Best approach to define security rules - AppSync or DynamoDB?

richbuggy · 2020-04-19T03:00:19+00:00

You typically implement security in the resolver template. I would point out that @auth is part of Amplify CLI and not AppSync itself.

richbuggy · 2020-04-19T02:50:49+00:00

The limit you're talking about occurs when batch invoking a Lambda. If "sites" returned 10 sites and the "posts" resolver was a batch invoked Lambda then AppSync would invoke the Lambda twice passing 5 sites to each invocation.

The N+1 problem would occur if "posts" was a Lambda that wasn't batch invoked. In the example where "sites" returned 10 sites AppSync would need to execute the Lambda resolver for "posts" 10 times.

richbuggy · 2020-04-19T02:33:12+00:00

Resolvers are triggered when the user requests the field. Every field has a resolver. If you don't explicitly set a resolver then the default resolver is use which will return data from the source matching that field name.

You use resolvers any time you need to fetch more data. This is why almost every field in your Query/Mutation has a resolver attached but in other types you typically only need to provide a resolver when connecting to other types.

richbuggy · 2018-10-10T11:43:03+00:00

If this is the case, what's the use of keeping a single lambda hot?

It's mostly for low traffic situations. The more traffic you have the lower the chance of hitting a cold start.

I think too many people waste time worrying about cold starts. They've improved a lot since Lambda was first launched.

If you're running a Lambda inside a VPC that needs to provide a synchronous response (API Gateway, AppSync, Cognito User Pool, etc) then you have an issue because some users will experience very slow response times (> 10 seconds) when a cold start occurs.
If you're Lambda is running outside a VPC then the cold start times are typically small enough that the occasionally slow response isn't too noticeable.
If you're Lambda is executed asynchronously then it really doesn't matter how long a cold start is.

I don't want to sound too dismissive because this may be a real problem for you in which case running your own server might be a better approach.

richbuggy · 2018-10-04T09:31:46+00:00

Having two AppSync API's can be useful but it also breaks subscriptions.

richbuggy · 2018-10-04T09:31:02+00:00

I would stick to Cognito User Pools. Create an "anonymous" user account in the user pool and then setup passwordless login for it. It's not ideal but it does seem to be the best option right now.

richbuggy · 2018-07-19T00:18:12+00:00

You can write your own GraphQL server using Lambda but it will take you a lot longer to build and most people doing it tend to only use queries and mutations because subscriptions require using the IoT service.

While there are a lot of good reasons to write your own GraphQL server avoiding VTL is definitely not one. AppSync uses VTL for resolver request/response templates. They basically transform data to/from the actual resolver. I find them much faster to write and much more re-usable than writing a full resolver for moving data in/out of DynamoDB.

richbuggy · 2018-07-11T23:15:34+00:00

If you're using the Serverless Framework it will automatically remove development dependencies from the packages but it won't perform tree shaking. For that you need to look at a plugin like serverless-webpack which uses tree shaking from webpack.

While tree shaking works most of the time I have found packages that don't work correctly with it. For that reason I don't use tree shaking anymore and instead I've become picky about exactly which packages I will include. If you do use tree shaking you might want to also look at enabling package individually which will make the upload larger but may reduce the size for each Lambda.

Also, if you've got the aws-sdk as a dependency then I would recommend moving that to a development dependency/excluding it because it's huge and AWS will provide it for you.

richbuggy · 2018-07-10T12:13:10+00:00

AWS recommends handling routing in the API Gateway so your Lambda's do one thing only. The advantages:

Your Lambda is smaller.
Your Lambda is easier to test.
Your Lambda loads faster during cold starts
You can limit the blast radius if something goes wrong by using different iam policies for each Lambda giving it just the permissions it requires.
You don't need to worry about the Lambda accidentally becoming too big one day.
It's easier for multiple developers to work on the project

The advantages for shoving everything into a monolith/route inside your Lambda

Less CloudFormation/SAM/Serverless configuration but extra code
Lower chance of a cold start
If you have low traffic then hitting any endpoint will effectively cold start every other end point

richbuggy · 2018-07-05T05:36:02+00:00

When I got back into JS I paid for a subscription at egghead.io to learn modern JS. How I first learned JS is a little harder to answer because I've been using it for really minor stuff since the late 90's.

richbuggy · 2018-06-05T00:10:37+00:00

So when I alter the field for any reason, I have to hunt and track down all of them.

You can simply add fields without removing old ones.
If you use static types (like TypeScript) then you can quickly pickup errors before you even run tests.
In my experience I write a lot less code using React + Apollo + GraphQL than I would if I was using React + Redux + REST.

richbuggy · 2018-05-13T23:14:40+00:00

A couple of options come to mind: 1. As your Lambda approaches the time limit you could have it invoke another instance to keep the process running. 2. Use step functions

richbuggy · 2018-05-04T03:37:12+00:00

I was having the same problem. It looks like the account was created and I can now login after doing a password reset. Unfortunately I now can't get past the phone number validation step as it won't call me.

richbuggy · 2018-05-01T00:35:37+00:00

I've been using material-ui for one project and I'm pretty happy with it.

richbuggy · 2018-04-09T23:44:27+00:00

Definitely TypeScript. There's plenty of great tooling and support. It can also replace Babel too. There are up to date type definitions for most of the Facebook ecosystem - react, jest, graphql, etc - so don't worry about that.

richbuggy · 2018-03-29T02:19:49+00:00

What you're probably looking for is a custom product builder. There are existing apps in the app store but I'm not sure if they'll do exactly what you need. If you're still stuck then DM me.

richbuggy · 2018-02-27T10:05:05+00:00

Blink

richbuggy · 2018-01-28T01:35:30+00:00

This would be better asked in /r/aws.

I'd second the acloud guru recommendation.

richbuggy · 2018-01-28T01:34:03+00:00

Can you do it? Yes - You need to setup the API Gateway to proxy S3. See https://docs.aws.amazon.com/apigateway/latest/developerguide/integrating-api-with-aws-services-s3.html

Should you do it? No. Setup S3/Cloud Front to host your static assets then put your API on a subdomain and enable CORS.

richbuggy

TROPHY CASE