cdk-nag VS serverless-java-container

Thankfully using tools like cdc-nag you can help enforce some best practices around this and enable encryption from the beginning.

cdk-nag is an open-source tool that provides automated checks for AWS CDK code and the resulting Cloudformation templates to help ensure that they adhere to security and compliance best practices.

cdk-nag: Check CDK applications or CloudFormation templates for best practices using a combination of available rule packs. Inspired by cfn_nag.

There are already useful CDK Aspects out there that are ready to be used in your CDK application. In this section I want to give you an example for one of them: One of them is cdk-nag.

In the Construct Hub the construct cdk-nag has been released. The cdk-nag construct allows you to check your CDK applications for best practices using a combination of available rule packs. Using this cdk-nag construct and use it inside your code to check upon security best practises, will eventually make your application more secure. In this article I will describe how to use the cdk-nag construct in combination with CDK.

I'm using cdk-nag and love it https://github.com/cdklabs/cdk-nag

The key dependency to make it work and translate between Spring Boot 3 (web annotation) model and AWS Lambda is the dependency to the artifact aws-serverless-java-container-springboot3 defined in the pom.xml. It's based on Serverless Java Container which natively supports API Gateway's proxy integration models for requests and responses, and we can create and inject custom models for methods that use custom mappings.

The AWS Serverless Java Container makes it easier to run Java applications written with frameworks such as Spring, Spring Boot 2 and 3, or JAX-RS/Jersey in Lambda. We have already seen that Micronaut framework also uses AWS Serverless Java Container.

Serverless has grown to mean many things and can even mean something different depending on whose cloud you are paying for. But for our team and for the purpose of this article, serverless is a way of building and running applications without having to manage the underlying infrastructure on AWS.

Read the Quick Start here: https://github.com/awslabs/aws-serverless-java-container/wiki/Quick-start---Spring-Boot3 Thanks to Mark Sailes for all of his help with this tuto

Having knowledge about microservices architectures, serverless, and related concepts is highly beneficial. This includes understanding chaos testing techniques with AWS Fault Injection Simulator.

I've heard that server providers like Amazon Web Services offer dynamic scaling serverless architecture https://aws.amazon.com/serverless/

AWS Docs - Official documentation for all things AWS serverless

Although not what I would consider 'core' cloud services, the orchestration and communication services are key to event driven development and robust application design. If you are structuring your application to take advantage of event flow, these are tools you are going to want to be familiar with, and will be instrumental in your success by saving you time, money, complexity, and management overhead. This about wraps up what I want to cover with serverless cloud services, though there is so much out there to explore. Tune in tomorrow as we start to put all of this together with best practices.*

If you're new to the application development world, API stands for Application Programming Interface, an interface that offers a 'service' of sorts for applications to consume. Google Maps, for instance, has a public API that you or I could use if we're building an application to locate all of the restaurants in our town. They surface this, and many, many other data points via documented endpoints, and we can use things like API keys to access this data. If you're a developer, chances are you will build an API at some point in your career, if not several, and you will definitely work with them. As a key building block in application development, AWS provides a few API solutions.

As an AWS Hero and a Principal Software engineer at a large Fortune 100 enterprise, I have been focused solely on serverless technologies and enablement over the last 3 years. I have spoken quite extensively about our serverless journey, what serverless means in a large enterprise, and how to be successful in a corporate setting. Everything I have learned has been through experience, on-the-job. The serverless definition I resonate with most states that serverless is event-driven, your resources scale up and down without you needing to manage them, and follows an "only pay for what you use" model. Let's break this down a bit further: