How Using CloudFront as an API Gateway Exposed Security and Governance Gaps on EKS

·1 views

An engineering team building a microservices-based identity platform on Amazon EKS initially routed both frontend and REST API traffic through Amazon CloudFront, believing it a natural fit since the CDN was already in use. While CloudFront successfully forwarded all required HTTP methods to the Application Load Balancer and Kubernetes Ingress, it was never designed to manage API lifecycle concerns such as consumers, stages, quotas, and authorizers. This architectural misstep meant the API origin remained publicly addressable, security policies were fragmented across multiple layers, and differentiated rate limiting for machine-to-machine clients required custom logic outside CloudFront. The revised design separates responsibilities by keeping CloudFront in front of the frontend while routing public API traffic through Amazon API Gateway, which connects privately to the EKS cluster via VPC Link. The key lesson was distinguishing between edge content distribution, which CloudFront handles well, and API governance, which requires a dedicated management layer.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developers Build Zero-Dependency Java JSON Parser in 72-Hour Hackathon

A team participating in the ZeroDepsHack 2026 hackathon built JValue, a fully functional JSON parser and serializer in Java, using no third-party libraries whatsoever. The project relied solely on the Java standard library, including hand-written recursive-descent parsing, a custom test runner, and a 15-command CLI built without any external frameworks. Developers also implemented a JDK-only file fetcher to download test corpora, replacing common tools like curl and JUnit. The team documented 12 specific substitutions where third-party libraries were replaced by standard library equivalents, honestly noting the tradeoffs involved. The exercise was intended to test whether modern Java development could function without the dependency ecosystem most projects take for granted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Code Review Test Reveals Which Tools Actually Read Your Rules Files

A developer designed a controlled experiment to determine whether AI code review tools genuinely read project-specific rule files like CLAUDE.md and AGENTS.md, or simply rely on general best practices. Two tools, CodeRabbit and Qodo, were tested against a small Cloudflare Worker API that deliberately violated two rules: one widely-known security bad practice and one obscure internal naming convention. Both tools flagged the security violation, but that test proved little since any standard scanner would catch it regardless of file access. Only Qodo successfully identified the camelCase route naming violation — a purely internal convention with no external reference — and traced its functional impact on real requests. The experiment highlights a meaningful gap in AI code review reliability when enforcing custom, repo-specific conventions at scale.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Common Myths That Blur the Line Between AI Models and Actual Servers

A technical FAQ published on DEV Community identifies five widespread misconceptions that cause developers to conflate AI language model outputs with real server-side execution. The piece clarifies that a free model provides token prediction only, with no bundled compute or server infrastructure attached. It also explains that environment variables set inside a chat or markdown code block do not affect any running process on an actual machine. The author recommends a set of shell checklists — including hostname, pwd, and export verification commands — to confirm whether a task was genuinely executed on a server rather than merely described by the model. The article was prepared as part of outreach for MonkeyCode, a platform the author uses for free model access and server resources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Ex-cameraman builds AI photo caption tool solo after spending 20 minutes per post

Marco, a 25-year TV cameraman turned photographer based in Dublin, built CAPTD to solve a personal pain point: writing captions, hashtags, and alt text for photos was taking him 20 minutes per post. Using AI-assisted development despite no prior coding experience, he created the tool over roughly six months using TanStack Start, Supabase, Google Gemini, and Vercel. CAPTD generates platform-specific content packs for nine social networks, supports ten languages, and includes features like a Creator Voice tone system and a free 28-lesson photography academy. The platform requires no signup to use its core generator, a deliberate decision by Marco to lower the barrier for new users. A major post-redesign bug silently broke multi-language output and mobile generation without triggering any errors, marking a critical challenge in the tool's development.

0 comments Read more at DEV Community