When I was first tasked with building Zai's EventCatalog, I knew it wasn’t going to be simple.
What I didn’t realise was that it would become one of the most rewarding technical journeys I’ve been on; filled with challenges, caffeinated problem solving, unexpected lessons, and a lot of pride at the finish line.
This is the story of how Zai's EventCatalog came to life: from a simple goal to a secure, automated, scalable platform.
The initial brief sounded straightforward:
"Create a simple internal catalog website using EventCatalog that documents key system events, make it secure (via our corporate identity provider), easy to deploy, and resilient."
At the time, I thought, "Sounds like a few S3 buckets and CloudFront, how hard can it be?"
(You already know where this is going.)
Before touching any code, I spent time thinking through the requirements:
The first decision? Start small, prove the concept, and grow it carefully.
I started with the basics:
And sure enough; after a few hours, I saw my first "Hello World" on a real URL.
When I finally accessed the website over CloudFront, it was a great milestone: the site was live globally within minutes.
Small win, big motivation.
Of course, making something work and making it secure are two very different things.
Problems started stacking up:
Now the real engineering work started.
{
"Effect": "Allow",
"Principal": {
"Service": "cloudfront.amazonaws.com"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::<YOUR_BUCKET>/*",
"Condition": {
"StringEquals": {
"AWS:SourceArn": "arn:aws:cloudfront::account-id:distribution/distribution-id"
}
}
}
When you’re experimenting with toy data in a development account, you can (briefly) put your docs bucket in public-read. But be mindful of what you upload there and never carry that setting into staging or prod.
No matter which way I turned, the answer kept pointing toward one thing:
Lambda@Edge + one of our corporate identity providers.
Implementing SAML authentication was a whole new world.
The first time I opened a SAML Response, I stared at it like it was hieroglyphics. Definitely check the SAML docs:
Base64 encoding inside HTTP POSTs.
Yet this was the most technical part.
Wrote the Lambda@Edge function in Node.js v20.
Used libraries:
I had to:
Sent this token back as a Secure, HttpOnly cookie.
const token = jwt.sign(
{
user: userId,
iat: nowSeconds,
exp: nowSeconds + expTime // token expiry duration
},
fetchSecretKey()
);
return {
status: '302',
statusDescription: 'Found',
headers: {
location: [{
key: 'Location',
value: '<https://login.hellozai.com/.../sso/saml?'>
}]
}
};
Result:
Anyone without a valid session would automatically be redirected to login.
All of this inside an Edge Lambda, operating at the CloudFront request layer.
When I finally got the first successful login redirect, I’m not exaggerating, I celebrated like I had just won a championship.
Once the basics were working, it was time to automate everything.
I moved from:
Manual AWS Console clicks ➜ CloudFormation templates.
Manual deployments ➜ Buildkite pipelines.
All builds and deployments for EventCatalog happen in a dedicated non-production AWS account (this is purely an internal tool), which lets us avoid touching prod.
Wrote a deploy pipeline that:
FROM node:20-alpine
WORKDIR /app
COPY edgeLambda/ .
RUN npm install
CMD ["npm", "test"]
It wasn’t all smooth sailing:
Important takeaway: CloudFront only accepts published Lambda@Edge versions, not aliases.
(Pro tip: never run npm install directly on your CI agent, use containers for clean, consistent builds.)
Each obstacle taught me something, sometimes painfully, but I wouldn’t trade it.
We didn’t stop at “it works.”
I added:
This made deployments safer and will give the team in the future confidence to trust every push.
If you're trying to do something similar:
Today, EventCatalog stands as a secure, scalable, easy-to-deploy internal platform.
But more importantly, it represents the journey I went through: from basic cloud hosting, through authentication challenges, automation pipelines, and deep technical growth.
It wasn't just about building a system.
It was about building an engineer.
About the Author
Fathy Abdelshahid
A software engineer who wrangles APIs by day, lifts weights by night, and blends technical know-how with humour, caffeine, and the occasional bad joke.