Serverless best practices for configuration management and cost optimization [AWS Summit @ Berlin]

Serverless computing is becoming a core component in how companies build and run their applications and services. This session will discuss how serverless computing is evolving as well as architectural and configuration management best practices, optimizations, and useful tips to build secure, high-scale, high-performance serverless applications.

Transcript

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Serverless best practices for configuration management and cost optimization Alex Casalboni Technical Evangelist, AWS
2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T About me • Software Engineer & Web Developer • Startupper for 4.5 years • Serverless Lover & AI Enthusiast • ServerlessDays Organizer • AWS Customer since 2013
3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Agenda 1. Serverless security & configuration management 2. Serverless cost optimization
4. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Lambda permission model Fine-grained security controls for both execution and invocation Execution policies Define what AWS resources/API calls can this function access via AWS Identity and Access Management (IAM) Used in streaming invocations For example, “Lambda function A can read from DynamoDB table users” Function policies Used for sync and async invocations For example, “Actions on bucket X can invoke Lambda function Z" Resource policies allow for cross account access
6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Action: “s3:*” … make puppies cry! Action: “dynamodb:*" Action: “sns:*“ Photo by Matthew Henry on Unsplash
7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Fine-grained IAM policy with AWS SAM MyFunction: Type: AWS::Serverless::Function Properties: Handler: index.handler Runtime: python2.7 Policies: - AWSLambdaExecute # Managed Policy - Version: '2012-10-17' Statement: - Effect: Allow Action: - dynamodb:GetItem Resource: !GetAtt MyDynamoDBTable.Arn
8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Hardcoded secrets make fish cry! Photo by Julieann Ragojo on Unsplash
9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T AWS Lambda environment variables Key-value pairs that you can dynamically pass to your function Available via standard environment variable APIs (based on runtime) Can optionally be encrypted via AWS Key Management Service (AWS KMS) Allows you to specify in IAM what roles have access to the keys to decrypt the information Useful for creating environments per stage (such as dev, test, prod)
10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T AWS Systems Manager―Parameter Store Centralized store to manage your configuration data Supports hierarchies Plaintext or encrypted with AWS KMS Can send notifications of changes to Amazon SNS or Lambda Can be secured with IAM Calls recorded in AWS CloudTrail Can be tagged Available via API/SDK Useful for centralized environment variables, secrets control, feature flags
11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Parameter Store access via SDK import json, boto3 ssm = boto3.client('ssm') def get_parameter(): response = ssm.get_parameter( Name='LambdaSecureString’, WithDecryption=True ) return response['Parameter']['Value'] def lambda_handler(event, context): value = get_parameter() print(”value = %s" % value)
12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Parameter Store access via SDK with ssm_cache import json, boto3 ssm = boto3.client('ssm') def get_parameter(): response = ssm.get_parameter( Name=‘my_param’, WithDecryption=True ) return response['Parameter']['Value'] def lambda_handler(event, context): value = get_parameter() print(”value = %s" % value) from ssm_cache import SSMParameter param = SSMParameter(‘my_param’) def lambda_handler(event, context): value = param.value print(”value = %s" % value) github.com/alexcasalboni/ssm-cache-python
13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T AWS Secrets Manager Allows you to manage, retrieve, and rotate credentials Helps you rotate secrets regularly without breaking stuff Keeps track of different password versions Implements security controls associated with credential management Built-in support for Amazon RDS
14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T AWS Secrets Manager + Parameter Store Uniform and consistent access to both services You can reference Secrets Manager secrets with Parameter Store APIs Rotation & Refresh delegated to the client As simple as using a prefix: /aws/reference/secretsmanager/ +
15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Secrets access via Parameter Store import json, boto3 ssm = boto3.client('ssm’) prefix = ‘/aws/reference/secretsmanager’ def get_secret(): response = ssm.get_parameter( Names=[‘%s/my_secret’ % prefix], WithDecryption=True ) return response['Parameter']['Value'] def lambda_handler(event, context): value = get_secret() print(”value = %s" % value)
16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Secrets access via Parameter Store with ssm_cache import json, boto3 ssm = boto3.client('ssm’) prefix = ‘/aws/reference/secretsmanager’ def get_secret(): response = ssm.get_parameter( Names=[‘%s/my_secret’ % prefix], WithDecryption=True ) return response['Parameter']['Value'] def lambda_handler(event, context): value = get_secret() print(”value = %s" % value) from ssm_cache import SecretsManagerParameter secret = SecretsManagerParameter(‘my_secret’) def lambda_handler(event, context): value = secret.value print(”value = %s" % value) github.com/alexcasalboni/ssm-cache-python
17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Parameters & secrets grouping with ssm_cache from ssm_cache import SSMParameterGroup group1 = SSMParameterGroup(max_age=300) # 5min cache param1 = group.parameter('param_1’) param2 = group.parameter('param_2’) group2 = SSMParameterGroup(base_path="/Foo") # common prefix foo_bar = group2.parameter('/Bar') # will fetch /Foo/Bar baz_params = group2.parameters('/Baz') # will fetch /Foo/Baz/1 and /Foo/Baz/2 secret = group2.secret(‘my_secret’) # will fetch /aws/reference/secretsmanager/my_secret group1.refresh() group2.refresh()
18. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. amzn.to/serverless-security
19. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Anatomy of a function Your function Language runtime Function container Compute substrate
21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T The request lifecycle Bootstrap the runtime Start your code Cold start Warm start Download your code Start new container AWS optimization Your optimization
22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Same view in AWS X-Ray
23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Efficient function code Avoid “fat”/monolithic functions Control the dependencies in your function's deployment package Optimize for your language Node – Browserfy, Minify
24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Ephemeral function environment Lambda processes a single event per-container No need for non-blocking execution on the frontend REMEMBER – containers are reused Lazily load variables in global scope Don’t load it if you don’t need it
25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Ephemeral function environment import boto3 client = None def my_handler(event, context): if not client: client = boto3.client("s3") # process
26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Concise function logic Separate Lambda handler from core logic Use functions to TRANSFORM, not TRANSPORT Read only what you need Query filters in Amazon Aurora Use Amazon S3 select
27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Concise function logic (example) from mylib import MyLibClass def lambda_handler(event, context): operation = event['Operation’] myobj = MyLibClass() if operation == ‘do_this’: my_obj.do_this() elif operation == ‘do_that’: myobj.do_that() else: raise ValueError(‘Invalid op’)
28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Concise function logic (example) import boto3 ddb = boto3.client(‘dynamodb’) class MyLibClass(object): MY_CONSTANT = ‘blabla’ def __init__(…): # constructor def do_this(self): # use ddb to do this def do_that(self): # use ddb to do that from mylib import MyLibClass def lambda_handler(event, context): operation = event['Operation’] myobj = MyLibClass() if operation == ‘do_this’: my_obj.do_this() elif operation == ‘do_that’: myobj.do_that() else: raise ValueError(‘Invalid op’)
29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Small changes, big difference # Download and process all keys for key in src_keys: response = s3_client.get_object(…) contents = response['Body'].read() for line in contents.split('\n')[:-1]: line_count +=1 try: data = line.split(',') srcIp = data[0][:8] … # Select IP Address and Keys for key in src_keys: response = s3_client.select_object_content( expression=“SELECT SUBSTR(obj._1, 1, 8), obj._2 FROM s3object as obj”) contents = response['Body'].read() for line in contents: line_count +=1 try: … After (95s, $0.028) Before (200s, $0.112) https://github.com/awslabs/lambda-refarch-mapreduce
30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T SMART RESOURCE ALLOCATION Match resource allocation (up to 3 GB!) to logic Stats for Lambda function that calculates 1000 times all prime numbers <= 1000000 128 MB 11.722s $0.024628 256 MB 6.6789s $0.028035 512 MB 3.1949s $0.026830 1024 MB 1.4659s $0.024638
31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T “AWS Lambda Power Tuning” Data-driven cost & performance optimization for AWS Lambda github.com/alexcasalboni/aws-lambda-power-tuning Don’t guesstimate!
32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T No orchestration in code START JOB JOB #X STARTED HTTP POST HTTP POST ARE WE THERE YET? NOPE! WE’RE DONE! ZzZz OR time.sleep(10)
33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T No orchestration in code
34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Gateways & routers Choose suitable entry point for client applications Single, custom client? Use the AWS SDK Not end user facing? Use regional endpoints on API Gateway Discard uninteresting events ASAP S3 – Event prefix SNS – Message filtering
35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Resilient: retry policies Understand retry policies Sync never retried Async retried 2 times Streams retried all the time Leverage Dead Letter Queues (DLQ) SQS or SNS for replays REMEMBER: Retries count as invokes
36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Concurrency Controls Concurrency a shared pool by default Separate using per function concurrency settings Acts as reservation Also acts as max concurrency per function Especially critical for data sources like RDS “Kill switch” – set per function concurrency to zero
37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. S U M M I T Should my Lambda function be in a VPC? Does my function need to access any specific resources in a VPC? Does it also need to access resources or services in the public internet? Don’t put the function in a VPC Put the function in a private subnet Put the function in a subnet with a NAT’d route to the internet Yes Yes No No Do I need a VPC?
38. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
39. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.