My Journey

Poo Tracker

David — Mon, 19 Oct 2026 12:51:28 GMT

I wanted to create a particular app which would incorporate a Serverless front end but also have the ability to display previous logs.

I opted to create a rather crude form that allowed someone living with a Bowel condition to log their motions including pictures if relevant.

In an ideal world, the user would login, provide new information and be able to see previous records. I was hoping to not lean on AWS Amplify for this project as I wanted to use a Secure S3 Bucket tied in with AWS Cloudfront and Cognito. Sadly Cloudfront is not part of the Entry tier of AWS so I opted not to push for that at this stage.

I will break this down by the Service

AWS S3

We have 2 different S3 Buckets operating here.

Frontend Hosting
- This was used to host the site but had a JSON Policy of s3:GetObject to *, which allowed public access. This is ideal for unencrypted testing but not much else in the real world. Ideally this would sit behind Cloudfront and only be accessed via Cognito Login. I will do this on a separate Project.
Image Storage
- Public Access was blocked on this, and only the Lambda function had the IAM permission to trigger the storage.

AWS DynamoDB

This Database was chosen primarily for the Free tier access but also as we didn't need a relational database for such a quick project.

UserId is used to group the data and timestamp allows for the entries to be sorted.

AWS IAM (Identity and Access Management)

As mentioned, Services can't inherently talk to each other in AWS, so Policies were added to ensure this could happen. AmazonDynamoDBFullAccess, AmazonS3FullAccess, and AmazonSNSFullAccess.

In a Full Production Software, we would use Least Privilege to set these up.

AWS Lambda

Like S3, 2 branches of Lambda occur;

ProcessBristolSubmission

This allows image data to be put into the S3 bucket, itemises this on DynamoDB and then sends an Alert on SNS.

Note that User ID is set to 'test-user-001' for now until Cognito is set up.

import json
import boto3
import base64
import uuid
from datetime import datetime

# 1. Initialize Boto3 clients (The magic wands)
dynamodb = boto3.resource('dynamodb')
s3_client = boto3.client('s3')
sns_client = boto3.client('sns')

# 2. Hardcode your specific resources HERE
BUCKET_NAME = 'bristol-health-submissions-yourname-2026'
SNS_TOPIC_ARN = 'arn:aws:sns:eu-west-2:446503125379:BristolAlerts'
TABLE_NAME = 'BristolSubmissions'

def lambda_handler(event, context):
    try:
        # 3. Parse the data coming from API Gateway / Frontend
        body = json.loads(event['body'])
        
        bristol_scale = body.get('bristol_scale')
        pain_level = body.get('pain_level')
        blood_present = body.get('blood_present', False)
        image_base64 = body.get('image_data') # The photo file sent as text
        
        # We will use a dummy user ID until we set up Cognito later
        user_id = 'test-user-001'
        timestamp = datetime.utcnow().isoformat()
        image_url = "No image uploaded"
        
        # 4. If there is a photo, save it to S3
        if image_base64:
            image_name = f"{user_id}-{uuid.uuid4()}.jpg"
            image_bytes = base64.b64decode(image_base64)
            
            s3_client.put_object(
                Bucket=BUCKET_NAME,
                Key=image_name,
                Body=image_bytes,
                ContentType='image/jpeg'
            )
            image_url = f"s3://{BUCKET_NAME}/{image_name}"

        # 5. Save the text data to DynamoDB
        table = dynamodb.Table(TABLE_NAME)
        table.put_item(
            Item={
                'UserId': user_id,
                'Timestamp': timestamp,
                'BristolScale': bristol_scale,
                'PainLevel': pain_level,
                'BloodPresent': blood_present,
                'ImageUrl': image_url
            }
        )

        # 6. Send the email via SNS
        sns_client.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject='New Health Submission Logged',
            Message=f"A new submission was saved.\nBristol Scale: {bristol_scale}\nPain Level: {pain_level}\nBlood Present: {blood_present}"
        )

        # 7. Reply to the frontend website
        return {
            'statusCode': 200,
            # CORS headers are required so your web browser doesn't block the response
            'headers': {
                'Access-Control-Allow-Origin': '*', 
                'Access-Control-Allow-Headers': 'Content-Type',
            },
            'body': json.dumps({'message': 'Submission successful!'})
        }

    except Exception as e:
        # If anything goes wrong, tell the frontend
        return {
            'statusCode': 500,
            'body': json.dumps({'error': str(e)})
        }

GetBristolHistory

Using 'Query' we bring back the submissions of 'test-user-001' into the Form view

import json
import boto3
from boto3.dynamodb.conditions import Key
import decimal

dynamodb = boto3.resource('dynamodb')
TABLE_NAME = 'BristolSubmissions'

# Helper class to convert a DynamoDB item to JSON.
class DecimalEncoder(json.JSONEncoder):
    def default(self, o):
        if isinstance(o, decimal.Decimal):
            if o % 1 > 0:
                return float(o)
            else:
                return int(o)
        return super(DecimalEncoder, self).default(o)

def lambda_handler(event, context):
    try:
        table = dynamodb.Table(TABLE_NAME)
        
        # We use the same dummy user ID we used to save the data
        user_id = 'test-user-001'
        
        # This is a DynamoDB Query. It instantly finds the "neighborhood" 
        # for this specific user, rather than scanning the whole database.
        response = table.query(
            KeyConditionExpression=Key('UserId').eq(user_id)
        )
        
        items = response.get('Items', [])
        
        # Sort the items so the newest submission is at the top of the table
        items.sort(key=lambda x: x['Timestamp'], reverse=True)

        return {
            'statusCode': 200,
            # CORS headers to allow your S3 website to fetch the data
            'headers': {
                'Access-Control-Allow-Origin': '*',
                'Access-Control-Allow-Headers': 'Content-Type',
            },
            # We use the DecimalEncoder to fix a common Boto3 bug
            'body': json.dumps({'history': items}, cls=DecimalEncoder)
        }

    except Exception as e:
        return {
            'statusCode': 500,
            'headers': {
                'Access-Control-Allow-Origin': '*'
            },
            'body': json.dumps({'error': str(e)})
        }

This is also my first knowledge of boto3, which is the official AWS Kit for Python, more to come on this I'm sure.

AWS API Gateway

This involves two routes;

Post /submit - Involved withe Form Submission

Post /history - Involved with the History View

CORS was set to *, and content-type allowed the methods of GET, POST and OPTIONS.

AWS SNS (Simple Notification Service)

I created 'BristolAlerts' which emailed any notification to me.

Roadblock

I was hoping to create a login using Cognito and a secure frontend using Cloudfront (to help deter DDOS) but Cloudfront is not available to me just yet.

What's Next?

I would like to pad this out further with some different features;

Create a Login Page for the users so the form is not Public
Have the ability for the User to see their individual records and the photos attached to them
Create an Admin View

Randomness

David — Tue, 13 Oct 2026 12:16:39 GMT

As my journey to being a Web Developer continues, I have carried on my Javascript learnings via Scrimba.

Today I learnt about Math.random and Math.floor and how they work.

Math.random

If prompted, Math.random will give you a random (this in itself can be argued) number between 0 and 1. So it might be 0.2525357 or 0.9234 etc.

So how would we get a random number between 1 and 10? Well could start with this. This gives us a random number from 0 to 9, and then we +1 so we include 10 and exclude the 0.

let random = (Math.random()*10)+1
console.log (random)

Math.floor

This works well but it still decimal places in the way. If we apply Math.floor, then this will effectively snip off the decimal places.

let random = Math.floor((Math.random()*10)+1)
console.log (random)

This will now give us a random number between 1 and 10.

Creating a Photo Geolocation Tool

David — Mon, 12 Oct 2026 10:41:54 GMT

A friend of mine had an idea for an outdoor tracking app based on a submitted Photo. I thought this was a great way of creating another mini project to help me cement the AWS services prior to my AWS Exam in November.

I would like to note that Ai does support in the development of my projects, but I feel this is important in 2026 where not using Ai would not be advantageous in terms of;

Learning of new services and terminologies
Creation of quick to develop front end pages.

Please note that whilst I use Ai, I am constantly learning the fundamentals in the background so I'm not just a mindless button pusher.

API Keys using KMS and IAM are not included in this project debrief but were setup initially.

Step 1

Using a very simple prompt, I created a photo uploader using .HTML, .CSS (and Tailwind) and Vanilla Javascript. The below code also includes our API Gateway URL which I will touch on next.




  
  
  The Wild Haven GreenScheme
  
  
  
  
  
  
  
  
  





  
  
    
    
    
      
      
        
      
      The Wild Haven GreenScheme
      Nature & Wildlife Photo Location Mapper
    

    
    
      
      
        
        
        
        
        
        
          
            
          
          Click to upload photo
          JPG or PNG (Max 1 photo)
        

        
        
          
          
          
          
          
        
      

      
      

      
      
    

    
    
      
        
        Photo Location Result
      
      
      
      
        Analyzing photo metadata...
      
      
      
      
        Polling DynamoDB background processor...

Step 2.

I used API Gateway as the entry point into my AWS backed but as API Gateway is not suitable for high res photos going through it (more costly and prone to timeouts).

So instead of passing the image through the API, a lambda programme (get-presigned-url) acted as the gatekeeper to allow a photo in without exposing my API Keys.

import json
import boto3
import uuid
import os
from botocore.config import Config

s3_client = boto3.client('s3', config=Config(signature_version='s3v4'))
BUCKET_NAME = os.environ['BUCKET_NAME']

def lambda_handler(event, context):
    try:
        file_name = f"{uuid.uuid4()}.jpg"
        
        # Generate URL without strict content-type signature lock
        presigned_url = s3_client.generate_presigned_url(
            'put_object',
            Params={
                'Bucket': BUCKET_NAME,
                'Key': file_name
            },
            ExpiresIn=300
        )
        
        return {
            'statusCode': 200,
            'headers': {
                'Access-Control-Allow-Origin': '*',
                'Access-Control-Allow-Headers': '*',
                'Access-Control-Allow-Methods': 'GET, PUT, OPTIONS'
            },
            'body': json.dumps({
                'uploadURL': presigned_url,
                'fileName': file_name
            })
        }
    except Exception as e:
        print(f"Error: {e}")
        return {
            'statusCode': 500,
            'body': json.dumps({'error': 'Could not generate URL'})
        }

This script was also adapted to Access-Control-Allow-Origin so browsers wouldn't block it.

Step 3.

The photo is then uploaded to an S3 Bucket which has an Even notification attached to it, which will trigger another Lambda function

Step 4.

The lambda function process-photo-metadata has now been triggered and this will begin to assess the photo's metadata and where the photo was taken. This uses EXIF Binary Parsing which I am currently not familiar with to show the exact GPS. This then writes the location to the DynamoDB table

Step 5.

In our HTML file, we have a Javascript function that begins polling the AWS Api for the result of the Photo. It will run 10 times before timing out to prevent overuse.

  6. DATABASE POLLING LOGIC
      ===============================================================
      Because the backend Lambda processes the EXIF data in the background,
      the frontend doesn't know exactly when it finishes.
      
      "Polling" means the frontend repeatedly asks the database (every 2 seconds) 
      "Are you done yet?" until it gets the answer or times out.
    */
    async function pollForLocation(fileName, attempts = 0) {
      // If we've asked 10 times (20 seconds) and still no answer, give up.
      if (attempts >= 10) {
        locationText.textContent = 'Location unknown';
        locationStatus.textContent = 'Timed out waiting for location processing.';
        return;
      }

      try {
        // Ask API Gateway to check DynamoDB for this specific file name
        const res = await fetch(`${API_BASE_URL}/get-location?fileName=${encodeURIComponent(fileName)}`);
        
        if (res.ok) {
          const data = await res.json();
          
          // If the backend has replaced the temporary "Processing..." text with a real location
          if (data.location && data.location !== 'Processing EXIF metadata...') {
            
            // Success! Update the UI with the final location.
            locationText.textContent = data.location;
            locationStatus.textContent = 'Retrieved directly from DynamoDB';
            return; // Stop the polling loop completely
          }
        }
      } catch (err) {
        console.warn('Polling check error:', err);
      }

      // If we didn't return (stop) above, wait 2000 milliseconds (2 seconds) 
      // and then call this exact same function again, adding 1 to our attempts counter.
      setTimeout(() => pollForLocation(fileName, attempts + 1), 2000);
    }

This is the Lambda code that processes such a polling request

import json
import boto3

dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('photo-metadata')

def lambda_handler(event, context):
    # Get fileName from query parameters: /get-location?fileName=xyz.jpg
    params = event.get('queryStringParameters') or {}
    file_name = params.get('fileName')
    
    if not file_name:
        return {
            'statusCode': 400,
            'headers': {'Access-Control-Allow-Origin': '*'},
            'body': json.dumps({'error': 'Missing fileName parameter'})
        }
        
    try:
        response = table.get_item(Key={'fileName': file_name})
        item = response.get('Item')
        
        if item:
            return {
                'statusCode': 200,
                'headers': {
                    'Access-Control-Allow-Origin': '*',
                    'Access-Control-Allow-Methods': 'GET, OPTIONS'
                },
                'body': json.dumps({'location': item.get('location', 'Location processing...')})
            }
        else:
            return {
                'statusCode': 200,
                'headers': {'Access-Control-Allow-Origin': '*'},
                'body': json.dumps({'location': 'Processing EXIF metadata...'})
            }
    except Exception as e:
        print(f"Error: {e}")
        return {
            'statusCode': 500,
            'headers': {'Access-Control-Allow-Origin': '*'},
            'body': json.dumps({'error': 'Failed to fetch location'})
        }

This then results in a resulting image having a location.

Future Considerations

This has been a fairly straightforward example to achieve. I am not saying I understand how the code between AWS and my Frontend is linking yet but this is just the beginning.

From here I could develop this further by creating a login area where someone can upload a photo, it would save to their account.

Combining Sandbox Payment Processor with AWS

David — Thu, 08 Oct 2026 13:47:14 GMT

As I now had a working prototype based in VS Code Python Script, I was eager to apply my AWS modest learnings with this problem.

Step 1.

I added my API Key and ID into AWS Secrets Manager under other type of secret.

Step 2.

With the support of AI for speed, I created a very modest index.html which consisted of a form with 2 questions

Item Name
Item Price

(The Final Code is at the bottom)

The script used a Javascript Script to fire the submission

Step 3.

Using AWS Amplify, I linked by Git account and created a live site of my code. Using VS Code I will update that as we go through.

Step 4.

Using AWS IAM, I added a policy called 'CashflowsSecretReadAccess' which gave the script access to the Secrets Manager and created a role for;

AWSLambdaBasicExecutionRole - For Logging purposes

Step 5.

Using LAMBDA I added a Python script that ran when the form was submitted

import json
import hashlib
import urllib.request
import urllib.parse
import base64
import boto3
from botocore.exceptions import ClientError

def get_secrets():
    client = boto3.client('secretsmanager', region_name="eu-west-2")
    try:
        response = client.get_secret_value(SecretId="cashflows/credentials")
        return json.loads(response['SecretString'])
    except ClientError as e:
        print(f"Error fetching secret: {e}")
        return None

def lambda_handler(event, context):
    # 1. Fetch credentials from AWS Secrets Manager
    secrets = get_secrets()
    if not secrets:
        return {
            "statusCode": 500, 
            "headers": {"Access-Control-Allow-Origin": "*", "Content-Type": "application/json"},
            "body": json.dumps({"message": "Failed to load credentials"})
        }
    
    api_key = secrets.get('API_KEY')
    config_id = secrets.get('CONFIG_ID')
    endpoint = "https://gateway-int.cashflows.com/api/gateway/payment-jobs"

    # 2. Extract data from incoming HTML form submission
    try:
        raw_body = event.get('body', '')
        if event.get('isBase64Encoded', False):
            raw_body = base64.b64decode(raw_body).decode('utf-8')
        
        parsed_body = urllib.parse.parse_qs(raw_body)
        amount = parsed_body.get('amountToCollect', ['10.00'])[0]
        order_number = parsed_body.get('orderNumber', ['Test-Order-01'])[0]
    except Exception as e:
        print(f"Extraction error: {e}")
        amount = "10.00"
        order_number = "Test-Order-01"

    # 3. Build Cashflows Payload using test card & 3DS bypass name
    payload_dict = {
        "type": "Payment",
        "paymentMethodsToUse": ["creditcard"],
        "amountToCollect": str(amount),
        "currency": "GBP",
        "locale": "en_GB",
        "parameters": {
            "cardNumber": "4510400400099005",
            "cardHolderName": "Luke Skywalker",  # Triggers automatic 3DS success in test environment
            "cardCvc": "123",
            "cardExpiryMonth": "12",
            "cardExpiryYear": "28"
        },
        "order": {
            "orderNumber": str(order_number)
        }
    }

    # 4. Generate SHA-512 Hash
    raw_json_body = json.dumps(payload_dict, separators=(',', ':'))
    hash_input = api_key + raw_json_body
    request_hash = hashlib.sha512(hash_input.encode('utf-8')).hexdigest().upper()

    headers = {
        "ConfigurationId": config_id,
        "Hash": request_hash,
        "Content-Type": "application/json"
    }

    # 5. Send request to Cashflows
    req = urllib.request.Request(endpoint, data=raw_json_body.encode('utf-8'), headers=headers, method='POST')
    
    try:
        with urllib.request.urlopen(req) as response:
            response_data = json.loads(response.read().decode('utf-8'))
            status_code = response.getcode()
    except urllib.error.HTTPError as e:
        response_data = json.loads(e.read().decode('utf-8'))
        status_code = e.code

    # 6. Extract action URL if Cashflows returns a 3DS redirect link
    action_url = None
    if isinstance(response_data, dict):
        action_url = response_data.get("links", {}).get("action", {}).get("url")

    return {
        "statusCode": 200,
        "headers": {
            "Access-Control-Allow-Origin": "https://main.dna7h844op3tm.amplifyapp.com",
            "Content-Type": "application/json"
        },
        "body": json.dumps({
            "cashflows_status": status_code,
            "action_url": action_url,
            "response": response_data
        })
    }

Some important steps in this code:

Luke Skywalker is a success message for testing purposes.
The Lambda will run for 15 seconds but it will fall back on fake data if it doesn't process it in time.

Step 6.

Using AWS API Gateway, I create a POST gateway and linked it to my LAMBDA code with a deployed stage URL ending with /pay.

The gateway has a burst limit of 10 and a rate limit of 5 per second to help prevent bad actors.

Cross-Origin Resource Sharing (CORS) is also directed to the Amplify URL to prevent the form being used from a different source.

Step 7.

Once uploaded, this now produces a working model.

Next Steps

This is just the start of this, as it is a very modest E-Commerce engine. We could;

Add Products
Add Card Holder Details
Add CAPTCHA
Success and Failure redirects.

Challenges

Working with AI, I managed to get the code working in some form very early on, but getting working Statuses was a challenge. Looking over the Specs, I found out I needed Luke Skywalker involved and to change my action_url link to one given by the Payment Software.

API Calls Introduction

David — Thu, 08 Oct 2026 09:05:19 GMT

API Calls run the Internet. When you press Play watching your 5th Episode in a row of 'Great British Bake Off' on your Smart TV, the play button doesn't actually play the content.

Instead a packet of information is sent to the Media Servers to say this episode has been requested by user 123456. It will do authentication to check you have the right to watch that, then a success/sorry message will be relayed back resulting in HD Nigella.

I was kindly given access to a sandbox dev environment of an online Payment Solution.

Step 1.

In order to run an API, you need an API Key or a Personal Access Token. The first thing to note is, an API is a key and like your house keys, you wouldn't leave them out for anyone to take (I hope?).

So API Keys need to be held safe either Internally of the Software or an Exterior Source such as Amazon Web Services (AWS) Secrets Manager or Keeper Security, Inc. They can't be naked in the code otherwise you're going to have a bad day.

API Keys also have different configurations in terms of what they can and can't do. Can they update something or can they just view something? Different softwares will give different abilities in terms of what is in the 'scope' of the API.

Step 2.

Using Python, we want to create a script which takes the API and sends over data in a specially configured JSON package.

Why Python? Python is great language for sending data in a clean format. It's a popular choice when it comes to Business Intelligence and Analytics and making sure the data is structured corrected. We don't want Dirty Data.

This is especially important with this platform as gaps in the payload will cause errors.

import hashlib
import json
import requests

api_key = "Darth Vader is Luke's Dad"
config_id = "Shhh"
endpoint = ""

# 1. Define the payload
payload_dict = {
    "type": "Payment",
    "paymentMethodsToUse": ["creditcard"],
    "amountToCollect": "99.99",
    "SCAExemptionIndicator": "LowValue",
    "currency": "GBP",
    "locale": "en_GB",
    "parameters": {
        "cardNumber": "00",
        "cardHolderName": "Test User",
        "cardCvc": "123",
        "cardExpiryMonth": "12",
        "cardExpiryYear": "30"
    },
    "order": {
        "orderNumber": "Tea Pot"
    }
}

# 2. Convert dictionary to a compact JSON string (no extra spaces)
raw_json_body = json.dumps(payload_dict, separators=(',', ':'))

# 3. Generate the SHA-512 Hash: API Key + Raw JSON Body
hash_input = api_key + raw_json_body
request_hash = hashlib.sha512(hash_input.encode('utf-8')).hexdigest().upper()

# 4. Set Headers and fire the request
headers = {
    "ConfigurationId": config_id,
    "Hash": request_hash,
    "Content-Type": "application/json"
}

response = requests.post(endpoint, headers=headers, data=raw_json_body)

print(f"Status Code: {response.status_code}")
print(f"Response: {json.dumps(response.json(), indent=2)}")

This code has a cool feature called the sha512 in which the Order details along with the API are concatenated together to form a massive number. This is run through a hash generator to create a secret number that only the other side knows is true.

In order to run this code through the terminal I had to do;

source .venv/bin/activate // Creates a local virtual environment for the Libraries as I haven't installed them fully yet.

python3 Desktop/test_payment.py - Run the code

I then get my order come through to the portal but it's pending?

Well this is because fintech is uber complex and we need to click on a confirmation page to confirm this. As of the time of writing this, I have managed to get this to work once but I don't fully get this yet.

But from an API call, I have triggered a payment.

What did I learn from this?

I don't fully understand Python code (yet) as I have been predominantly working in Javascript but I have understood the basics of the payload being sent.

What's next?

This currently runs from my desktop but I plan now to mock up a quick site where I add the key details such as the product, the price, the card details and it will do the API call directly.

Thank you for taking the time to read this.