Blog Posts

AWS Lambda makes it easy to build serverless apps—but security is often an afterthought. This post covers 14 real-world Lambda security best practices, from input validation, secret management, and least-privileged IAM to tenant isolation and safe logging. Backed by years of hands-on experience and aligned with OWASP Serverless Top 10, it includes a downloadable checklist to help you secure your functions from day one.

I attempted to run an MCP server serverlessly on AWS Lambda using FastAPI, FastMCP, and the Lambda Web Adapter. While it technically worked, the developer experience was rough—cold starts were slow, observability was limited, and testing was clunky. Compared to my experience building with Bedrock agents, this felt like a step backward. MCP is promising, but today, running it on Lambda isn’t production-ready. Here’s my full breakdown and thoughts.

In this post, you'll learn how to use AWS Lambda functions as both data sources and event handlers for publish and subscribe actions in AWS AppSync Events. We’ll walk through setting up a namespace, wiring direct Lambda integrations using CDK, and handling real-time events with Powertools for AWS Lambda. This approach gives you full control, observability, and flexibility—all while keeping your WebSocket architecture serverless and scalable.

Avoid common AWS Serverless architecture pitfalls! Learn 5 outdated patterns & the best practices to replace them for better services

In this post, I will share my thoughts about AWS Lambda extensions, the good and the bad, and when you should use or should not use them