In today’s fast-paced digital landscape, seamless workflows are essential for maintaining operational efficiency. One critical aspect of many workflows is the approval process, where decisions need to be made quickly and securely. Email-based approvals have become a preferred solution due to their accessibility and ease of use.

But how do you ensure that this method is not only user-friendly but also secure? Enter the concept of email-based approval workflows using one-time links. This approach bridges the gap between convenience and security, empowering users to approve or reject tasks directly from their inbox without compromising sensitive data.

In this post, we’ll explore how email approval workflows work, the role of one-time links in ensuring security, and best practices for implementing this feature in your systems.

Need for a Token in One-Time Link Generation

A key element of implementing one-time approval links is the use of a unique token. This token serves as a secure identifier that ensures the authenticity of the approval action and ties it to a specific leave request. Without a token, the link would be a simple URL, which could be easily guessed or reused, undermining its security and purpose.

Here’s some key aspects essential for one-time link generation –

• Uniqueness : Each token is randomly generated and unique to the leave request, ensuring that no two links are the same. This uniqueness prevents unauthorized users from tampering with the link or attempting to generate a valid approval link on their own. 
• Security : The token serves as a form of authentication, guaranteeing that only the correct user (the manager or approver) can interact with the link.
• Non-Reusability : A well-designed token is single-use, meaning once the link has been clicked and the approval action is completed, the token expires. This prevents any possibility of reusing the same link, providing an added layer of security. Even if someone gains access to the link after it has been used, it will no longer be valid, ensuring that approvals or rejections cannot be mistakenly repeated.

Generating a Secure Token

A UUID (Universally Unique Identifier) is a simple yet powerful way to achieve this. A UUID is a 128-bit identifier designed to be globally unique. It ensures that no two tokens are ever the same, making it ideal for one-time links in approval workflows. UUIDs can be generated programmatically using most modern programming languages and libraries.

The UUID, along with relevant metadata, is stored in the database. The associated metadata includes:

• Request ID: The unique identifier for the leave request.
• Token Creation Timestamp: The time when the token was generated.
• Token Usage Status: Indicates whether the token is valid, has been used, or has expired.

The token is designed to be time-sensitive, with a validity period (e.g., 2 days). This gives the approver enough time to review and approve the leave request while ensuring that the token expires after the defined period to prevent misuse.

When the approver clicks the one-time link, the system performs a series of checks 

1. Validate the Token’s Existence: The system first checks if the token exists in the database.
2. Check Token Association: The system ensures that the token is linked to the specific request.
3. Verify Token Validity Period: The token’s creation timestamp is compared to the current time to confirm that it is still within the validity period.
4. Ensure the Token Has Not Been Used: Finally, the system checks if the token has already been used. If it has, the link is considered expired and no further action is allowed.

Only when all of these checks are successfully passed, the approval action is executed.

Adding Login-Based Verification for Secure Email Approvals

Token-based links alone may be insufficient in systems where strict access control is necessary. If the email link is accessed by an unauthorized user, login-based verification ensures that approvals are granted only after confirming the identity of the approver.

How It Works

1. Token Verification: The user clicks the one-time link, which routes them to the system (e.g., https://example.com/approve?token=<UUID>).
2. Authentication Prompt: Before processing the approval, the user is redirected to the system’s login page.
3. Login Validation: The system authenticates the user’s credentials (username, password, and potentially additional security checks like 2FA).
4. Approval Grant: Upon successful login, the system validates the token, associates it with the logged-in user, and processes the approval request.

The system leverages the existing login mechanism that users already know and trust, eliminating the need for new MFA tools. Additionally, it maintains detailed records of who approved the request and when, even through this token-based approach, ensuring accountability and traceability for every action.

This balance of security, usability, and traceability makes login-based verification an ideal choice for workflows where approval integrity is critical.

Notifications for Approval Actions

In any approval workflow, notifications serve as a direct acknowledgment of the user’s action while also acting as a safeguard in case of unauthorized activity. They –

• Keeps the approver informed that their action has been successfully recorded.
• Provides a record of actions taken, helping users and administrators track approvals.
• Alerts users immediately if an approval they didn’t authorize occurs, allowing them to report suspicious activity.

When sending notifications for approval actions, it’s essential to include key details that provide clarity and context. Each notification should specify the request ID, a brief description of the action, the date and time of the approval, and the identity of the approver. Additionally, include a link to review the request or take further action if needed. 

For enhanced security, the notification should also prompt users to report unauthorized activity, such as: “If this approval was not made by you, please contact support immediately.” These elements ensure the notification is informative, actionable, and serves as both a confirmation and a security safeguard.

Conclusion: Technical Design Decisions and Impact

The implementation of one-time approval links using UUID tokens in the approval system reflects a well-considered balance of simplicity, security, and efficiency, while also addressing potential challenges. 

UUIDs for Simplicity and Security.
The decision to use UUIDs is driven by the need for a secure yet simple solution. This approach strikes a balance between maintaining security and keeping the system simple, without the complexity of additional systems for token generation or storage. 

Notification for Unauthorized Approvals
By incorporating notifications for approval actions, workflows become more transparent, users stay informed, and the system achieves a higher standard of accountability and security.

Auditability and Transparency
Finally, the design emphasizes transparency and accountability. Every action taken via the one-time approval link is logged, ensuring that the system remains auditable and that stakeholders can track approval history, providing full visibility into the decision-making process.

In today’s cloud-first era, AWS has become the backbone of countless applications and enterprises, offering unparalleled scalability, reliability, and flexibility. Its pay-as-you-go pricing model is revolutionary, allowing businesses to only pay for what they use. However, this flexibility can also lead to unexpected surprises on the billing dashboard if resources are not carefully managed.

As the cloud infrastructure grows and becomes more complex, here are some of the common hurdles that businesses encounter

• Lack of Visibility and Control  – With AWS’s vast range of services, tracking usage and spending across regions and resources can be daunting, making it challenging to identify cost drivers.
• Unpredictable and Spiky Costs – AWS services like EC2 and Lambda can face sudden usage spikes from traffic surges, misconfigurations, or accidental provisioning, leading to costly overruns if not properly monitored.
• Difficulty in Forecasting Costs – The complexity of AWS pricing models combined with the dynamic nature of cloud environments, makes it difficult for organizations to accurately forecast costs.

To help organizations address these challenges, AWS offers a range of powerful tools and services that include –

• AWS Pricing Calculator
• AWS Budgets
• AWS Cost Anomaly Detection
• AWS Cost Explorer

In this blog, we’ll explore how these AWS services can help businesses optimise their cloud spend, offering practical guidance on how to use them to manage, control, and forecast costs effectively.

Evaluating Service-Specific Costs

One of the most effective tools for managing costs before diving into AWS implementation is the AWS Pricing Calculator. This tool allows businesses to estimate the costs of AWS services in advance, helping to align cloud expenses with budgetary constraints and project requirements. The AWS Pricing Calculator is an interactive web tool designed to provide detailed cost estimates for AWS services. It’s particularly useful for planning new implementations, comparing service costs, or assessing the financial impact of scaling existing infrastructure.

Key Features include 

1. Allows users to create cost estimates based on specific workloads, configurations, and usage patterns.
2. Provides a breakdown of costs for compute, storage, networking, and managed services, including associated charges like data transfers or snapshots.
3. Accounts for variations in pricing across AWS regions, ensuring estimates reflect local cost structures.

For ex. consider a serverless application is being developed where AWS Lambda functions process user-submitted data. The Lambda function has a 500-millisecond execution time and is allocated 256 MB of memory, with 1 million invocations per month. Additionally, the application is estimated to transfer 10 GB of data out of AWS each month. The AWS Pricing Calculator is used to estimate the associated costs, factoring in free-tier usage for requests and compute time, with additional charges for data transfer beyond the free 1 GB allowance. In this example it would cost approximately $1.01 per month. 

Knowing this cost upfront has 2 key benefits 

Cost Awareness and Preparedness
It allows you to plan development scenarios while considering the impact of each factor on the overall cost. This preparation ensures you’re aware of potential costs, enabling better budgeting and adjustments if any parameters change during the execution phase.

Improved Service Understanding and Risk Mitigation
While some cost factors for this cost calculation might be unknown at the start, understanding that these factors contribute to the total cost helps you gain a deeper insight into the service. This awareness allows you to be better prepared for potential cost fluctuations or the worst-case scenario as your usage scales or requirements evolve.

To know more about how to create an estimate see this. AWS enables users to create cost estimates across services, which can be saved and shared for collaborative planning.

AWS Budgets for cost tracking

AWS Budgets helps you proactively manage costs by providing early warnings if your spending exceeds your expectations, allowing you to address issues before they become larger problems. You can create budgets based on cost, usage, or specific service usage. Whether you’re tracking monthly costs or monitoring the usage of a particular service, AWS Budgets allows you to set thresholds and receive notifications when your actual costs or usage exceed your predefined limits. This feature ensures that you are immediately aware of potential overages and can take corrective action.

The 2 most frequently used templates include – ‘Zero budget spend’ and ‘Monthly Cost budget’. As the name suggests ‘zero budget spend’ notifies you once your spending exceeds $0.01 which is above the AWS Free Tier limits and is relevant when you are in your free tier account usage. 

The ‘Monthly Cost budget’ is more relevant for businesses beyond the free tier usage. For eg. if you estimate your monthly cost for AWS account to be around 100$, its safe to setup budget exceeding 20% of this cost which is 120$. This means you will be notified when 1) your actual spend reaches 85% 2) your actual spend reaches 100% 3) if your forecasted spend is expected to reach 100%.

Cost Anomaly Detection

AWS Cost Anomaly Detection is an advanced tool designed to help you identify unusual spending patterns in your AWS environment. By leveraging machine learning algorithms, it provides automated insights into unexpected cost variations, enabling you to take timely action to control costs. While AWS Budgets tracks overall cost trends or specific usage against planned limits for a fixed period, AWS Cost Anomaly Detection, on the other hand, focuses on reactive monitoring by identifying unusual spending patterns, even within budgeted thresholds.

For ex. If your usual daily Lambda costs are $2 but suddenly spike to $8 on a single day due to unexpected increases in invocations or execution time, AWS Cost Anomaly Detection flags this as an anomaly, even if your total monthly cost is still under the budgeted cost.

By identifying anomalies early, you can investigate and address potential cost drivers before they escalate into significant expenses. When starting out with the Cost anomaly or a new AWS account, It’s advisable to set up monitoring at a Service level. This grants you the basic required monitoring. 

As you get familiar with this service or depending on your account usage, you can opt for ‘Cost category’ or ‘Cost Allocation Tag’ that helps you track and identify unusual spending patterns based on specific tags applied to your resources. This enables granular cost monitoring and provides insights into anomalies within tagged projects, environments, or business units.

You can attach ‘Alert Subscription’ to these monitoring alerts that notifies you when a cost monitor detects an anomaly. Depending on the alert frequency, you can notify designated individuals by email.

Visualizing and Analyzing Your Cloud Spend

AWS Cost Explorer is a visualization tool that provides insights into your AWS spending and usage patterns over time. It enables you to analyze historical data, identify trends, and predict future costs, offering an intuitive way to manage and optimize your cloud expenses. A typical cost explorer dashboard would look like this

Some of the Key Benefits include

1. Cost Explorer provides a breakdown of your AWS usage and costs across services, accounts, and tags, helping you pinpoint cost drivers.
2. With cost predictions based on historical data, it helps in estimating future expenditures and planning budgets effectively.

When viewing the current month cost, its most effective to use the Date range of ‘Month-to-date’ , granularity of ‘Daily’ and a groping dimension of ‘Service’. This will allow you to view per service charges on a daily basis as shown below

By enabling focused analysis, filters in AWS Cost Explorer make it easier to identify the root cause of cost spikes. It allows you to customize your cost and usage reports by focusing on specific attributes such as services, accounts, regions, or tags. This precision helps in identifying and analyzing cost spikes effectively.

For ex. By filtering costs by AWS regions, you can detect if a spike is related to region-specific activity, such as higher usage in a particular geographic area.

Addressing Unexpected Costs

The above described methods help one proactively highlight the cost spikes. However, it doesn’t help to avoid them. So what do you do if you encounter unexpected charges?

Try to find the root cause of the issue
The Cost explorer helps in understanding the service associated with the cost spike. You can make use of the filters to appropriately drill down to the Region to try to understand the resource that is possibly causing the spike.

Reach out to AWS Support promptly
The AWS support team can help investigate and resolve the issue, providing clarity on the root cause. In cases of genuine mistakes or misconfigurations, AWS Support may also offer billing adjustments, ensuring that your costs align with actual usage. Don’t hesitate to leverage this valuable resource for maintaining cost efficiency and transparency.

To Summarise

Effective cost management in AWS is not just about reacting to spikes but proactively planning and monitoring your spending. Tools like AWS Cost Anomaly Detection, AWS Cost Explorer, and AWS Cost Calculator empower businesses to visualize, predict, and control their cloud costs while optimizing resource usage. Taking preventive steps, such as setting up cost alerts and anomaly detection models, helps highlight potential issues early. 

However, In case of unexpected cost spikes, leveraging AWS customer support can provide quick resolutions. AWS’s support team is highly responsive and prioritizes customer satisfaction, especially for long-term users, ensuring that issues are addressed efficiently.

By combining these tools and strategies, you can maintain better financial oversight, avoid surprises, and ensure your cloud infrastructure remains both scalable and cost-effective.