Enterprise serverless

Enterprise Serverless
Justin Wood & Dmitry Lozitskiy
J U L Y 2 0 2 0

“The rapid adoption of
serverless is happening in
the enterprise”
W e r n e r V o g e l s | A W S r e : I n v e n t 2 0 1 9

3 | © 2020. For information, contact Deloitte Touche Tohmatsu Limited.
Current State of Serverless
Earlier this year Datadog has released ”The State Of Serverless” report. There are some interesting revelations showing that it’s not only widely adopted but is most of the time a
preferred choice of technology, particularly by companies who are already using containers technologies.

Brief History of Serverless
Working backwards with customers back in 2012, Amazon Storage Division (S3, EBS) realized the need for a compute model similar to S3 super simple storage model with its PUT, GET
and LIST. This is what eventually was created by Tim Wagner’s team and became AWS Lambda with its notion of “invoke in the cloud”. Lambda’s initial goal was to produce thumbnails
of images uploaded to S3, The team didn’t expect that Lambda will cause a revolution in Cloud Computing.
Tim Wagner,
creator of AWS Lambda

Why Serverless?
Computing has evolved over time to higher levels of flexibility, finer grained levels of control and lower cost of maintenance. Serverless is currently the most advanced stage of
this evolution.

Serverless vs Microservices
The Microservices is now a popular architectural style and is recognised as the de-facto approach for decomposing monoliths.
Serverless is Microservices without servers (or containers) where the Cloud is the platform.
Differences Similarities
o Scale with complexity
o PaaS systems still incur the costs of worker nodes
o Containers are analogues for servers
o Application is decomposed
and features are isolated
o Services are managed
independently
o Scale with simplicity
o Reduced operational cost
o Lower capacity demands
o Easier operational management
MicroservicesServerless

Serverless Application Building Blocks
This diagram shows the foundational building blocks for a good serverless application

Enterprise Challenges
Although a serverless application development model has clear benefits, there is still a substantial adoption barrier that enterprise organizations face when embarking on a
serverless journey.
How to operate serverless
environment at scale?
How to control access to
serverless infrastructure
and applications?
How to ensure
resiliency of
serverless
applications?
How to optimize
performance of
serverless applications?
How to optimize cost of
serverless applications?

What Good Looks Like
For successful adoption of serverless application development model, it is crucial to establish a solid foundation. Well-Architected Framework helps to address adoption
challenges upfront.
E N T E R P R I S E S E R V E R L E S S
DevSecOps
Test Driven Development
Embedded Standards
Tracing, Logging, Monitoring and Alerting
Code Metrics
Mocking Framework
Opinionated
Everything fails all the time

Serverless Lens
In 2015, AWS released Well-Architected Framework - structured way of comparing cloud workloads against architectural best practices. In 2017, AWS extended the framework’s
general advice to be more application and domain specific with the concept of a “lens". A lens are specific technology areas, which focus on specific extensions to generic advice.
Serverless is one of the available lenses.
https://bit.ly/3g59PbL

DevSecOps: Infrastructure as Code
Using infrastructure as code approach may seem tedious and time consuming, however by eliminating manual ops out of the change release process it pays back very quickly.
Advantages:
• Deploy applications in a repeatable manner
• Reduce risks of errors caused by manual processes
• Embed security and coding standards into the build process
• Track and audit changes and releases over time
• Have a safe roll back strategy
AWS CDK AWS SAM SERVERLESS FRAMEWORK
AWS CLOUDFORMATION
creates

DevSecOps: Tools to help
• sam local invoke and sam local
start-api for local development,
debugging and testing
• sam local generate-event to generate
a mock of AWS service event
• sam local start-lambda for mocking
AWS Lambda locally (to write integration
tests)
DynamoDB local:
$ docker run -p 8000:8000 amazon/dynamodb-local -jar DynamoDBLocal.jar -inMemory –sharedDb
$ aws dynamodb create-table --table-name tracing-app --attribute-definitions
AttributeName=id,AttributeType=S --key-schema AttributeName=id,KeyType=HASH --billing-mode
PAY_PER_REQUEST --endpoint-url http://localhost:8000
AWS SAM CLI
Extending the developer's toolchain with local serverless development frameworks helps to improve agility and reduces iterations required to release features into production.

DevSecOps: Tools to help
$ pip install localstack
$ localstack start

DevSecOps: Maximize productivity
$ aws s3 mb s3://localstack-app-bucket --endpoint-url http://localhost:4566
$ sam local start-api --skip-pull-image --env-vars sam-local.env.json
$ curl -X POST http://localhost:3000/upload -d '{"message": "localstack bucket upload"}'
$ aws s3 ls s3://localstack-app-bucket --endpoint-url http://localhost:4566
2020-07-22 13:33:56 39 84bb000d2a5adde8e86ad16fedcd833e.file
https://bit.ly/3jFcGdD

DevSecOps: Continuous Delivery Example
Robust Continuous Delivery process ensures that changes delivered to production are immutable across stages, production environment is safe-guarded from untested
deployments at early stages.
Example of single branch Dev CI/CD pipeline
https://bit.ly/2EnWHRd
Advantages:
• Serverless starts with the
pipeline itself
• Single branch pipeline for
small teams
• Dynamic branch pipeline
for bigger and mature
teams

DevSecOps: Release Process Example
Code review process is enforced for production changes via IAM role policy, allowing developers to push code into the feature branches and create pull requests to merge code
into the master branch.
Advantages:
• Code is merged into master branch via Pull Request
• Peer-review of the code is enforced by developer IAM role policy
Example of Production CI/CD pipeline

DevSecOps: Security is a responsibility
In Shared Responsibility Model for Serverless Applications, application owners are responsible to ensure that the application is resilient to attacks.
Top 10 most critical security risks for
Serverless Applications:
https://github.com/puresec/sas-top-10
https://owasp.org/www-project-serverless-top-
10/
Top 10 serverless threats:

DevSecOps: Security negligence impacts
Applying security in-depth approach to secure serverless applications is must, especially when dealing with customer data and PII.
OWASP Serverless Goat:
https://github.com/OWASP/Serverless-Goat

DevSecOps: Shifting security left
Improving cloud security posture by shifting security left in software delivery process.
Open source vulnerability scanner tool:
• Helps to discover known vulnerabilities before the code
hits the repository via IDE integration
• Smoothly integrates with existing CI/CD process
• Continuously monitors deployed serverless functions for
newly discovered vulnerabilities
https://bit.ly/3hCqMup

DevSecOps: Security in-depth
Improving code centric security as well as ensuring runtime security is critical, especially when dealing with customer data.
• Runtime Protection (Function Self Protection)
ü detects and stops application attacks
(SQL injection, XSS, etc.)
ü profiles function and application
behaviour
ü detects and prevents an anomaly
behaviours
• Risk Assessment (Proact)
ü scans function before deployment
ü detects permissive roles
ü detects vulnerable dependencies
ü detects hardcoded credentials
ü checks rules violation

Observability is crucial for serverless applications. With its distributed nature, serverless applications can easily span to hundreds of functions calling hundreds of other services.
Applying traditional monolith application approaches for serverless observability won’t work.
AWS X-Ray helps to some extent with distributed tracing, but mainly focused around
measuring execution times and identifying performance bottlenecks
https://bit.ly/3hCdDS4

Observability is crucial for serverless applications. With its distributed nature, serverless applications can easily span to hundreds of functions calling hundreds of other services.
Applying traditional monolith application approaches for serverless observability won’t work.
AWS ServiceLens comes to help and bridges the gap between X-Ray and CloudWatch by
integrating traces, metrics, logs, and alarms into one place
Current limitations:
• Trace segments inside Lambda functions are
immutable
• No way to override segment trace id and
parent id
• Not suitable for large scale serverless
applications

Observability at scale requires right tools, the state of observability of serverless architecture is critical and will directly impact business performance.

Performance: Execution environment
Due to the nature of serverless compute performance is not always proportional to cost, it takes time an effort to find a balance for each individual workload
Warm
environment?
Find compute
Download
code
Start execution
environment
InitializationInvoke handler
Lambda Service
Request
Response

Performance: Static initialization
Cold start is influenced by:
• Memory allocation
• Size of the function
• Static initialization
Static initialization is influenced by:
• Size of function package
• Amount of initialization work

Performance: Optimization strategies
Code optimization:
• Optimise dependencies
• Reuse connections
• Node.js – minify/uglify (32 times less in size)

Performance: Tuning
https://bit.ly/30QdBPL

Performance: Tuning

Next Level: Operational Excellence
There are many frameworks that speed the development of Serverless applications but ultimately the development team uses a full technology stack and follows a set of
practices and processes that support high quality, high velocity Agile development.
Templates
Standard patterns are implemented as templates use
in generators to create standardized code. Templates
are independently maintained in library.
Standard Architectural Patterns
Serverless architectures have grown, evolved and
coalesced into standardised patterns. We catalogue
and apply these patterns in consistant ways to our
implementation. Operating Model
The team is build for success with the appropriate
governance and stakeholders from Deloitte, AWS and the
business.
Code Snippets
A set of curated and consistant code snippets for
carrying out standard operations. Frictionless Communication
We recognize the importance of communication
between the various team members and stakeholders
especially when you consider that resources may be
drawn from various geographical locations to
leverage expertise and economies.
Delivery Framework
The team works in a well-defined agile delivery framework.
Behaviour Driven Development
Specifications form the foundations for tests so that
there is direct traceability to requirements and in a
way that facilitates automation.
Team Analytics
As an agile team progresses through delivery measurement
of team metrics in relation to velocity is key to understanding
the levers for continuous improvement
Generators
We use code generation to implement standard
patterns and enforce the use of the standardized
serverless framework componentry. Templates and
snippets are brought together by generators that free
the developer from inconsistent cut-and-paste.
Automated Code Review
By enforcing pull request and using bots to do linting
and test coverage we build quality into the release
process.
Evangelise and Educate
In an environment rooted in traditional development the
serverless ways of work, it’s advantage and mix of
technologies might not be accepted and embraced so we
work with the development teams and the business to make
sure serverless is understood.
Cross Functional
The team is built with a full complement of the roles required
for successful serverless cloud development
Accelerators Team

Operating Models
The high performing team will be able to fulfill all the roles described here in a well formed and well governed team.
Scrum Master
Serverless Development
Lead
Serverless Developers
AWS DevOps Specialist
Business Analyst Tester
Cloud Architect
Product Owner
Test Lead
Tester
Business Analyst / SME
Guru Cloud Architect
Engagement LeadPractice Manager
Development
Manager
Executive Sponsor
Governance Dev
Modernisation Program Lead

https://bit.ly/32VDHnb
Help us to make it better by providing your feedback:

Enterprise serverless

More Related Content

What's hot

Similar to Enterprise serverless

Recently uploaded

Enterprise serverless