Open Source Frameworks

Checkov scans cloud infrastructure configurations to find misconfigurations before they're deployed. Checkov uses a common command-line interface to manage and analyze infrastructure as code (IaC) scan results across platforms such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework. Verify changes to hundreds of supported resource types in all major cloud providers. Checkov supports developers using Terraform, Terraform plan, CloudFormation, Kubernetes, ARM Templates, Serverless, Helm, and AWS CDK. Scan cloud resources in build-time for misconfigured attributes with a simple Python policy-as-code framework. Analyze relationships between cloud resources using Checkov’s graph-based YAML policies. Execute, test, and modify runner parameters in the context of a subject repository CI/CD and version control integrations.

The AWS Cloud Development Kit (AWS CDK) is an open source software development framework to define your cloud application resources using familiar programming languages. Provisioning cloud applications can be a challenging process that requires you to perform manual actions, write custom scripts, maintain templates, or learn domain-specific languages. AWS CDK uses the familiarity and expressive power of programming languages for modeling your applications. It provides you with high-level components called constructs that preconfigure cloud resources with proven defaults, so you can build cloud applications without needing to be an expert. AWS CDK provisions your resources in a safe, repeatable manner through AWS CloudFormation. It also enables you to compose and share your own custom constructs that incorporate your organization's requirements, helping you start new projects faster.

The AWS SigV4 Library is a standalone library for generating authorization headers and signatures according to the specifications of the Signature Version 4 signing process. Authorization headers are required for authentication when sending HTTP requests to AWS. This library can optionally be used by applications sending direct HTTP requests to AWS services requiring SigV4 authentication. This library has no dependencies on any additional libraries other than the standard C library. This library is distributed under the MIT Open Source License. This library has gone through code quality checks including verification that no function has a GNU Complexity score over 8, and checks against deviations from mandatory rules in the MISRA coding standard. Deviations from the MISRA C:2012 guidelines are documented under MISRA Deviations. This library has also undergone static code analysis using Coverity static analysis, and validation of memory safety through the CBMC automated reasoning tool.

LocalStack is a fully functional local AWS cloud stack that enables you to develop and test your cloud and serverless apps offline. It spins up an easy-to-use testing environment on your local machine that has the same APIs and works the same way as the real AWS cloud environment. It can spin up a number of different core Cloud APIs on your local machine, including API Gateway, Kinesis, DynamoDB, Firehose, Lambda and many others. LocalStack was built on some of today’s best-of-breed mocking/testing tools, combining them and making them interoperable, and adding important functionality such as error injection and pluggable services. All this happening locally, without ever talking to the cloud.

A Node.js serverless framework for front-end/full-stack developers. Build the application for next decade. Works on AWS, Alibaba Cloud, Tencent Cloud, and traditional VM/Container. Super easy integrate with React and Vue. There are many similar frameworks in the community, so why do you need Midway? Midway is a framework that Alibaba has been developing continuously. Before egg was used as the underlying framework, an application-oriented framework was required to connect with the group's scenarios. The full use of TypeScript is the trend for a period of time in the future, and iterating and developing for the future is a requirement for the innovation of the architecture team. Although the community already has a framework like Nest, the maintenance, collaboration, and modification of these products will be restricted by commercial products, and it is impossible to achieve rapid iteration and security assurance of requirements. The overall R&D concept is also different from ours.

Middy is a very simple middleware engine that allows you to simplify your AWS Lambda code when using Node.js. If you have used web frameworks like Express, then you will be familiar with the concepts adopted in Middy and you will be able to get started very quickly. A middleware engine allows you to focus on the strict business logic of your Lambda and then attach additional common elements like authentication, authorization, validation, serialization, etc. in a modular and reusable way by decorating the main business logic. One of the main strengths of serverless and AWS Lambda is that, from a developer perspective, your focus is mostly shifted toward implementing business logic. Anyway, when you are writing a handler, you still have to deal with some common technical concerns outside business logic, like input parsing and validation, output serialization, error handling, etc.

Seata, or Simple Extensible Autonomous Transaction Architecture is an open source distributed transaction solution that brings high performance and easy-to-use distributed transaction services under a microservices architecture. It has 3 basic components: a Transaction Coordinator for maintaining the status of global and branch transactions; a Transaction Manager that defines the scope of global transaction; and a Resource Manager that manages resources being worked on by branch transactions, and drives branch transaction commit or rollback. Seata has played a pivotal role of distributed consistency Middleware in Ali economy, and has provided strong support for businesses of all departments. It continues to be used and trusted by dozens of other companies.

Run REST APIs and other web applications using your existing Node.js application framework (Express, Koa, Hapi, Sails, etc.), on top of AWS Lambda and Amazon API Gateway. Vendia is the real-time data cloud for rapidly building applications that securely share data across departments, companies, clouds, and regions. We’re excited to announce the latest release of Vendia Share! This release includes new features like smart contracts, user-level transactions, the beta release of Azure support, and more. We also added a pay-as-you-go pricing plan that gives developers from organizations of any size access to Vendia's enterprise-grade platform for building data-driven, multi-party, cross-cloud apps. If you want to migrate an existing application to AWS Lambda, it's advised to get the minimal example up and running first, and then copy your application source in.

StreamAlert is a serverless, real-time data analysis framework that empowers you to ingest, analyze, and alert on data from any environment, using data sources and alerting logic you define. Computer security teams use StreamAlert to scan terabytes of log data every day for incident detection and response. Incoming log data will be classified and processed by the rules engine. Alerts are then sent to one or more outputs. Rules are written in Python; they can utilize any Python libraries or functions. Merge similar alerts and automatically promote new rules if they are not too noisy. Ingested logs and generated alerts can be retroactively searched for compliance and research. Serverless design is cheaper, easier to maintain, and scales to terabytes per day. Deployment is automated, simple, safe and repeatable for any AWS account. Secure by design, least-privilege execution, containerized analysis, and encrypted data storage.

Tekton is a powerful and flexible open-source framework for creating CI/CD systems, allowing developers to build, test, and deploy across cloud providers and on-premise systems. Get started with Tekton. Tekton standardizes CI/CD tooling and processes across vendors, languages, and deployment environments. It works well with Jenkins, Jenkins X, Skaffold, Knative, and many other popular CI/CD tools. Tekton lets you create CI/CD systems quickly, giving you scalable, serverless, cloud native execution out of the box. Tekton abstracts the underlying implementation so that you can choose the build, test, and deploy workflow based on your team’s requirements. Tekton is a collaborative project where members of the ecosystem contribute together to make CI/CD easier for everyone. See the individuals and organizations that are involved in the Tekton project.

Serverless Chrome contains everything you need to get started running headless Chrome on AWS Lambda (possibly Azure and GCP Functions soon). The aim of this project is to provide the scaffolding for using Headless Chrome during a serverless function invocation. Serverless Chrome takes care of building and bundling the Chrome binaries and making sure Chrome is running when your serverless function executes. In addition, this project also provides a few example services for common patterns (e.g. taking a screenshot of a page, printing to PDF, some scraping, etc.). Why? Because it's neat. It also opens up interesting possibilities for using the Chrome DevTools Protocol (and tools like Chromeless or Puppeteer) in serverless architectures and doing testing/CI, web-scraping, pre-rendering, etc. You must configure your AWS credentials either by defining AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environmental variables, or using an AWS profile.