Amazon Web Services · Associate
AWS Certified Solutions Architect - Associate
If the function takes longer than the visibility timeout, the message becomes visible again and another invocation picks it up while the first is still processing: guaranteed duplicates. AWS recommends a visibility timeout ≥ 6× the function timeout. The module computes and validates it.
When moving a message to the DLQ, SQS keeps the original enqueue timestamp (in FIFO it resets). If the DLQ has the same retention as the source queue, messages can vanish from the DLQ almost immediately. Set the DLQ retention longer than the source (the module uses the maximum, 14 days).
scaling_config.maximum_concurrency limits how many concurrent instances of the function the queue can invoke. It's an event source mapping setting, independent of the function's reserved concurrency and free of charge, and it keeps one queue from using all of the reserved concurrency or the account's concurrency quota. Note: the reserved concurrency must be greater than or equal to the sum of the maximums of all the function's event sources; otherwise Lambda might throttle your messages.
GitHub's issuer is the same for every organization: without scoping sub, any GitHub repository could assume your role. That's why IAM rejects creating or updating a trust policy for that provider when the sub (or job_workflow_ref) condition is missing or is just a wildcard. But "repo:*" or "repo:my-org/*" pass validation. The real boundary is yours to set: this module uses StringEquals with one sub per environment.
AssumeRoleWithWebIdentity grants 3600 s by default; you can request up to the role's MaxSessionDuration (12 h max), and asking for more makes the call fail. If you assume another role from it (role chaining, common in multi-account), the session is capped at 1 hour. A long apply that runs past the limit fails mid-way with a half-written state.
Route 53 Resolver charges per ENI per hour, plus queries, and each endpoint needs at least two IPs in different AZs. Inbound plus outbound is four ENIs billing around the clock even with zero queries. In GCP the inbound policy and forwarding zones have no hourly charge. With several accounts, centralize the endpoints in the hub and share the rules with RAM instead of repeating them.
For the VPC Resolver to resolve inbound DNS queries using the records in a private hosted zone, the zone must be associated with the VPC where you created the inbound endpoint.
S3 queues expirations and processes them asynchronously: anywhere from days to weeks can pass between the expiration date and the actual deletion. You're not charged for the expiration or for the storage time of an object that has already expired.
With versioning on, the Expiration action only adds a delete marker and the version becomes noncurrent, which is still billed. You also need NoncurrentVersionExpiration (and to clean orphaned delete markers). This pattern leaves the bucket unversioned on purpose: the TTL is the desired behavior.
S3 keeps the parts of a multipart upload until you complete or stop it, and their storage is billed the whole time. Always add an AbortIncompleteMultipartUpload rule: aborting the upload deletes the parts.
By default, Object Ownership is BucketOwnerEnforced and all ACLs are disabled. AWS announced that, starting in April 2023, S3 would enable Block Public Access and disable ACLs on all new buckets, with no change for existing ones. Still declare them in IaC: declaring the state prevents drift if someone edits them in the console.
It's a route table entry with no hourly or per-GB charge, which is why it's the default for S3. But it's not reachable from on-premises (VPN/Direct Connect) or from another region. For those cases you need an Interface Endpoint, which is billed hourly per AZ and is the real equivalent of Azure Private Endpoint.
An explicit Deny beats any Allow, including the admin's. If the policy denies all s3:* outside the endpoint, the console and the CI pipeline (outside the VPC) lose access, and you can end up unable to edit the bucket policy itself. This module limits the Deny to object operations and lets you exclude break-glass principals via aws:PrincipalArn.
Enabling IAM auth on the instance doesn't create any user. You must run CREATE USER app; GRANT rds_iam TO app; plus table GRANTs. In PostgreSQL, for a user with rds_iam (including master) IAM auth takes precedence over the password: don't grant it to master if you need it as break-glass.
The token expires after 15 minutes and is used only to authenticate: it doesn't affect the session once established, but if you try to connect with an expired token, the connection is rejected.
To pull the image without internet egress, the task needs ECR (api and dkr) interface endpoints, plus the S3 gateway endpoint (where ECR stores layers). If it uses the awslogs log driver, it also needs the CloudWatch Logs interface endpoint. Each interface endpoint is billed hourly per AZ. The alternative (NAT Gateway) is also billed hourly and per GB.
To create an HTTPS listener you must deploy at least one SSL server certificate (from ACM or IAM). ACM cannot validate resources in a VPC private hosted zone or any other private domain, even if the ALB is internal. ACM does not validate domain ownership for imported certificates or for certificates signed by a private CA.
With manage_master_user_password = true, RDS generates the master password and stores it in Secrets Manager. The Terraform provider doesn't allow combining it with password, and RDS doesn't support it in some scenarios (for example Blue/Green deployments), so decide upfront.
Letra Chica