Distributed Locks Reality Check: When Redis Redlock Is the Wrong Tool

Client A acquires lock (TTL 30s)
Client A pauses 40s (GC / laptop sleep / SIGSTOP)
TTL expires → Client B acquires lock
Client A resumes and writes anyway ← double writer

# ✅ DynamoDB: lock row + monotonic fence; writers must present fence
import boto3
from botocore.exceptions import ClientError

ddb = boto3.resource("dynamodb").Table("leases")

def acquire(resource_id: str, owner: str, ttl_epoch: int) -> int:
 # Returns fencing token (version)
 try:
 out = ddb.update_item(
 Key={"pk": resource_id},
 UpdateExpression="SET #o=:o, #t=:t, #v=if_not_exists(#v,:z)+ :one",
 ConditionExpression="attribute_not_exists(pk) OR #t < :now",
 ExpressionAttributeNames={"#o": "owner", "#t": "ttl", "#v": "fence"},
 ExpressionAttributeValues={
 ":o": owner, ":t": ttl_epoch, ":now": ttl_epoch - 1,
 ":z": 0, ":one": 1,
 },
 ReturnValues="ALL_NEW",
 )
 return int(out["Attributes"]["fence"])
 except ClientError as e:
 if e.response["Error"]["Code"] == "ConditionalCheckFailedException":
 raise RuntimeError("lock held") from e
 raise

def write_with_fence(item_table, pk: str, fence: int, body: dict) -> None:
 # ✅ reject stale owners even if they still think they hold Redis lock
 item_table.put_item(
 Item={**body, "pk": pk, "fence": fence},
 ConditionExpression="attribute_not_exists(pk) OR fence < :f",
 ExpressionAttributeValues={":f": fence},
 )

# ❌ Classic Redlock-only “safety”
# redis.set(name, owner, nx=True, ex=30)
# do_payment() # no fence on the ledger write
# redis.delete(name)