Secure EC2 Deployments from GitHub Actions Using AWS SSM, No Open Ports Needed

·2 views

Developers deploying to EC2 via GitHub Actions have traditionally relied on long-lived SSH keys, open port 22, or bastion hosts — all of which carry significant security risks. AWS Systems Manager Session Manager eliminates these risks by having the SSM Agent on the instance initiate an outbound HTTPS connection to AWS, removing the need for any inbound security group rules. Combined with EC2 Instance Connect, temporary SSH keys can be pushed to an instance for just 60 seconds, leaving nothing persistent to rotate or leak. IAM policies replace key-file-based authentication, and every session is logged in CloudTrail for full auditability. An open-source GitHub Action, ankurk91/setup-ssh-over-ssm-action, packages this entire setup and teardown process, enabling clean deployments with no stored secrets or open ports.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Next.js Four-Layer Caching Model Explained: How Each Cache Works and Why It Matters

Next.js uses four distinct caching mechanisms — request memoization, data cache, full route cache, and router cache — each operating at a different scope and lifetime. Request memoization deduplicates identical fetch calls within a single server render pass and resets once the response is sent. The data cache persists fetch responses across multiple server requests until explicitly revalidated, while the full route cache stores prerendered HTML generated at build time. The router cache retains client-side navigation payloads for 30 seconds on dynamic routes and up to 5 minutes on static ones. Treating these four layers as a single system is the root cause of stale-data bugs and performance issues in many Next.js applications.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a Daily Reminder App Needs Three States, Not Just a Boolean Flag

A developer building a self-opening morning checklist discovered that using a simple true/false boolean to track whether a reminder had been addressed created an unintended loop — closing the window without pressing the start button caused the reminder to reappear every 30 seconds. The root problem was that the boolean tracked whether the window had opened, not whether the user had actually responded to it. To fix this, the developer replaced the single flag with three distinct states: done, dismissed, and owed — where owed is simply the absence of the other two. This change also resolved two unrelated edge cases, including preventing multiple reminder windows from stacking up during late-night sessions. The open-source Windows app stores all data locally in a single JSON file with no account or server required.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds offline-first notes app with sync-ready schema and no-build landing page

A developer has released Nookly, a local-first notes app built with Flutter and SQLite that stores all data on-device with no account or cloud dependency. To future-proof the app for eventual multi-device sync, every database table is designed from the start with UUID keys, soft deletes, timestamps, and version fields — avoiding a costly rewrite later. Drag-and-drop reordering uses fractional indices so only the moved item is updated, rather than triggering cascading changes across sibling rows. Full-text search is powered by SQLite's FTS5 and kept accurate through database-level triggers rather than application code, preventing index drift. The app's landing page was shipped as a single HTML file using CDN-loaded React and Tailwind with in-browser JSX compilation, requiring no npm or bundler setup.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Java Concurrency Explained: Key Concepts from Threads to CAS and JMM

A technical guide published on DEV Community covers 40 Java concurrency and multithreading interview topics in depth. It explains the difference between processes and threads, highlighting how Java 21's virtual threads via Project Loom allow millions of lightweight threads without the overhead of platform threads. The guide details the Java Memory Model, clarifying how happens-before relationships, volatile fields, and synchronized blocks ensure visibility and ordering across threads. It also contrasts synchronized with ReentrantLock, and explains why volatile alone is insufficient for compound operations like increment, making AtomicInteger a safer choice. Additionally, it covers how modern ConcurrentHashMap achieves high concurrency through per-bin locking and lock-free reads, unlike the fully synchronized Hashtable.

0 comments Read more at DEV Community