Find out more about Serverless Stacks

1. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Woody Borraccino, AWS Solutions Architect
5/3/2017
Deep Dive on Serverless Stack

2. Agenda
What is a Serverless Application?
What do we need to think about when building one?
• Bundling and Deploying
• Continuous Integration & Continuous Delivery
• Versioning, Stages, Variables
• Metrics, Monitoring, Logs, and Profiling

3. No servers to provision
or manage
Scales with usage
Never pay for idle Availability and fault
tolerance built in
Serverless means…

4. Serverless application
EVENT SOURCE SERVICES (ANYTHING)
Changes in
data state
Requests to
endpoints
Changes in
resource state
FUNCTION
Node.js
Python
Java
C#

5. API Gateway
Internet
Mobile Apps
Websites
Services
AWS Lambda
functions
AWS
API Gateway
Cache
Endpoints on
Amazon EC2
All publicly
accessible
endpoints
Amazon
CloudWatch
Monitoring
Amazon
CloudFront
Any other
AWS service

6. Amazon S3 Amazon
DynamoDB
Amazon
Kinesis
AWS
CloudFormation
AWS CloudTrail Amazon
CloudWatch
Amazon
Cognito
Amazon SNSAmazon
SES
Cron events
DATA STORES ENDPOINTS
CONFIGURATION REPOSITORIES EVENT/MESSAGE SERVICES
Example event sources that trigger AWS Lambda
… and a few more with more on the way!
AWS
CodeCommit
Amazon
API Gateway
Amazon
Alexa
AWS IoT AWS Step
Functions

7. Common use cases
Web
Applications
• Static
websites
• Complex web
apps
• Packages for
Flask and
Express
Data
Processing
• Real time
• MapReduce
• Batch
Chatbots
• Powering
chatbot logic
Backends
• Apps &
services
• Mobile
• IoT
</></>
Amazon
Alexa
• Powering
voice-enabled
apps
• Alexa Skills
Kit
IT
Automation
• Policy engines
• Extending
AWS services
• Infrastructure
management

8. Building a deployment package
Node.js & Python
• .zip file consisting of
your code and any
dependencies
• Use npm/pip to
install libraries
• All dependencies
must be at root level
Java
• Either .zip file with all
code/dependencies,
or standalone .jar
• Use Maven / Eclipse
IDE plugins
• Compiled class &
resource files at root
level, required jars in
/lib directory
C# (.NET Core)
• Either .zip file with all
code/dependencies,
or a standalone .dll
• Use NuGet /
VisualStudio plugins
• All assemblies (.dll)
at root level

9. Create templates of your infrastructure
CloudFormation provisions AWS resources
based on dependency needs
Version control/replicate/update templates like
code
Integrates with development, CI/CD,
management tools
JSON and YAML supported
AWS CloudFormation

10. AWS Serverless Application Model (SAM)
CloudFormation extension optimized for
serverless
New serverless resource types: functions,
APIs, and tables
Supports anything CloudFormation supports
Open specification (Apache 2.0)

11. AWSTemplateFormatVersion: '2010-09-09'
Resources:
GetHtmlFunctionGetHtmlPermissionProd:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:invokeFunction
Principal: apigateway.amazonaws.com
FunctionName:
Ref: GetHtmlFunction
SourceArn:
Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ServerlessRestApi}/Prod/ANY/*
ServerlessRestApiProdStage:
Type: AWS::ApiGateway::Stage
Properties:
DeploymentId:
Ref: ServerlessRestApiDeployment
RestApiId:
Ref: ServerlessRestApi
StageName: Prod
ListTable:
Type: AWS::DynamoDB::Table
Properties:
ProvisionedThroughput:
WriteCapacityUnits: 5
ReadCapacityUnits: 5
AttributeDefinitions:
- AttributeName: id
AttributeType: S
KeySchema:
- KeyType: HASH
AttributeName: id
GetHtmlFunction:
Type: AWS::Lambda::Function
Properties:
Handler: index.gethtml
Code:
S3Bucket: flourish-demo-bucket
S3Key: todo_list.zip
Role:
Fn::GetAtt:
- GetHtmlFunctionRole
- Arn
Runtime: nodejs4.3
GetHtmlFunctionRole:
Type: AWS::IAM::Role
Properties:
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Action:
- sts:AssumeRole
Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
ServerlessRestApiDeployment:
Type: AWS::ApiGateway::Deployment
Properties:
RestApiId:
Ref: ServerlessRestApi
Description: 'RestApi deployment id: 127e3fb91142ab1ddc5f5446adb094442581a90d'
StageName: Stage
GetHtmlFunctionGetHtmlPermissionTest:
Type: AWS::Lambda::Permission
Properties:
Action: lambda:invokeFunction
Principal: apigateway.amazonaws.com
FunctionName:
Ref: GetHtmlFunction
SourceArn:
Fn::Sub: arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${ServerlessRestApi}/*/ANY/*
ServerlessRestApi:
Type: AWS::ApiGateway::RestApi
Properties:
Body:
info:
version: '1.0'
title:
Ref: AWS::StackName
paths:
"/{proxy+}":
x-amazon-apigateway-any-method:
x-amazon-apigateway-integration:
httpMethod: ANY
type: aws_proxy
uri:
Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-
31/functions/${GetHtmlFunction.Arn}/invocations
responses: {}
swagger: '2.0'
CloudFormation template

12. SAM template
AWSTemplateFormatVersion: '2010-09-09’
Transform: AWS::Serverless-2016-10-31
Resources:
GetHtmlFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: s3://flourish-demo-bucket/todo_list.zip
Handler: index.gethtml
Runtime: nodejs4.3
Policies: AmazonDynamoDBReadOnlyAccess
Events:
GetHtml:
Type: Api
Properties:
Path: /{proxy+}
Method: ANY
ListTable:
Type: AWS::Serverless::SimpleTable

13. Lambda Environment Variables
Key-value pairs that you can dynamically pass to your
function
Available via standard environment variable APIs such as
process.env for Node.js or os.environ for Python
Can optionally be encrypted via KMS
• Allows you to specify in IAM what roles have access to the keys
to decrypt the information
Useful for creating environments per stage (i.e. dev,
testing, production)

14. API Gateway Stage Variables
• Stage variables act like environment variables
• Use stage variables to store configuration values
• Stage variables are available in the $context object
• Values are accessible from most fields in API Gateway
• Lambda function ARN
• HTTP endpoint
• Custom authorizer function name
• Parameter mappings

15. Stage variables and Lambda alias for stages
Using Stage Variables in API Gateway together with Lambda function Aliases
helps you manage a single API configuration and Lambda function for multiple
stages
myLambdaFunction
1
2
3 = prod
4
5
6 = beta
7
8 = dev
My First API
Stage variable = lambdaAlias
Prod
lambdaAlias = prod
Beta
lambdaAlias = beta
Dev
lambdaAlias = dev

16. Fully managed build service that compiles source code,
runs tests, and produces software packages
Scales continuously and processes multiple builds
concurrently
You can provide custom build environments suited to
your needs via Docker images
Only pay by the minute for the compute resources you
use
Launched with CodePipeline and Jenkins integration
AWS CodeBuild

17. version: 0.1
environment_variables:
plaintext:
"INPUT_FILE": "saml.yaml”
"S3_BUCKET": "”
phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
build:
commands:
- npm test
post_build:
commands:
- aws cloudformation package --template $INPUT_FILE --s3-
bucket $S3_BUCKET --output-template post-saml.yaml
artifacts:
type: zip
files:
- post-saml.yaml
- beta.json
buildspec.yml Example

18. version: 0.1
environment_variables:
plaintext:
"INPUT_FILE": "saml.yaml”
"S3_BUCKET": "”
phases:
install:
commands:
- npm install
pre_build:
commands:
- eslint *.js
build:
commands:
- npm test
post_build:
commands:
- aws cloudformation package --template $INPUT_FILE --s3-
bucket $S3_BUCKET --output-template post-saml.yaml
artifacts:
type: zip
files:
- post-saml.yaml
- beta.json
• Variables to be used by phases of
build
• Examples for what you can do in
the phases of a build:
• You can install packages or run
commands to prepare your
environment in ”install”.
• Run syntax checking,
commands in “pre_build”.
• Execute your build
tool/command in “build”
• Test your app further or ship a
container image to a repository
in post_build
• Create and store an artifact in S3
buildspec.yml Example

19. What service and release step corresponds with which tests?
UI
Service
Unit
Third Party
Tooling
AWS CodeBuild
BuildTest

20. Continuous delivery service for fast and
reliable application updates
Model and visualize your software release
process
Builds, tests, and deploys your code every time
there is a code change
Integrates with third-party tools and AWS
AWS CodePipeline

21. Source
Source
GitHub
Build
CodeBuild
AWS CodeBuild
Deploy
JavaApp
Elastic Beanstalk
AWS CodePipeline
MyApplication

22. Deploy via CodePipeline
Pipeline flow:
1. Commit your code to a source code repository
2. Package in CodeBuild
3. Use CloudFormation actions in CodePipeline to
create or update stacks via SAM templates
Optional: Make use of ChangeSets
4. Make use of specific stage/environment
parameter files to pass in Lambda variables
5. Test our application between stages/environments
Optional: Make use of Manual Approvals

23. • Gain system-wide visibility into resource utilization,
application performance, and operational health
• Collect and track metrics with CloudWatch Metrics
• Collect and monitor log files with CloudWatch Logs
• Set alarms and send messages to SNS
• Automatically react changes via CloudWatch Events
Amazon CloudWatch

24. Custom
CloudWatch
Dashboards

25. • Identify performance bottlenecks and errors
• Pinpoint issues to specific service(s) in your
application
• Identify impact of issues on users of the
application
• Visualize the service call graph of your
application
AWS X-Ray

26. Service map

27. Trace view

28. INTRO
Robert Kehoe
F-Secure, Security Cloud Team

29. THE CHALLENGE
 How to monetize our existing APIs?
 Constraints:
 Don’t want to expose entire API
 Some APIs are purely internal (provisioning, licensing, etc…)
 Don’t want to handle credit cards / billing (PCI compliance)
 Don’t want to have to modify existing APIs / code

30. THE SOLUTION
 Amazon API Gateway Integration with AWS Marketplace
 F-Secure Security Cloud API for URLs

31. © F-Secure
Existing F-Secure
Security Cloud
Reputation API
F-Secure Security
Cloud API for
URLs
Amazon API
Gateway
Amazon API
Gateway
AWS Lambda
AWS Marketplace
Users
F-Secure
Developer Portal
AWSKMS Amazon
DynamoDB
F-Secure Security Cloud API for
URLs
3. Call API with API Key
1. Subscribe to service
4. Get URL reputation
back
2. Get an API Key
F-Secure Security Cloud API for URLs
https://aws.amazon.com/marketplace/pp/B01N3NNLIW

32. WHY
SERVERLESS?

33. LESS MOVING PARTS
1 CloudFormation stack, with 12 resources
Packaged & Deployed with AWS SAM
3 CloudFormation stacks, with +100 resources

34. A FEW TIPS
 API Gateway
 Binary support, AWS SAM,
aws-serverless-express, etc…
 Not for every use case
 Large binaries, long running
tasks or single digit ms
response times
 Amazon API Gateway
Integration with AWS
Marketplace
 Creating an API takes ~2
minutes
 Business side takes more
time…
 Starter project on
GitHub/AWSlabs
 aws-api-gateway-developer-
portal

35. Next steps
• See https://aws.amazon.com/serverless for reference
architectures, samples, and links to more content!
• Explore the AWS SAM specification on GitHub
• Visit the Lambda console, download a blueprint, and get
started building your own Serverless Applications
• Send us your questions, comments, and feedback on the
AWS Lambda Forums.

36. Thank you!
Woody Borraccino, AWS Solutions Architect