How to Serve Private Assets - Proxy, presigned URL, CloudFront, WAF
Private files in the browser: proxy, presigned URL, CloudFront signed URL, and OAC with WAF, compared by who checks access. A 200MB file tests the proxy myth.
aws
4 posts
Running a Notification System with BullMQ, Part 4 - How to Read the History You Stored
Delivery-history JSON in S3 is hard to query. Four options on infrastructure, query cost, and freshness, and why nightly Parquet conversion won.
Passwordless DB Access and Least Privilege - IRSA, rds_iam, ALTER DEFAULT PRIVILEGES
A Kubernetes pod connects to a database with no password via IRSA and rds_iam. The account stays least privilege with a separate owner and default privileges.
Running a Notification System with BullMQ, Part 3 - Where to Store Delivery History
Where should delivery history live? The trade-offs weighed across a dedicated relational DB, a serial S3 pipeline, SNS fan-out, and a Firehose route.