EthanLabs
Loading amazing content...
Loading amazing content...
Thoughts on web development, technology trends, and best practices
7 posts
A raw-SDK cleanup script once deleted zero records it should have deleted, because it reimplemented entity shape independently of the real write path. The fix: dev tooling now calls the same service functions production does — with one deliberate, structurally-separate exception for state the service layer can't reach
A Cognito User Pool's immutable schema attributes hit two separate provider-level bugs — one that corrupts Pulumi's own recorded state on refresh, one that reports a successful update while silently changing nothing. Neither is fixable in application code; both needed a documented, permanent distrust of one narrow resource
An occasional orphaned user row looked like DynamoDB read-consistency lag. It was actually Lambda's own async-invocation retry — a second mechanism stacked underneath EventBridge's, firing about a minute later on the same trace ID and creating a duplicate Cognito user for a tenant already mid-deletion
Single-table DynamoDB and a generic `createDAL()` factory turned out to be the same decision made twice: push key-structure discipline out of individual developer diligence and into a structure that enforces it by construction
A base-fee-plus-seat-overage pricing model needs two Stripe subscription items, not one; webhooks confirm state changes but never decide them; and a single four-state subscription machine replaces a separate `isActive` flag that could quietly disagree with it
Instead of trusting every handler to filter by `tenantId`, InvocaCare pushes tenant isolation down to AWS IAM itself — a Lambda authorizer calls STS AssumeRole to hand each request credentials that are structurally incapable of reading another tenant's data