vpc

Before building an internal service layer, decide whether you need one: what it costs per call, the volume where VPC Lattice wins, and when direct invoke still beats it.

aws · aws-cdk · lambda +4

A private REST API structurally cannot carry gRPC, and every AWS surface that speaks gRPC excludes Lambda targets. What to keep from gRPC, and what to drop.

aws · aws-cdk · lambda +4

The private REST API, the resource policy that switches it on, per-route AWS_IAM grants, the two CDK stacks, and signing the call from a Node 22 Lambda.

aws · aws-cdk · lambda +4

SigV4 proves which service is calling and nothing about which user it is for. How to propagate a verified subject, and what the transport actually encrypts.

aws · aws-cdk · lambda +4

Same-account, the resource policy and the caller's identity policy are an OR. Cross-account they become an AND, and silence denies. What that changes in the perimeter.

aws · aws-cdk · lambda +4

API Gateway shares one throttle bucket with your front door, never retries a Lambda integration, and cannot see loops through itself. What you have to rebuild.

aws · aws-cdk · lambda +4

The access log already names the caller, route, and latency. Per-route metrics are not free, the user token needs masking, and AWS is switching off its own mesh.

aws · aws-cdk · lambda +4

Advanced AWS Lambda patterns and cost optimization: Lambda Layers, VPC configuration, cross-account execution, and architectural decisions.

lambda · serverless · cost-optimization +5

Master DynamoDB migrations, environment variable management, secrets handling, and VPC configurations when moving from Serverless Framework to AWS CDK.

aws · aws-cdk · dynamodb +4