Teches on Technology Enlightened

Multi-region high availability for Azure Content Understanding

Fri, 31 Jul 2026 16:00:00 +0100

Azure Content Understanding and Azure OpenAI Service are regional services. A production document-processing workflow often cannot treat a regional endpoint, its model deployments, or its analyzer definitions as a single point of failure. In this post, we discuss a highly available solution built across multiple regions to handle regional failures.

Architecture

Figure 1. Implemented regional stacks and cross-region flows.

The diagram shows two distinct planes: solid lines represent synchronous request traffic, while dashed lines represent asynchronous analyzer reconciliation. This separation addresses two related resilience challenges: routing requests to a healthy Content Understanding backend and keeping analyzer configurations consistent across regions. API Management selects a local-first backend synchronously within each available gateway, while two queue-driven Azure Functions synchronize analyzers asynchronously.

Scale Azure Databricks secure network access to Azure Data Lake Storage

Mon, 11 Dec 2023 18:00:00 +0100

Many organisations store their data in a centralised data lake on Azure Storage accounts. In this post we will look at a solution to scale the secure network access between the centralised data lake storage account and Azure Databricks workspaces VNets.

The recommended approach to achieve a scalable and secure network access to the data lake storage is to use Private Endpoints for the storage accounts.

Build intelligence in your eCommerce applications using Azure Open AI

Mon, 13 Mar 2023 15:00:00 +0100

Overview

Whenever I shop online, checking the reviews of the products is a tedious task. Sometimes the low-rated reviews are based on delivery, packaging… whereas a few high-rated reviews might be on cost but not on quality. Generally, reviews/ratings are displayed without any context which results in customers needing additional time and effort to get the most value out of it. Hence, we built this prototype using Azure Open AI to present the consolidated information from all the reviews of a product.

Optimize Azure Kubernetes Service Node Cost by Combining OnDemand and Spot VMs

Mon, 27 Feb 2023 08:00:00 +0100

Overview

While it’s possible to run the kubernetes nodes either in on-demand or spot node pools separately. We can optimize the application cost without compromising the reliability by placing the pods unevenly on spot and OnDemand VMs using the topology spread constraints. With baseline amount of pods deployed in OnDemand node pool offering reliability we can scale on spot node pool based on the load at a lower cost. In this post, we will go through step by step approach on deploying an application spread unevenly on spot and OnDemand VMs.

Serverless URL Shortener on Azure

Mon, 20 Feb 2023 08:20:00 +0100

Building an URL shortener is much easier now using the Serverless technologies in Azure. In this post, we will discuss about developing this solution.

Update: My colleague (Christopher Maneu) pointed out that we could optimize the cost by using Azure Static Web Apps (SWA) for hosting the management console. I updated the design to use SWA and added another API to check what the target URL is for the specific short URL gets resolved without visiting the site.

Serverless API Backend for xBrowserSync on Azure

Sun, 30 Oct 2022 20:00:00 +0000

I have been using xBrowserSync for two years now with my own API Backend. In this post we will look at deploying the xBrowserSync API backedn using the serverless technologies on Microsoft Azure

I used CosmosDB to persist the data, CosmosDB supports per item size of up to 2MB. Hence I set the size limit to 1.5MB and configured it to serverless mode as to pay only for the used read/write capacity units. One Azure functions have been used to handle create-bookmark, updat-bookmark, and get details from CosmosDB operations. Using Azure API Management consumption plan, I have configured APIs to invoke this Azure function.

Mirror HTTP request using ALB backed by AWS Lambda

Sun, 12 Sep 2021 10:30:00 +0000

When Gonzalo Diethelm asked me whether there is a way to echo the http request to validate Lambda@Edge functions that modifies the request by adding / updating / deleting headers? I couldn’t find something that’s already available. Hence I quickly created a simple Lambda function front-ended by Application Load Balancer to just return the response that it has recieved.

Serverless UI testing using Selenium, AWS Lambda, AWS Fargate, and AWS Developer Tools

Sat, 20 Mar 2021 08:30:00 +0000

Since the post Using AWS CodePipeline, AWS CodeBuild, and AWS Lambda for Serverless Automated UI Testing was published, things have evolved with Chrome headless and Firefox headless being supported natively. AWS Lambda now supports container images, AWS Step Functions has added support for Map state and its integration with Lambda, and AWS Fargate has enabled automating the UI testing completely using serverless technologies.

The goal of this post is to demonstrate how to use AWS Developer Tools) to build a continuous delivery pipeline that automatically deploys a test environment and runs a UI test against it. We also explain how to build a container image which includes Chromium browser, Firefox browser, Selenium, and its dependencies, which are used in Lambda and Fargate. You can accelerate the testing by launching multiple test cases in parallel using the Map state in Step Functions.

Serverless API Backend for xBrowserSync

Mon, 21 Dec 2020 16:00:00 +0000

Ever since Xmarks Sync was shutdown by LogMeIn(LastPass), I was looking for a better cross browser & cross device bookmark synchronization service. While reviewing PrivacyTools I came across xBrowserSync which looked like a better alternative.

I liked the way it has been implemented using SHA-256 hash, 250000 iterations and AES-GCM algorithm to generate the hash of the custom password provided. Additionally, xBrowserSync provides a way to configure your own API backend where you store your information. There is already an open source implementation of xBrowserSync API and a docker version available.

Running AWS Glue jobs connecting to database in VPC with Custom DNS

Thu, 06 Sep 2018 07:55:46 +0000

AWS Glue is a fully managed ETL service that makes it simple and cost-effective to categorize your data, clean it, enrich it, and move it reliably between various data stores. Glue job is the business logic that automate the extract, transform, and transfer data to different locations.

Glue job creates a Hadoop task in the backend and since it uses Hadoop ecosystem all the nodes in the cluster must be able to find using the FQDN and communicate with each other. To satisfy Hadoop DNS lookup, both forward and reverse lookups must succeed. When you use the default DHCP option set with AmazonProvidedDNS, it automatically creates the DNS record for the nodes that’s getting created in the VPC.

Using AWS CodePipeline, AWS CodeBuild, and AWS Lambda for Serverless Automated UI Testing

Sat, 23 Sep 2017 08:21:28 +0000

Testing the user interface of a web application is an important part of the development lifecycle. In this post, I’ll explain how to automate UI testing using serverless technologies, including AWS CodePipeline, AWS CodeBuild, and AWS Lambda.

I built a website for UI testing that is hosted in S3. I used Selenium to perform cross-browser UI testing on Chrome, Firefox, and PhantomJS, a headless WebKit browser with Ghost Driver, an implementation of the WebDriver Wire Protocol. I used Python to create test cases for ChromeDriver, FirefoxDriver, or PhatomJSDriver based the browser against which the test is being executed.

Resources referred to in this post, including the AWS CloudFormation template, test and status websites hosted in S3, AWS CodeBuild build specification files, AWS Lambda function, and the Python script that performs the test are available in the serverless-automated-ui-testing GitHub repository.

Create Multiple Builds from the Same Source Using Different AWS CodeBuild Build Specification Files

Wed, 02 Aug 2017 04:40:10 +0000

In June 2017, AWS CodeBuild announced you can now specify an alternate build specification file name or location in an AWS CodeBuild project.

In this post, I’ll show you how to use different build specification files in the same repository to create different builds. You’ll find the source code for this post in the GitHub repo.

Requirements

The AWS CLI must be installed and configured.

Solution Overview

I have created a C program (cbsamplelib.c) that will be used to create a shared library and another utility program (cbsampleutil.c) to use that library. I’ll use a Makefile to compile these files.

Continuous Delivery of Nested AWS CloudFormation Stacks Using AWS CodePipeline

Wed, 28 Jun 2017 08:45:47 +0000

In CodePipeline Update – Build Continuous Delivery Workflows for CloudFormation Stacks, Jeff Barr discusses infrastructure as code and how to use AWS CodePipeline for continuous delivery. In this blog post, I discuss the continuous delivery of nested CloudFormation stacks using AWS CodePipeline, with AWS CodeCommit as the source repository and AWS CodeBuild as a build and testing tool. I deploy the stacks using CloudFormation change sets following a manual approval process.

Here’s how to do it:

In AWS CodePipeline, create a pipeline with four stages:

Monitor AWS Trusted Advisor Checks

Tue, 14 Mar 2017 17:39:24 +0000

AWS Trusted Advisor is an important tool which provides more than 50 checks across four different categories Cost Optimization, Performance, Security & Fault Tolerance (at the moment of writing this post).

But I have noticed that this is not being used more extensively considering the importance of it. Hence I created couple of lambda functions which shall be configured to run on daily basis to refresh the checks and create summary of all the checks and send an email.

Scheduling automated EBS snapshots serverless using AWS Lambda

Thu, 09 Jun 2016 11:46:37 +0000

EBS snapshot as backup mechanism is a very common practice and it also has been defined in Backup and Recovery section of EC2 best practices. If you have read my another article Save AWS costs by scheduled start and stop of EC2 instances, similar approach will be used in creating Snapshots too.

Using JSON in EC2 Tags enables us to provide granular configuration details. Create an EC2 tag with name as backup and value with details containing time to take backup and retention period. Obtaining these details from Tags will enable us to configure different schedule & retention period for different EC2 instance. If no backup is needed on a particular day, that day shall be removed from the value.

Sync S3 bucket to multiple S3 buckets in different region

Fri, 27 May 2016 11:55:41 +0000

Cross-Region Replication for Amazon S3 was introduced last year which enables replicating objects from a S3 bucket to a different S3 bucket located in different region (it can be same/different AWS account). It’s one of the most sought after feature for long time but it doesn’t solve some of the scenarios as defined below.

Synchronizing to a bucket in same region.
Synchronizing to multiple destination buckets.
Object ACLs needs to be set at the source bucket hence multiple different ACLs needs to be set when copying across different accounts.
Replication doesn’t change the ownership of the objects hence bucket policy applied at the destination bucket won’t be honored.

Refer the feedback from AWS support team regarding the last point mentioned above.

Running IIS in Windows Docker Container in Amazon EC2

Sun, 15 May 2016 15:53:17 +0000

Windows Server 2016 Technical Preview 5 was released on 27th April 2016 & it’s well known by now that it supports docker with its windows server containers. Microsoft also started uploading windows server core with various application as docker images to docker hub.

I was wondering whether it’s possible to run Windows 2016 TP5 on an EC2 instance and launch a windows container inside the EC2 instance. EC2 officially supports only upto Windows 2012 R2 and I couldn’t find any 2016 AMI’s in Ireland region. Hence I decided to install Windows 2016 TP5 on local VirtualBox, upload it to S3 create AMI out of it and launch the EC2 instance.

Using AWS IoT button - Simple Example

Sat, 14 May 2016 17:32:27 +0000

Amazon did a limited release of the programmable Dash button and unsurprisingly it got sold out within a day. It’s stated in amazon.com that “We don’t know when or if this item will be back in stock.”, hence you might need to wait to get one.

I take this opportunity to write a post about how I used the AWS IoT button that I received in AWS re:Invent 2015 to show case AWS IoT to the team.

Automated Blue/Green deployment using Lambda and CloudFormation

Thu, 05 May 2016 07:42:54 +0000

Blue/Green deployment is a well-known method to deploy an application without any downtime. Performing DNS switch is one of the very common techniques to achieve this. Using DNS switch has a minor issue with DNS caching which might take some time for DNS change to be propagated.

Apart from DNS switch, AWS gives us two different options to switch the stacks. One is to have single ELB and swap it across auto-scaling group and another is switching the launch configuration of the auto-scaling group. Check the following presentation on various methods to achieve blue/green deployment in AWS.

Cracking AWS Solution Architect Professional Certification

Sun, 06 Mar 2016 20:06:20 +0000

If you had noticed, there has been a gap of few weeks since my last post. I went off the radar to prepare for AWS Certified Solution Architect Professional exam. Lots of learning and completed it successfully.

I can’t provide any details on the questions since I have signed a NDA. But I shall provide some suggestions based on my experience.

Read through the blue print and understand the weight-age for different sections.
I took this Linux Academy course. It was helpful to refresh all the topics and useful on services which I didn’t use regularly.
Quiz provided by Linux Academy was okay. I tried Cloud Academy quiz and it had lots of typo and didn’t cover all the sections.
Reading the product documentation, FAQs, whitepapers & case studies were useful.
Most of the questions had multiple requirements which covers more than 3 AWS services. Hence while answering we need to make sure that the selected answer is best suitable for all the requirements.
Some of the questions on outdated (which is expected) referring to old reservation model. But they did a good job in avoiding feature specific questions which might change.
Certain AWS services like Direct Connect, Storage Gateway, CloudFront, IAM, S3 were prominent.
Knowledge on storage concepts like RAID, iSCSI connections used in Storage Gateway, etc will be useful.
Deep knowledge on Networking especially VPC, VPN, Routing, etc would help.
Good understanding of Web Identity federation, SAML based federation, Custom identity broker & SSO to Management console is needed.
Knowledge on media streaming, download/upload options, performance and cost benefits using CloudFront would be required.
You might already know that the questions & answers are lengthy. Many questions have at least two correct answers and identifying the best answer was really tricky.
72 questions in 170 minutes looks achievable and I had 25 minutes to spare after reviewing all the questions which I marked for review.
Don’t miss to take the practice exam (it costs $40) and it will help you to understand your area of strength and weakness.
Take a practice exam after you complete your preparation and before booking the exam. Based on the result you shall book or study deeply on the sections that you need more attention.
Don’t take the practice exam multiple times since the questions will be same during all the attempts of practice exam (you shall find this detail in fine prints when you try to re-book for practice exam).

I would say all the effort and money that you spend on this certification is worth it.

Installing Let’s Encrypt - Free & Open TLS certificate

Sun, 20 Dec 2015 09:51:35 +0000

Let’s Encrypt is a free and open certificate authority managed by a public benefit organization called ISRG which concentrates on the security communication over the Internet. There are many technology companies like Mozilla, Akamai, EFF, Cisco, IdenTrust, Facebook, etc are sponsors and the platinum sponsors have a seat in their Technical Advisory Board.

It uses Automated Certificate Management Environment (ACME) protocol to enable communication between the certification authority and the web server to which the certificate is issued. Let’s encrypt uses ACME to validate the domain Server Name Indication. ACME protocol has been submitted as draft to IETF for formal approval process to be an RFC.

Sending response back to CFN custom resource from python Lambda function

Sun, 20 Dec 2015 06:00:56 +0000

CloudFormation uses a pre-signed S3 URL to receive the response back from the custom resources managed by it. There are few blue prints available for Node.js Lambda custom resources but nothing available for python yet. Hence I created this simple function which shall be used to send the response back to CFN custom resource by performing PUT request to the pre-signed S3 URL.

import json
import requests

def lambda_handler(event, context):
    responseStatus = 'SUCCESS'
    responseData = {}
    if event['RequestType'] == 'Delete':
        sendResponse(event, context, responseStatus, responseData)

    responseData = {'Success': 'Test Passed.'}
    sendResponse(event, context, responseStatus, responseData)

def sendResponse(event, context, responseStatus, responseData):
    responseBody = {'Status': responseStatus,
                    'Reason': 'See the details in CloudWatch Log Stream: ' + context.log_stream_name,
                    'PhysicalResourceId': context.log_stream_name,
                    'StackId': event['StackId'],
                    'RequestId': event['RequestId'],
                    'LogicalResourceId': event['LogicalResourceId'],
                    'Data': responseData}
    print 'RESPONSE BODY:n' + json.dumps(responseBody)
    try:
        req = requests.put(event['ResponseURL'], data=json.dumps(responseBody))
        if req.status_code != 200:
            print req.text
            raise Exception('Recieved non 200 response while sending response to CFN.')
        return
    except requests.exceptions.RequestException as e:
        print e
        raise

if __name__ == '__main__':
    lambda_handler('event', 'handler')

I’m using json module to form the response body, json module is available by default in the Lambda container. Whereas the requests module which I use to perform the http PUT request needs to be packaged along with the python script.

Continuous Integration - Manage shared resources across accounts automatically

Mon, 07 Dec 2015 18:28:16 +0000

I prefer creating the base AMI using packer; RDS snapshot using a Jenkins job which get triggered whenever there is a change in the database schema in the SCM. In case of installers, binaries, etc. it would be best to store them in a single S3 bucket.

In all the above mentioned scenarios I prefer to share those resources to a 3rd party AWS account and remove the share when not needed. Automating this would be easy to handle add/remove permissions, hence I decided to hold the sharing details in a JSON file in the SCM. Changes to that file will trigger a Jenkins job which will invoke a Lambda function which in turn will share the resources based on the values in the JSON file.

CloudFormation parameters grouping and labelling

Sun, 06 Dec 2015 07:16:52 +0000

Last week AWS enhanced CloudFormation by adding new services like AWS CodePipeline, AWS Config, AWS KMS and few more; default stack limit also has been increased from 20 to 200. Among other new features they also have introduced this small but useful parameters grouping and labelling feature.

Earlier all the parameters in a CFN template get listed in alphabetical order based on the logical name of the parameter. Also the parameters logical name is restricted to alphanumeric characters hence it causes some restrictions.

Executing Ruby code in AWS Lambda

Sun, 29 Nov 2015 18:41:59 +0000

AWS Lambda supports only Java, JavaScript & Python at the time of writing this post. I was wondering whether I can exploit the Lambda to execute chef’s knife commands on it since Lambda runs on a Linux container. Using simple python function I have identified that the code of the Lambda function gets copied to /var/task and executed from there.

I decided to custom build ruby as embedded platform similar to how chef-client or chefdk are distributed. My requirement is to execute knife commands and its uses embedded ruby version 2.1.0, hence I downloaded the source archive that specific version.

Automated cross account DNS management through CFN and API access through API gateway

Fri, 27 Nov 2015 09:57:13 +0000

It’s a general best practice to manage all DNS entries in Route53 in a centralized AWS account. In that case it is difficult to automate the DNS record creation/deletion based on resources created in another AWS account using CloudFormation. CloudFormation doesn’t yet have the capability to create resources in a different AWS account.

Combining IAM role delegation, AWS Lambda & CFN Custom resources provides us a solution. I have extended the same solution by exposing the Lambda function through API gateway which provides a powerful mechanism. The illustration give below explains the solution.

Obtain AMI Id from name to be used in CFN

Sun, 22 Nov 2015 17:41:24 +0000

In most cases we create custom AMI’s for various reasons like OS hardening, installing and configuring additional software, etc. If you use single AWS account to create the AMI’s and share it with other AWS accounts and use that as part of CloudFormation template, it is required to pass the new AMI Id every time.

AWS Lambda comes handy for easy and elegant solution to get the latest AMI Id based on the AMI name and owner.

Save AWS costs by scheduled start and stop of EC2 instances

Sun, 15 Nov 2015 14:56:57 +0000

Most of the AWS resources are billed on per-hour basis which provides us an opportunity to save cost based on the usage pattern. Especially in case of Dev/Test environment, we need them only during the working days and working hours.

By using AWS Lambda function (python) in combination with EC2 instance tags, scheduled start or stop can be achieved with few lines of code.

Advantages of using AWS Lambda:

For 128MB memory we get 3,200,000 seconds free tier usage per month in AWS Lambda which will be more than enough for this function.
IAM role will be associated with the Lambda function which will be used to perform the required task and no separate keys need to be configured.

I used a tag with name as schedule & JSON string for tag value using which I could define the day and time when it needs to be started or stopped.

Best editor for AWS CloudFormation template (JSON)

Fri, 06 Nov 2015 21:56:03 +0000

AWS CloudFormation template is a way to describe the AWS resources that can be created/updated/deleted and it’s in JSON format. Like many other programming languages most of the editors/IDE don’t have proper syntax highlighting for JSON.

For a long time I was using notepad++ and the built-in Javascript syntax highlighting which doesn’t provide much granular highlighting. I was looking for a much better editor and finally found Atom, the most powerful editor by GitHub. It provides the ability to customize almost everything in it. It also can be extended using huge list of packages and themes.