances were launched. Phase 1 made the two data loads concurrent, reducing initialisation time by approximately 80%, while Phase 2 concurrently downloaded and loaded large configurations within a subscribed service, adding a further approximate 6% reduction. Phase 3 removed disk persistence because its stale-data fallback conflicted with most clients’ need for current data, allowing failed connections to trigger client action such as retrying. Benchmarks across services with varied data sizes indicated reductions of up to 90%.


### [Using demo data for testing Stripe integrations in AWS-hosted applications](https://yomu.fyi/post/using-demo-data-for-testing-stripe-integrations-in-aws-hosted-applicat.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: James Beswick
- Published: Nov 22, 2024
- Type: Tutorial

Stripe sandboxes let developers manage multiple test environments from one Stripe account for AWS-hosted applications, extending Stripe’s test mode with simulated external events, fake balances, and Test Payouts using API v2 keys. The post describes seeding a sandbox with products and other Stripe objects by exporting production data to CSV for import or generating records with the Stripe CLI and scripts. For local use, developers authenticate with stripe login, while CI scripts pass a sandbox key to each CLI request and can optionally delete the created products afterward. It recommends storing the key in AWS Secrets Manager, retrieving it at runtime through the AWS CLI or SDK, restricting access with IAM, avoiding logs and source repositories, and rotating keys; this lets CI scripts use sandbox data without exposing credentials.


### [Growing your Stripe integration With Event Destinations](https://yomu.fyi/post/growing-your-stripe-integration-with-event-destinations.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Ben Smith
- Published: Oct 31, 2024
- Type: Explainer

Stripe Event Destinations, now in general availability and rolling out to all accounts, lets companies extend payment workflows without changing existing integrations. The post explains how Stripe events can be sent either to an AWS account through Amazon EventBridge or to a webhook endpoint, with EventBridge routing selected events to services such as AWS Lambda, Step Functions, and SQS. Event filtering, logging, transformation, and built-in security reduce the need to operate webhook servers and verify signatures in application code. Serverless Lambda functions can add custom logic and connect to DynamoDB, S3, or SNS, supporting examples including date-limited memberships, partial student payments, and real-time tipping broadcasts through AWS IoT Core and WebSockets. The resulting architecture is presented as flexible and scalable for variable or growing event volumes while preserving the underlying Stripe integration.


### [How we reduced peak memory and CPU usage of the product configuration management SDK](https://yomu.fyi/post/how-we-reduced-peak-memory-and-cpu-usage-of-the-product-configuration.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Ram Dilip Pradhan
- Published: Oct 30, 2024
- Type: Problem & solution

GrabX’s product configuration SDK used substantial memory and CPU because every client downloaded, decoded, and loaded a single JSON file containing configurations for all services, even when it needed only a small subset. The design also regenerated and fetched complete files every minute, while decoding a file larger than 100 MB could starve request handling and increase P99 latency. The proposed redesign partitions data by service, stores each configuration in its own JSON file and S3 prefix, and adds service-level changelogs so SDKs subscribe only to required services and apply targeted updates. Benchmarking across varied configuration sizes found potential reductions of up to 70% in memory utilisation and more than 50% in maximum CPU utilisation. Further work is planned to reduce SDK initialisation time.


### [How to Create a Secure CI/CD Pipeline Using Okta Terraform](https://yomu.fyi/post/how-to-create-a-secure-ci-cd-pipeline-using-okta-terraform.md)
- Company: [Okta](https://yomu.fyi/company/okta.md)
- Author: Nick Connelly
- Published: Oct 11, 2024
- Type: Tutorial

The guide presents a secure CI/CD pipeline for managing Okta resources with Terraform, AWS, and GitHub Actions, addressing local setup, collaboration, state storage, secrets, and deployment automation. Its architecture uses GitHub as source control and workflow trigger, GitHub OIDC to authenticate to AWS IAM STS and assume roles, S3 for Terraform state, DynamoDB for state locking, and AWS Secrets Manager for Okta OAuth 2.0 client credentials private keys. Developers push changes to develop for an automatic development build, open a pull request to main for a production plan, and merge approved changes to trigger the production build. The workflows run Terraform init, plan, and apply as appropriate, while the guide also covers repository setup, branch organization, and troubleshooting for missed configuration in GitHub, Okta, or AWS.


### [Unveiling the process: The creation of our powerful campaign builder](https://yomu.fyi/post/unveiling-the-process-the-creation-of-our-powerful-campaign-builder.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Jie Zhang
- Published: Sep 10, 2024
- Type: Explainer

Grab details the event processing architecture behind Trident, its internal marketing campaign platform that evaluates If This, Then That (IFTTT) logic over Kafka streams. The core processing unit is a treatment consisting of an event, optional conditions, and actions. Complex campaign capabilities—such as counters, limits, and delays across multiple hours via recursive SQS message scheduling—are assembled from multiple coordinated treatments. To simplify campaign creation, Grab introduced a flowchart-like visual builder represented as a JSON node tree that compiles recursively into treatments while persisting node-to-treatment mappings to reconcile edits over time.


### [Bringing your Stripe objects to life with Workbench](https://yomu.fyi/post/bringing-your-stripe-objects-to-life-with-workbench.md)
- Company: [Stripe](https://yomu.fyi/company/stripe.md)
- Author: Ben Smith
- Published: Aug 29, 2024
- Type: Tutorial

The post demonstrates how Stripe Workbench’s Inspector can be used to examine a PaymentIntent throughout its lifecycle and diagnose payment workflow issues. It maps states including requires\_payment\_method, processing, requires\_action, succeeded, and canceled, showing how the status property changes as inputs and decisions move the object through a state machine. The walkthrough creates and confirms test PaymentIntents with Stripe Shell commands, including a 3DS-required card that produces a requires\_action state and a use\_stripe\_sdk next\_action. It also describes reacting to state changes through webhook endpoints or Amazon EventBridge, using the Inspector to identify friction such as PaymentIntents stalled at requires\_action and to debug abandoned payments.


### [AWS without Access Keys](https://yomu.fyi/post/aws-without-access-keys.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Jun 19, 2024
- Type: Problem & solution

The post describes how Fly Machines can access AWS resources such as an S3 bucket without distributing long-lived AWS access keys. It uses OpenID Connect (OIDC): AWS IAM trusts Fly.io’s OIDC identity provider, a role grants narrowly scoped permissions, and the app receives the role ARN as an environment variable. At boot, Fly’s Rust init requests a machine-specific OIDC token through the /.fly/api Unix socket, writes it to /.fly/oidc\_token, and sets AWS\_WEB\_IDENTITY\_TOKEN\_FILE and AWS\_ROLE\_SESSION\_NAME so the AWS SDK can call STS AssumeRoleWithWebIdentity. AWS verifies the token, issues short-lived credentials, and evaluates the role’s IAM policy before serving the requested object. The trust policy can constrain tokens by audience and subject, including an organization, Fly App, or machine; the same pattern can authenticate against other OIDC-compliant providers, although Azure and GCP lack equivalent init integration.


### [Event Driven Machines](https://yomu.fyi/post/event-driven-machines.md)
- Company: [Fly.io](https://yomu.fyi/company/fly-io.md)
- Published: Feb 5, 2024
- Type: Problem & solution

Event Driven Machines presents Lambdo, a pattern for using Fly Machines as short-lived, event-triggered compute rather than relying on HTTP activation. It polls an SQS queue for JSON events, batches the messages and metadata, then creates fast-booting Fly Machines with the events written to /tmp/events.json; the Machine is destroyed after processing finishes. Application code can come from an existing codebase or Lambdo’s Node and PHP runtime images, with handlers or commands processing each event. SQS message attributes select the required image and can specify VM size and command, while the approach supports arbitrary code and even GPU-enabled Machines, giving each event control over its execution environment.


### [Kafka on Kubernetes: Reloaded for fault tolerance](https://yomu.fyi/post/kafka-on-kubernetes-reloaded-for-fault-tolerance.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Fabrice Harbulot
- Published: Dec 26, 2023
- Type: Problem & solution

Grab's real-time data streaming platform, Coban, operates Kafka on AWS Elastic Kubernetes Service using Strimzi, allocating an entire EC2 worker node with NVMe instance store volumes to each broker. An initial architecture suffered from client connection errors, broken Network Load Balancer target groups, and zombie Persistent Volume Claims when worker nodes terminated. To achieve automated fault tolerance, the team integrated the AWS Node Termination Handler in Queue Processor mode with Auto Scaling lifecycle hooks, ensuring Kafka receives a SIGTERM to migrate partition leadership gracefully before shutdown. They also introduced the Kubernetes Cluster Autoscaler to dynamically provision replacement nodes during maintenance events and used the AWS Load Balancer Controller with TargetGroupBinding custom resources to dynamically update load balancer targets using IP mode.


### [Graph modelling guidelines](https://yomu.fyi/post/graph-modelling-guidelines.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Wenxiang Lu
- Published: Nov 8, 2023
- Type: Tutorial

Graph modelling uses graph theory to represent real-world entities, relationships, and properties through nodes and edges, unlocking insights across interconnected datasets. The process begins with defining domain concepts, mapping entities and relationships, and assigning relevant descriptive properties to both nodes and edges. Practitioners choose between graph structures such as property graphs or Resource Description Framework models before optionally developing a structural schema. Data is then imported or generated to populate storage systems such as Neo4j, Amazon Neptune, Azure Cosmos DB, or in-memory data structures. Finally, the graph is visualised and analysed using algorithmic methods like shortest path calculation, centrality measurement, and community detection.


### [Finding the right balance of speed and security through just-in-time access to cloud resources](https://yomu.fyi/post/finding-the-right-balance-of-speed-and-security-through-just-in-time-a.md)
- Company: [Ramp](https://yomu.fyi/company/ramp.md)
- Author: Julien Colombain
- Published: Oct 11, 2023
- Type: Problem & solution

Ramp’s rapid growth exposed problems in its AWS access model: three broad roles created persistent production access for some senior engineers while junior engineers depended on seniors for queries. The team first reorganized permissions into more than 20 team-specific AWS Identity Center groups, each backed by permission sets and a Terraform module that presents IAM configuration through human-readable resource lists. It then introduced just-in-time access through ConductorOne by pairing each non-production role with an elevated production role, removing standing production access and provisioning entitlements through AWS SSO group membership. Team-owned requests were automatically approved, while cross-team requests went to the relevant tech lead, with temporary access and backup approval handling described in the design. The resulting model reduced exposure, preserved fast access to needed resources, and recorded production activity for accountability and audit purposes.


### [How Ramp Accelerated Machine Learning Development to Simplify Finance](https://yomu.fyi/post/how-ramp-accelerated-machine-learning-development-to-simplify-finance.md)
- Company: [Ramp](https://yomu.fyi/company/ramp.md)
- Author: Peyton McCullough
- Published: Sep 15, 2023
- Type: Problem & solution

Ramp describes how its machine-learning organization used Metaflow to shorten the path from prototype to production for models spanning credit risk, fraud, growth, product, and Ramp Intelligence. Its initial riskiness model exposed long vendor-managed jobs, weak logging, limited Docker support, and substantial platform friction; the model took months to build. Metaflow, with developer-experience improvements, lets teams define flows in Python, run them locally or on AWS Batch, visualize results with cards, and connect production execution to Step Functions and Airflow. Ramp chose AWS-managed infrastructure, initially using Fargate before encountering startup and resource constraints, and later built a MetaflowOperator to simplify Airflow triggering and log access. After adoption, Ramp shipped eight additional models in ten months, recorded more than 6,000 Flow runs, and reports that data scientists can largely self-service while platform engineers spend less time debugging infrastructure.


### [Zero traffic cost for Kafka consumers](https://yomu.fyi/post/zero-traffic-cost-for-kafka-consumers.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Fabrice Harbulot
- Published: Jul 7, 2023
- Type: Problem & solution

Grab's real-time data streaming platform team reduced infrastructure expenses by enabling Kafka consumers to fetch from the closest partition replica instead of partition leaders. The platform previously operated across three AWS Availability Zones with three-way replication, resulting in cross-AZ network fees that constituted half of the Kafka platform's total cost. To address this, the team performed a zero-downtime upgrade to Kafka 3.1, configured a rack-aware replica selector using AWS Availability Zone IDs, and updated consumer SDKs to populate the client rack parameter. The rollout produced a 25% drop in cross-AZ traffic within three months under steady data volumes. However, the change increased end-to-end latency by up to 500ms, created potential CPU load skews across zones, and removed graceful isolation during broker rotation maintenance.


### [Identifying vulnerabilities in GitHub Actions & AWS OIDC Configurations](https://yomu.fyi/post/identifying-vulnerabilities-in-github-actions-aws-oidc-configurations.md)
- Company: [Tinder](https://yomu.fyi/company/tinder.md)
- Author: Tinder
- Published: Apr 18, 2023
- Type: Explainer

In 2021, GitHub released OpenID Connect support for GitHub Actions to let workflows retrieve short-lived cloud session tokens instead of storing static secrets. Tinder Security Labs discovered widespread IAM role misconfigurations that allow external repositories to assume target roles and access AWS resources. The primary issue stems from IAM trust policies that authenticate the GitHub identity provider but omit strict validation on the subject claim. Researchers located exposed role identifiers via public workflow searches and confirmed that arbitrary external GitHub Actions workflows could assume them, including roles within AWS official repositories. Remediation requires configuring trust policies to restrict the audience and validate repository namespaces, while unauthorized assumptions can be detected in CloudTrail logs.


### [Launch Week 7 Community Highlights](https://yomu.fyi/post/launch-week-7-community-highlights.md)
- Company: [Supabase](https://yomu.fyi/company/supabase.md)
- Author: paul\_copplestone
- Published: Apr 14, 2023
- Type: Announcement

Supabase reports community highlights from the past three months, covering ecosystem partnerships, self-hosting, Postgres extensions, client libraries, utilities, upstream work, and contributors. New collaborations include AWS RDS work on pg\_tle and Trusted Language PL/Rust, Clickhouse bidirectional Postgres integration, LangChain vector-store and hybrid-search contributions, a Vercel and OpenAI GPT-search template, Doppler secret syncing, Redwood’s Prisma Quick Start, Dart Edge, and T3 Turbo. The update also describes self-hosting support for Logs and Edge Functions, new Digital Ocean and Stackgres entrants, and extensions including pgvector, HypoPG, pg\_tle, PGroonga v3.0, LZ4 compression, and ICU support. It records new Swift, Python, and C# client libraries, cache helpers, Firebase-to-Supabase supashim, Postgres and OrioleDB patches, and recognition for contributors, while noting more than 48,000 GitHub stars.


[Newer posts](https://yomu.fyi/topic/aws/page/7.md) · [Older posts](https://yomu.fyi/topic/aws/page/9.md)