Creating Serverless apps for NASA in GovCloud
•Download as PPTX, PDF•
1 like•391 views
Presentation given at AWS Public Sector Summit 2019 as the first "DevChat" session: fast, scaling with Lambda, architectural evolution, security to get ATO, benefits
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Creating Serverless apps for NASA in GovCloud
Similar to Creating Serverless apps for NASA in GovCloud (20)
More from Chris Shenton
More from Chris Shenton (11)
Recently uploaded
Recently uploaded (20)
Creating Serverless apps for NASA in GovCloud
- 1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Creating serverless apps for NASA inGovCloud Chris Shenton Chief Technical Officer V! Studios D E V 0 1
- 2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Agenda What’s the problem? Current approaches do not work well Going serverless with AWS Lambda Our serverless architecture Addressing NASA security concerns Benefits of going serverless (and some drawbacks)
- 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T
- 4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Life-threateningsuit failureon spacewalk On July 16, 2013, water filled the helmet of astronaut Luca Parmitano, creating a life-threatening scenario which forced NASA to abort the spacewalk.
- 5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Challenges Designs, reports on paper or scanned without OCR Engineering that has worked for decades is not changed lightly OCR required for 100,000 pages per month About a half a shipping pallet of paper each month Attempts to OCR overwhelmed current data integration system Started to add OCR in 2015 but had to stop Resorted to OCRing only the title page of each report
- 6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T
- 7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Datacenterdoes not scale Traditional server
- 8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Cloud canscale,but... Amazon Simple Queue Service Auto Scaling group Instances
- 9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Containers scalebut add complexity Amazon Simple Queue Service Amazon Elastic Container Service
- 10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T
- 11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Serverlessisservice-ful Services include Compute Database Authentication Almost anything else Managed by cloud provider System Security Scaling Pay only for what you use 100% utilization No idle time Build business value, not infrastructure
- 12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T AWS Lambda: event-drivencomputing Pushed events include API Gateway Simple Storage Service Simple Notification Service CloudWatch Logs, Events Cognito Alexa Polled sources DynamoDB Simple Queue Service Kinesis Custom Invoke Lambda with API call Amazon Simple Storage Service (S3) Amazon API Gateway Amazon DynamoDB AWS Lambda AWS Lambda processes event
- 13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T
- 14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Serverlessusingbuilt-in scaling AWS Lambda auto-scaling Lambda function for OCR PDF multipage documents Text multipage documents
- 15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Serverlessexploiting parallelism AWS Lambda auto-scaling Lambda function: split doc into pages AWS Lambda auto-scaling Lambda function: OCR a single page PDF multipage documents PDF pages Text pages
- 16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Serverlessevent-driven workflow AWS Lambda auto-scaling VPC NASA address space EDI Application EDI Search API EVA Data Integration systems VPC Private address space /16 Split OCR Combin e Output /text_pages / /text_docs/ /pdf_pages / /pdf_docs/ PDF doc PDF doc PDF page s Text page s JSON doc Text page s Amazon Simple Storage Service (S3)
- 17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T
- 18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Securitycontrols to getNASAATO AWS Lambda VPC Lambda VPC Private address space /16 = 65535 IPs VPC EDI VPC NASA address space limited IPs Amazon Simple Storage Service (S3) Security group Allow to port 5333 Lambda not yet FedRAMP certified in GovCloud Security team required controls: GovCloud: NASA design docs are sensitive Separate VPC for Lambdas No VPC network egress for Lambdas IAM policies, roles restrict access Security Group allows output of final Lambda to EDI Search API Encrypted data in transit and at rest Static code analysis S3 VPC Endpoint avoided need for NAT, IGW egress S3 lifecycle expiration: auto-delete files after 1 day
- 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Secure integrationto EDIsystemsviaIAMRoles,Policies /doc_pd f/ Amazon Simple Storage Service (S3) /doc_pdf/ /page_pdf/ /page_text/ /doc_text/ /doc_pdf/ Security group marker sg-001 Security group • allow from sg-001 • to port 5333
- 20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T
- 21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T ServerlessBenefits Lower cost 80-90% less to run than conventional cloud Give each developer their own environment Automatic scaling No infrastructure to manage Security is outsourced Faster development, deploy Allows new way of thinking, problem solving, architectures Decompose monolithic procedures into functions Invoke each with event triggers “Function as a Service”
- 22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T ServerlessDrawbacks Implementations are opinionated Languages Run duration Memory and disk Vendor lock-in FUD factor But you want to use all the cloud provider’s services anyway! Local development and integration testing is more difficult Your laptop is not a cloud Overloading external services Your other systems may not keep up with 100s of Lambdas trying to connect SQL databases Enterprise authentication and authorization
- 23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Big winsfor NASA Ability to OCR all pages of every report improves astronaut safety Solve mission problems quickly and cost-effectively From design to production deployment in 2 months Avoiding classic cloud autoscaling, load-balancers saved a ton of time Frequent deployments were a breeze using the Serverless Framework Integration with other NASA systems took most of our time Convincing other teams we weren’t insane was critical Estimated cost to OCR 100,000 pages: $200 With tuning, we could get this down to about $20 It’s very fast, too We are expanding our serverless-based projects with EVA and other groups
- 24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T “The work you’ve accomplished is a big step proving out this new technology for NASA.” NASA EVA Office
- 25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Thank you! © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R S U M M I T Chris Shenton chris@v-studios.com @shentonfreude
Editor's Notes
- We’ve been building cloud infrastructure and cloud-native apps for NASA on AWS for about 7 years. Today I’ll be talking about how we deployed NASA’s first Serverless solution in AWS GovCloud.
- Once safely back on Earth, NASA needed to diagnose the problem and find the cause of the problem. Photo: https://upload.wikimedia.org/wikipedia/commons/thumb/8/82/ISS-36_The_faulty_Extravehicular_Mobility_Unit_%28EMU%29_spacesuit_helmet.jpg/1280px-ISS-36_The_faulty_Extravehicular_Mobility_Unit_%28EMU%29_spacesuit_helmet.jpg Video of the EVA: https://www.youtube.com/watch?v=MXunHkZHu1o Luca’s blog entry is harrowing reading: http://blogs.esa.int/luca-parmitano/2013/08/20/eva-23-exploring-the-frontier/
- At a previous AWS Public Sector Summit, we met with NASA’s EVA Office and showed them work we were doing with Lambda and OCR.
- Moving this to cloud doesn’t scale either.
- Auto-scaling groups, scale up/down policies, cool-down periods, …
- If only there was a better way…
- Think of Serverless like Uber: you could buy a car (high capital expenditure), pay for maintenance, and gas, and you amortize over many years; or you could hail an Uber, it picks you up quickly and drops you off, and you stop paying anything.
- Or course there are servers in “serverless” All those servers in the previous sides run 24x7. You probably have them duplicated for dev, QA and production. Image: Galactic cosmic rays, from NASA: https://roundupreads.jsc.nasa.gov/pages.ashx/714/Positive%20negative%20or%20neutral%20it%20all%20matters%20NASA%20explains%20space%20radiation
- There are 15 services that can “push” events currently. Re-think your architecture to trigger by events and their content: Lambda is “function as a service”.
- How we evolved our architecture, from concept to implementation.
- The big insight we had was that we could exploit parallelism even further.
- The EDI application dropped PDFs into our S3 bucket, which triggered Lambda processes, When deposited their outputs back into S3 to trigger the next lambdas in the pipeline. S3 “folder” prefixes were used to select which lambda to invoke. This allowed us to avoid using a database to track progress of documents and pages.
- The Government has more stringent requirements for technology adoption than commercial organizations. This is how we got our Security team to be comfortable with this new tech.
- Lambda currently under Joint Authorization Board review for GovCloud. Lambdas in VPCs aren’t best practices – cold-start time due to adding Elastic IP -- but it’s what our Security team needed to feel comfortable
- The EVA Data Integration systems trust each other using NASA enterprise authentication and “service accounts”; we knew this would not be able to keep up with high-volume Lambda requests, so used cloud-based IAM
- Instead of monoliths on a server, we decompose our modules into functions, and instead of calling each function, we trigger it with an event: Function as a Service (FaaS)
- Lambda supports: JavaScript, Python, Go, PHP, C#, Java, Ruby, PowerShell Efforts to emulate cloud services (e.g., AWS SAM Local, Atlassian LocalStack) but can never replicate AWS Move to cloud-native databases like DynamoDB and IAM-based security
- Short deadline: had to deliver before end of fiscal year. You’ll need to build trust for this new fangled Buck Rogers stuff.
- Our technical team, together with our NASA project leaders, were given a Group Achievement Award by NASA’s Administrator, Jim Bridenstine, for this pioneering work. For new applications, we think not just “Cloud First”, but “Serverless First!” It’s a game-changer. Award: “For exceptional innovation pioneering the first “serverless” solution in NASA OCIO’s GovCloud to enable rapid access to Extra-Vehicular Activity design and maintenance data with minimal expense"
- If you feel like discussing this later, hit me up and we can even whiteboard some ideas if you like. What questions do you have?