On-demand image scaling with AWS Lambda Claudio Mettler 

Project • Cloudification of a monolithic customized CMS based on TYPO3 CMS (PHP/MySQL) for an online news platform • Image scaling built into CMS/template language (TYPO3/fluid) • Unreliable • Slow 

Template View Helpers 
 
 

No content

Main Issues • Files on disk/EFS (and all in the same folder too!) • Lots of database queries • Unreliable 

Replacement requirements • Use S3 (and Cloudfront) • Must be on-demand: required sizes can't be anticipated at time of upload • Minimize high-latency and high-CPU operations in page generating process • Minimize shared state/coupling for robustness 

Step 1: Encode information in filename Original:
 /o/[content hash]-[namespace]-[id]-[w]-[h].jpg • Happens on image upload • Client library takes image file and namespace/id, uploads the file to S3 and returns path 

Step 2: Derive scaled filename from original Scaled: /s/[content hash]-[namespace]-[id]-[ow]-[oh]/[w]x[h].jpg • Client library takes original path and scaling configuration, returns scaled path • No interaction with S3 or database necessary • This is all that has to be done on page generation 

Step 3: Get S3 to act when scaled version doesn't exist • S3 can't trigger lambda and hold the request • It can Issue redirects and append the request path 

S3 Routing Rules s/ 404 https [api gateway url] prod/s/ 302 

Step 4: Lambda scaling task • Derive original path from scaled path • Fetch & scale original image • Save to S3 • Redirect back to S3 • For future requests, image will be directly delivered by S3 

Step 5: Clean up • Trigger cleanup Lambda task every time an original is deleted • Task deletes all scaled versions of the image 

Security considerations • If i can create arbitrarily scaled versions of an image, so can everyone on the internet • Easy to drive Lambda and S3 costs up with a few HTTP requests 

Solution: HMAC • Hash Message Authentication Code • Sign request URL with a shared key • Will not prevent people from invoking Lambda • Will prevent expensive operations on Lambda • Ideally, Cloudfront would handle redirects internally and never expose API Gateway URLs 

Scaled image URL /s/38fff39b6a847fc2d349bd331d9919adf5648ff8- zna-312468-240-160/317x211m.jpg?dyCQEqMUMa9n0LDzuciu7o5Tvvw%3D 

Demo • 16 JPEG pictures, 2448x2448, 1.2-1.6 MB in size each • Scaled down to 1000x1000 

No content

No content

No content

No content

Questions? [email protected] Terraform module: https://github.com/ponyfleisch/lambdaautoscale
 
 PHP Client lib: https://github.com/ponyfleisch/clownfish-client-php