Authorized invocation
No interactive database shell.
Operating the private tier · Entry 018
The runner inside the boundary.
PostgreSQL had no public route. Instead of creating a standing administrative host, I made migration access a constrained Lambda operation that could be confirmed, inspected, serialized, and audited.
Chapter 01
Move the operation to the database boundary.
AWS supports attaching Lambda functions to a VPC so they can access private resources through configured subnets and security groups. That let the database remain private while a purpose-built runner performed the occasional task.
Confirm environment
Mismatch is refused.
VPC Lambda
Task-scoped code and role.
Private RDS
No public route added.
Chapter 02
Make mutation a deliberate human act.
Deployment cannot migrate. CI cannot reach the database. Dry-run shows current and proposed revisions before a separately confirmed invocation applies changes.
Inspect first. Confirm the environment.
Then mutate.
Then mutate.
Chapter 03
Failure semantics are part of the design.
The runner stops on the first tenant failure, records progress, and resumes only through migration steps proven safe to repeat.
Fail fast
Do not report a partly migrated estate as complete.
Resume visibly
Record which tenant and revision completed.
Serialize
Reserved concurrency one caps simultaneous executions.
Separate roles
Package reuse must not spread database administration privileges.
Sources
Documented AWS behavior, current costs required.
The source’s near-zero cost is historical build context, not a quote. Logging, secrets, networking, invocations, and duration can incur charges.
Visual edition
The runner inside the boundary.
A narrated view of the private network path, explicit environment gate, dry run, partial-failure behavior, and single-execution control.