A note on dates: this post was written in 2020 using Terraform 0.12 and the nodejs12.x Lambda runtime. The architecture still holds up well, but if you’re following along today, check the current AWS provider docs and use a supported Lambda runtime and Terraform version. In particular, the aws_s3_bucket resource has since been split into smaller resources (aws_s3_bucket_acl, aws_s3_bucket_logging, aws_s3_bucket_website_configuration and so on).

Recently I had the chance to create a static website using S3 and CloudFront. I used Hugo as the framework for content management and Terraform to provision the infrastructure. There were a few interesting challenges, but in the end it worked out well.

In this talk, Chris Munns walks through building APIs with Amazon API Gateway - covering how it fits into a serverless architecture, the design choices you’ll face, and how to operate APIs in production. A solid primer if you’re putting an API Gateway in front of Lambda or your own backends.

In this talk, Paavan Mistry explains how to encrypt Kubernetes secrets at rest in etcd on Amazon EKS. By default, Kubernetes stores secrets only base64-encoded - not encrypted - so anyone who gains access to the API server or to etcd can read them in the clear. The talk shows how to use AWS KMS envelope encryption to protect secrets at rest, which is an easy win for anyone running EKS in production.