Solution Insights | Solutions Architecture | Cloud Modernization | GenAI | LLM

REST API Security | AWS API Gateway | Microservices Problem Statement We built a web application and some APIs for core functionalities of the application hosted in AWS Public Cloud. This is an internal application, and the API endpoints should be private, whereas the APIs are resolved outside the Enterprise network with the default endpoint generated in API Gateway. Hence, there is a need for a solution to set the API private. Impact Analysis The Web application is hosted in S3 as static hosting. The S3 bucket is set to private with the VPC-Endpoint policy as per the Client’s infrastructure standards. As per the current design, the application connects via an API Gateway and an internal ALB to the Java Microservices hosted in ECS containers in a private VPC. Current Integration Flow: Web client → React App (S3) → API Gateway → Internal ALB → ECS (Java Services). The current design uses AWS API Gateway with HTTP integration, which is public. Hence, we thought simply switching the integ...

Improving code quality and maintaining consistency across the application components is a crucial aspect of software development. In this post let’s look at some of the key engineering best practices to help produce high-quality code. Static code analyzer Scan your code to identify potential bugs, bad coding style, security vulnerabilities, Code-smell and to ensure that the code adheres to industry standards and coding conventions.   SonarQube is a popular static code analysis tool that brings default rulesets of industry guidelines. Enterprise specific rules can be defined for each tech stack. For example: Cognitive Complexity < 15 and Cyclomatic Complexity < 10 are ideal target metrics according to industry standards. That means your code has high readability (smaller functions, well structured) and less complexity (less number of decision logic). Ref: https://docs.sonarqube.org/latest/analyzing-source-code/overview/ Test-Driven-Development Write and execute automated unit ...

Any server-side applications built in NodeJS for clients, that have often to be hosted on the client's servers. It also opens up the possibility of easy reverse-engineering or reuse of our apps without our awareness. So, how do we protect the Node.js code against stealing business logic, and reusing them somewhere else? Node.js is a cross-platform JavaScript runtime that provides a light, scalable and open-source server environment for building real-time web applications at the enterprise level also. Overall it increases the efficiency of the development process as it fills the gap between frontend and backend applications. However, the Javascript can’t be protected and so protecting the Node.js deliverables from piracy can be challenging too. I do not see any industry-proven direct solution for that, but there are some best practices (workarounds!) that can be followed to increase the security of your code to an extent. Here is the list of techniques found on the Internet for our...

Choosing right technology stack! A vital part of creating solution architecture is the selection of technologies for each of the components. As a solution architect, when choosing a technology, you should look at it from an architecture and development perspective as well to build resilence with agile business solutions. One of the hardest things about technology selection is that for every problem there are several technology options and a lot of information available about them. Fortunately, selecting the right technology is not that tricky and you can quickly trim the options down by considering some of the key factors that we are going to see in this post.  This article is of my thought process, and it's a checklist of non-negotiable considerations for choosing a technology stack or a COTS product based on my hands-on experience in designing and executing enterprise scale applications/services, but the list is not limited to, and does not recommend any specific technology/plat...