4 posts
How do you get files that must not be public into the browser? A server proxy, presigned URLs, CloudFront signed URLs, and OAC with WAF, compared along one axis: who checks access. The belief that a proxy reads the whole file was checked with a 200MB file.
Delivery-history JSON sitting in S3 is hard to query as it stands. Four options weighed on always-on infrastructure, the shape of the query cost, and freshness, and why a nightly Parquet conversion won.
How a Kubernetes pod connects to a database with no password anywhere (IRSA and rds_iam), and how the account that connects keeps its privileges minimal (owner separation and default privileges).
Where should delivery history live? The trade-offs weighed across a dedicated relational DB, a serial S3 pipeline, SNS fan-out, and a Firehose route.