A presentation about SRE in Serverless world. Presented at Amsterdam DevOps engineers meetup on 12th Of June 2019

3. SRE In Serverless
World2019Stanislav Pogrebnyak

4. Let me introduce myself
• Before:
→ C/C++ developer for embedded software
→ Tech lead at the Digital Marketing platform
• This days:
→ Exploring topics like SRE, Chaos Engineering, DevOps
→ Working together with Portbase on super awesome SRE program
• Twitter: @pogrebnyak

5. Two main directions of today’s
talk:• Serverless for SRE
• SRE for Serverless
XEBIA7

6. 8

7. Serverless can be that very same tool for functional
and non-functional requirements
XEBIA9

8. Security for Serverless
• Shiny new things:
→ Cost attack
→ Cryptojacking
→ OWASP Top 10 Serverless
• Useful to explore:
→ https://www.puresec.io/blog
→ https://github.com/OWASP/Serverless-Goat
→ https://www.protego.io/blog/
• Xebia’s: “AWS Lambda Security Training“ by Ben de
Haan
XEBIA10

9. Serverless for Security
• Security threats detection automation
• Alerting automation
• Proactive actions(blocking bad actors) automation
• Secrets scanning automation
• Many other automations
• Authentication/authorization
XEBIA11

10. Chaos engineering for serverless
applications• Gremlin.com – Application level fault injection (ALFI)
• Injecting Chaos to AWS Lambda functions using Lambda Layers by
Adrian Hornsby
• Applying the Principles of Chaos to Serverless By Yan Cui
• https://github.com/artilleryio/chaos-lambda – not active for more than
a year
XEBIA12

11. How to avoid vendor lock with serverless applications?
XEBIA13
Well, first of, all is there a problem?
This is one opinion

12. How to avoid vendor lock with serverless applications?
XEBIA14
Well, there is a problem!
This is alternative
one

13. Few good practices:
• Move knowledge about platform execution as high up in the code
as possible
• Just for fun – try to run it outside the platform you’re using
• Separate concerns
• Show us some code, Stan!!!
XEBIA15

14. What about costs?
XEBIA16

15. Cost model
• A few facts:
→ Usually lower costs on small amount of
events
→ Can scale down to 0 – so potentially with
free tiers can be for free
→ With a lot of events can be significantly more
expensive than “traditional model”
• What can help:
→ Events batching
→ Faster runtimes(Go vs Nodejs)
→ Throttling
→ Costs Alerts !!! First thing should be!!!
XEBIA17

16. And remember
XEBIA18

17. And the last but not least:
Let’s coin some cool terms as well
• DevServerlessOps for example
• Or SRE (Serverless reliability engineer)
XEBIA19

18. Questions?