Wilmost-Tech

Beyond Servers: How Serverless Computing is Revolutionizing App Development

wilmo martinez — Thu, 25 Apr 2024 00:00:19 GMT

Introduction

In the ever-evolving landscape of technology, serverless computing has emerged as a game-changer, offering a paradigm shift in how backend services are provisioned and managed. Imagine writing and deploying code without the burden of worrying about the underlying infrastructure - that's the promise of serverless computing.

At its core, serverless computing allows developers to focus solely on writing code, without the hassle of managing servers or provisioning resources. In essence, it's like having a virtual team of infrastructure experts at your disposal, handling the heavy lifting behind the scenes.

The era of needing to own physical hardware to run servers is over, which used to be a big, expensive hassle for anyone wanting to create a website. Enter cloud computing, where fixed units of server space could be rented remotely. However, this traditional model often led to over-provisioning, as developers would err on the side of caution to prevent exceeding monthly limits, resulting in wasted resources.

This is where serverless computing shines. With serverless providers, companies are charged based on actual usage, rather than reserving and paying for a fixed amount of bandwidth or servers. The beauty lies in its auto-scaling nature, where resources dynamically scale up or down in response to demand, ensuring optimal performance and cost-efficiency.

What is Serverless Computing

Serverless is a cloud-native development model that allows developers to build and run applications without having to manage servers.

Despite its name, physical servers are still in the equation, but developers are blissfully unaware of their existence, allowing them to focus on building great products rather than managing infrastructure.

Under a serverless model, a cloud provider runs physical servers and dynamically allocates their resources on behalf of users who can deploy code straight into production.

How Serverless Works

Serverless architecture relies on functions, or more specifically functions-as-a-service (FaaS). It is a service model that allows developers to run code directly in the cloud without the need to build packages or maintain any infrastructure. Applications are broken up into individual functions that can be invoked and scaled individually.

Use Cases for Serverless Computing

Serverless architecture is ideal for asynchronous, stateless apps that can be started instantaneously.

Trigger-based tasks.
Building RESTful APIs.
Asynchronous processing.
Stream processing workloads.

Pros and cons of serverless

Pros

Lower cost: Basically you pay for the execution of your function.
Simplified scalability: Since your are not in charge of infrastructure provisioning.
Improve developer productivity : Developers have more time to innovate and optimize their application functionalities and business logic.

Cons

Testing and debugging: Debugging is more complicated because developers do not have visibility into backend processes, and because the application is broken up into separate, smaller functions.
Performance Impact: other of the downsides of using cloud computing is that processing times can vary widely between runs as the code may be deployed on a different server.
Vendor Lock-In: Setting up a serverless architecture with one vendor can make it difficult to switch vendors if necessary, especially since each vendor offers slightly different features and workflows.

List of Serverless Providers

AWS Lambda
Azure Functions
Google Cloud Functions(GCF)
IMB cloud Functions
Cloudflare Workers

Conclusion

As we wrap up our exploration of serverless computing, one thing is abundantly clear: the future of technology is here, and it's serverless. Gone are the days of fretting over infrastructure management and server maintenance; with serverless computing, developers are liberated to focus their energy where it truly matters - crafting innovative solutions and driving business growth.

By embracing serverless architecture, organizations can unlock a world of possibilities, from seamlessly handling fluctuating workloads to optimizing costs and resources with unparalleled efficiency.

Linux Commands

wilmo martinez — Mon, 04 Dec 2023 11:00:12 GMT

In the dynamic world of DevOps, where speed, automation, and efficiency reign supreme, mastering the command line is an indispensable skill. Linux, with its powerful command-line interface, is at the heart of many DevOps workflows. In this blog post, we'll explore essential Linux commands that every DevOps professional should have in their toolkit.

File and Directory Operations:

ls - List directory contents.
```
 ls -l /path/to/directory
```
cd - Change directory.
```
 cd /path/to/directory
```
pwd - Print working directory.
```
 pwd
```
touch - Create an empty file.
```
 touch file.txt
```
cp - Copy files or directories.
```
 cp sourcefile.txt destination/
```
mv - Move or rename files or directories.
```
 mv oldfile.txt newfile.txt
```
rm - Remove files or directories.
```
 rm file.txt
```
find - Search for files and directories.
```
 find /path/to/search -name "file.txt"
```
du - Show directory space usage.
```
 du -sh /path/to/directory
```
df - Display disk space usage.
```
df -h
```

Process Management:

ps - Show information about running processes.
```
 ps aux
```
top - Monitor system activity and processes in real-time.
```
 top
```
kill - Terminate processes by process ID (PID).
```
 kill PID
```
pkill - Terminate processes by name.
```
 pkill process_name
```
pgrep - List processes by name.
```
 pgrep process_name
```
htop - Interactive process viewer.
```
 htop
```
nice - Run a command with a specified priority.
```
 nice -n 10 myprocess
```
renice - Change the priority of a running process.
```
 renice -n 15 -p PID
```
systemctl - Manage system services and units.
```
 systemctl status service_name
```
journalctl - View and filter system logs.
```
journalctl -xe
```

Network and Connectivity:

ping - Check network connectivity to a host.
```
 ping google.com
```
ifconfig/ip - Display and configure network interfaces.
```
 ifconfig
```
netstat - Network statistics and connection information.
```
 netstat -tuln
```
ssh - Securely connect to remote servers.
```
 ssh user@remote_server
```
scp - Securely copy files between hosts.
```
 scp file.txt user@remote_server:/path
```
curl - Transfer data with URLs.
```
 curl 
```
ss - Display socket statistics.
```
 ss -tuln
```
nmap - Network exploration tool and security scanner.
```
 nmap -p 80 example.com
```
traceroute - Trace the route packets take to a network host.
```
 traceroute google.com
```

iptables - Configure firewall rules.

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Package Management:

apt-get/apt - Package management on Debian/Ubuntu.
```
 sudo apt-get install package_name
```
yum/dnf - Package management on Red Hat/CentOS.
```
 sudo yum install package_name
```
dnf - Improved package management for Fedora.
```
 sudo dnf install package_name
```
zypper - Package management on openSUSE.
```
 sudo zypper install package_name
```
dpkg - Debian package management (low-level).
```
 dpkg -i package.deb
```
rpm - Red Hat Package Manager (low-level).
```
 rpm -i package.rpm
```
apt-cache search - Search for packages on Debian-based systems.
```
 apt-cache search search_term
```
yum search/dnf search - Search for packages on Red Hat-based systems.
```
 yum search search_term
```
rpm -qa - List all installed RPM packages.
```
 rpm -qa
```
pip - Package installer for Python.
```
pip install package_name
```

User and Permission Management:

useradd - Add a new user.
```
 sudo useradd new_user
```
passwd - Change user password.
```
 sudo passwd username
```
usermod - Modify user attributes.
```
 sudo usermod -aG group_name username
```
userdel - Delete a user account.
```
 sudo userdel username
```
chown - Change file/folder ownership.
```
 sudo chown user:group file.txt
```
chmod - Change file/folder permissions.
```
 chmod 644 file.txt
```
visudo - Edit the sudoers file.
```
 sudo visudo
```
groups - Show groups a user belongs to.
```
 groups username
```
id - Display user and group information.
```
 id username
```
setfacl/getfacl - Manage access control lists.
```
setfacl -m u:username:rw file.txt
```

System Monitoring and Performance:

free - Display system memory usage.
```
 free -m
```
uptime - Show system uptime and load averages.
```
 uptime
```
vmstat - Virtual memory statistics.
```
 vmstat 1
```
iostat - Input/output statistics.
```
 iostat -d 1
```
sar - Collect and report system activity information.
```
 sar -u 1 5
```
top/htop - Real-time system resource monitoring.
```
 top
```
ps - View process information and resource usage.
```
 ps aux
```
lsof - List open files and their associated processes.
```
 lsof
```
iotop - Monitor I/O usage by processes.
```
 iotop
```
atop - Advanced performance monitor.
```
 atop
```

Backup and Restore:

tar - Create and extract tar archives.

 tar -cvzf backup.tar.gz /path/to/backup

rsync - Synchronize files and directories.
```
 rsync -av source/ destination/
```
dd - Copy and convert files.
```
 dd if=input_file of=output_file
```
dump - Create filesystem backups.
```
 dump -0u -f /path/to/backup.dump /dev/sdX
```
restore - Restore files from backups.
```
 restore -r -f /path/to/backup.dump
```
cron - Schedule automated backups.
```
 crontab -e
```
at - Schedule one-time tasks.
```
 at now + 1 hour
```
rsnapshot - Backup tool using rsync and hard links.
```
 rsnapshot daily
```

borg - Deduplicating backup program.

 borg create backup::backupname /path/to/backup

duplicity - Encrypted bandwidth-efficient backup.

 duplicity /source ssh://user@backup_server/destination

Log and Troubleshooting:

tail - Display the last part of a file (commonly used with log files).
```
 tail -f /var/log/syslog
```
grep - Search for patterns in files.
```
 grep "error" /var/log/application.log
```
journalctl - Query the systemd journal.
```
 journalctl -u service_name
```
dmesg - Display kernel ring buffer messages.
```
 dmesg | grep error
```
strace - Trace system calls and signals.
```
 strace -p PID
```
ltrace - Library call tracer.
```
 ltrace command
```
nc/netcat - Network utility for debugging and data transfer.
```
 nc -zv host port
```
tcpdump - Network packet analyzer.
```
 tcpdump -i eth0 port 80
```
ss - Socket statistics.
```
 ss -tuln
```
watch - Execute a program periodically and display the output.
```
 watch -n 1 command_to_watch
```

Adding HTTP Security Headers Using Lambda@Edge.

wilmo martinez — Tue, 21 Nov 2023 12:00:10 GMT

In the previous section, we've got the basics down on Lambda@Edge and web security headers. Now, let's roll up our sleeves and learn how to set up a Lambda function that'll give your web defenses a rock-solid boost. In Part II, we'll walk you through deploying a Lambda@Edge to shield your web apps from the latest threats and vulnerabilities.

Security inspection

The first step is to check the status of our website. We going to use https://observatory.mozilla.org/ to scan our domain.

for this demo, I will use my domain wilmomartinez.com but replace this domain name with your own.

The following is the result of the scanning.

Create a Lambda Function

Lets create the lambda function that would add the security headers to the responses from the origin in our CloudFront distribution.

In the AWS Lambda console go to functions, click create function and select Author from scratch. In the create function session will specify the following:

Field	Value
Name	lambda-edge-security-headers
Runtime	Node.js 18.x
Role	Chose an existing role
Existing role	existing role

Then click the create function button.

Write function code

I used the following code for the lambda function. It basically sets Strict-Transport-Security, Content-Security-Policy, X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy headers, then returns the updated response that include the security headers.

'use strict';

export const handler = async (event, context, callback) => {
    console.log('Event: ', JSON.stringify(event, null, 2));

    const response = event.Records[0].cf.response;

    response.headers['strict-transport-security'] = [{ value: 'max-age=31536000; includeSubDomains' }];
    response.headers['content-security-policy'] = [{key: 'Content-Security-Policy', value: "default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'"}]; 
    response.headers['x-xss-protection'] = [{ value: '1; mode=block' }];
    response.headers['x-content-type-options'] = [{ value: 'nosniff' }];
    response.headers['x-frame-options'] = [{ value: 'DENY' }]; 
    response.headers['Referrer-Policy'] = [{ value: 'strict-origin' }];  

    return response;
};

See more about security headers:

Test the function

It is highly recommended to test if our functions execute successfully and return the expected response before proceeding with the association with CloudFront. To do that we are going to take advantage of the test invoke function in the Lambda console.

Click the test, and you will be prompted with the window to configure your test event. In this case we will use the CloudFront Modify Response Header template. Select invoke

Deploy lambda

once we confirm that our lambda works as expected, now is time to deploy.

In order to deploying a function to Lambda@Edge we need to complete to process:

Create a function version
Associate the function version with the CloudFront distribution by selecting an applicable Cache Behavior and an event trigger type (viewer request, viewer response, origin request or origin response).

We can do both at once by selecting in Actions the option Deploy to Lambda@Edge

Set the trigger properties as shown below and click Deploy

After that, we will see the message that both, lambda version and CloudFront trigger has bee successfully created.

Validate the security headers

Lets check the header response form our Cloudflare distribution now.

curl --head https://

Rerun inspection

Lets rescan our domain.

https://observatory.mozilla.org/. Now we have a A+ score

Conclusion

Enhancing security through Lambda@Edge involves strategically integrating security headers into the origin response trigger of a CloudFront distribution behavior. In this demonstration, We've gone through the process of creating a Lambda@Edge function, associating it with a CloudFront distribution trigger, and verifying the effectiveness while actively monitoring the results. While this demo shows what Lambda@Edge can do, there's a lot more it can offer for coming up with clever and flexible ways to boost and strengthen security.

Adding HTTP Security Headers Using Lambda@Edge.

wilmo martinez — Tue, 31 Oct 2023 12:00:10 GMT

Security is critical for web applications as they often handle sensitive user data and transactions. Security headers play a crucial role in safeguarding web applications by mitigating common vulnerabilities. AWS Lambda@Edge facilitates the implementation of these security headers by allowing us to execute custom code at the edge locations of the AWS CloudFront CDN.

What are security headers

HTTP security headers are a subset of HTTP headers that are related specifically to security. They are exchanged between a client (usually a web browser) and a server to specify the security details of HTTP communication.

The most important HTTP security headers

Content-Security-Policy: is a crucial security header that helps prevent cross-site scripting (XSS) and data injection attacks. It defines which resources (e.g., scripts, images, styles) can be loaded and executed on a web page. It limits the sources from which content can be loaded, enhancing security.
Strict-Transport-Security(HSTS): HSTS instructs web browsers to enforce secure HTTPS connections for a specified duration, protecting users from potential man-in-the-middle attacks and ensuring all communication with your website is encrypted.
X-Content-Type-Options: This header prevents browsers from interpreting files as a different MIME type than declared, which can help mitigate attacks like MIME sniffing. Setting it to "nosniff" enhances security by reducing the risk of content-type confusion.
XFrame-Options: X-Frame-Options prevents your web pages from being embedded in frames or iframes on other websites. This guards against clickjacking attacks, where attackers attempt to trick users into performing actions without their knowledge.
Referrer-Policy: Referrer-Policy controls what information is included in the HTTP Referer header when a user clicks on a link. This can help protect user privacy and limit the exposure of sensitive information.
X-XSS-Protection: This header is designed to block or sanitize potential cross-site scripting (XSS) attacks in the browser. Enabling this header helps protect users by preventing malicious scripts from executing.

What is lambda edge how it can help us?

Lambda@Edge provides the ability to execute a Lambda function at an Amazon CloudFront Edge Location. This capability enables intelligent processing of HTTP requests at locations that are close (for latency) to your customers. You can run a Lambda@Edge function in response to four different CloudFront events.

Some of the use cases :

Dynamic Content Delivery
Security and Compliance
Real-time Image Optimization
Bot Detection and Mitigation
User Authentication and Authorization

How it works?

The viewer navigates to the website.
Before CloudFront serves content from the cache it will trigger any Lambda function associated with the Viewer Request trigger for that behavior.
CloudFront serves content from the cache if available, otherwise, it goes to step
Only after CloudFront cache ‘Miss’, Origin Request trigger is fired for that behavior.
S3 Origin returns content.
After content is returned from S3 but before being cached in CloudFront, Origin Response trigger is fired.
After content is cached in CloudFront, Viewer Response trigger is fired and is the final step before the viewer receives content.
Viewer receives content.

Conclusion

In this section, we covered the essentials of Lambda@Edge and web security headers. In the second part of this article, We will explore the practical aspects of implementing a Lambda function to improve your online security.

Cloud Resume Challenge

wilmo martinez — Thu, 21 Sep 2023 12:00:12 GMT

What is the cloud resume challenge

The Cloud Resume Challenge is a multiple-step resume project that helps build and demonstrate fundamental skills for pursuing a career in the Cloud. The project was published by Forrest Brazeal.

About me

Before I got into technology, I had a background in electronics and worked as a customer service representative in a call center for several years, in addition to serving as NOC technician in a telecom company.

I had the opportunity to work as NOC technician in a data center, and that experience changed my life because it introduced me to the world of technology. I started to learn about cloud technologies and eventually acquired a set of tools like Python, Linux, cloud computing, cybersecurity, Docker, Kubernetes, and the list is still growing

Why I took it?

Get practice (working with services that I haven't worked before)
Build something functional from scratch
Learn about serverless architecture
Prove myself that I will be able to make it

Why should you do it too?

If you are just starting in the cloud or just want to practice your skills, this challenge is a good point to start. The following are some of the reasons:

Get hands-on experience in the cloud
understand how services interact with each other
Get a better understanding of how web services work
Get confidence
Build your portfolio

The process

The Challenge is broken up into 5 Chunks:

Chunk 0. Certification Prep
Chunk 1. Building the front-end
Chunk 2. Building the API
Chunk 3. Front-end/back-end integration
Chunk 4. Automation (IaC, CI/CD)

The Challenge involved creating an HTML resume and hosting it as a static website on an S3 bucket, implementing HTTPS for security, setting up a custom DNS domain name connected to a CDN for optimized speed and performance, coding in Python to track visitor counts, establishing a database for visitor data storage, scripting in JavaScript to retrieve the count via an API gateway, deploying the website through a CI/CD pipeline from a version-controlled repository, and configuring all resources using Infrastructure as Code (IaC) on AWS.

AWS services that I use: S3, ACM, CloudFront, Cloudformation, Rout53, Apigateway, Dynamodb, Lambda functions

Conclusion

The following quote became a reality at every stage of the process.

The work will teach you how to do it.

Don't get discouraged by what you don't know yet; just start, and commit to it, and you will learn a lot.

You can check my finished version: https://wilmomartinez.com