© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
Serverless Architectural Patterns
Boaz Ziniman, Technical Evangelist – Amazon Web Service
@ziniman
boaz.ziniman.aws
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
Serverless Beyond Lambda
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
Pattern 1:
Web App/Microservice/API
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Web application
Data stored in
Amazon
DynamoDB
Dynamic content
in AWS Lambda
Amazon API
Gateway
Browser
Amazon
CloudFront
Amazon
S3
Amazon Cognito
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon API
Gateway AWS
Lambda
Amazon
DynamoDB
Amazon
S3
Amazon
CloudFront
• Bucket Policies
• ACLs
• Origin Access Identity (OAI)
• Geo-Restriction
• Signed Cookies
• Signed URLs
• DDOS Protection
IAM IAM
Serverless web app security
• Throttling
• Caching
• Usage Plans
• ACM
Static Content
Browser
Amazon Cognito
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Custom
Authorizer
Lambda
functionClient
Lambda
function
Amazon API
Gateway
Amazon
DynamoDB
AWS Identity &
Access Management
SAML
Two types:
• TOKEN - authorization token
passed in a header
• REQUEST – all headers, query
strings, paths, stage variables or
context variables.Custom
Authorizer
Cognito
User Pool
Custom Authorizers
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-Region with API Gateway
us-west-2
us-east-1
Client
Amazon
Route 53
Regional
API
Endpoint
Regional
API
Endpoint
Custom
Domain
Name
Custom
Domain
Name
API Gateway
API Gateway
Lambda
Lambda
api.mycorp.com
CNAME
CNAM
E
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
http://bit.ly/ServerlessShop
https://github.com/patrick-michelberger/serverless-shop
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
Pattern 2:
Stream Processing
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Stream processing characteristics
• High ingest rate
• Near real-time processing (low latency from ingest to
process)
• Spiky traffic (lots of devices with intermittent network
connections)
• Message durability
• Message ordering
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Streaming data ingestion
Amazon CloudWatch:
Delivery metrics
Amazon S3:
Buffered files
Kinesis
Agent
Record
Producers Amazon Redshift:
Table loads
Amazon Elasticsearch Service:
Domain loads
Amazon S3:
Source record backup
AWS Lambda:
Transformations &
enrichment
Amazon DynamoDB:
Lookup tables
Raw records
Lookup
Transformed records
Transformed recordsRaw records
Amazon Kinesis Firehose:
Delivery stream
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Best practices
• Tune Firehose buffer size and buffer interval
• Larger objects = fewer Lambda invocations, fewer S3 PUTs
• Enable compression to reduce storage costs
• Enable Source Record Backup for transformations
• Recover from transformation errors
• Follow Amazon Redshift Best Practices for Loading Data
• How to handle time series, sorted data
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
bit.ly/AWSIoTColours
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Colour cube voting
Amazon
S3 Bucket
Amazon
CloudFront
AWS IoT
Amazon
Cognito
Amazon
Cognito
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Real-time analytics
Amazon Kinesis Streams:
Ingest stream
Amazon Kinesis Analytics:
Time window aggregation
Amazon Kinesis Streams:
Aggregates stream
Amazon Kinesis Firehose:
Error stream
Amazon S3:
Error records
Record
Producers
AWS Lambda:
Alert function
Amazon DynamoDB:
Device thresholds
AWS SNS:
Notifications
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon Kinesis Streams and AWS Lambda
• Number of Amazon Kinesis Streams shards corresponds to concurrent invocations
of Lambda function
• Batch size sets maximum number of records per Lambda function invocation
Amazon Kinesis:
Stream
AWS Lambda:
Processor function
Streaming source Other AWS services
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Fan-out pattern
Fan-out pattern trades strict message ordering vs higher throughput & lower latency
Amazon Kinesis:
Stream
Lambda:
Dispatcher function
Lambda:
Processor function
Increase throughput, reduce processing latency
Streaming source
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thomson Reuters – Product Insight
Solution for usage analysis tracking:
Capture, analyze, and visualize analytics data generated by offerings, providing
insights to help product teams continuously improve the user experience
Throughput: Tested 4,000 requests / second
Growing to 10,000 requests / second or 25 Billion requests / month
Latency: new events to user dashboards in less than 10 seconds
Durable: no data loss since inception
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
Additional Patterns
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Serverless Data Lake
S3
Bucket(s)
Key
Management
Service
Amazon
Athena
AWS
CloudTrail
Amazon
Cognito
AWS IAM
Amazon
Kinesis
Streams
Amazon
Kinesis
Firehose
Amazon ES
Amazon
QuickSight
AWS Glue
Amazon
DynamoDB
Amazon
Macie
Amazon API
Gateway
AWS IAM
Amazon
Redshift
Spectrum
AWS
Direct
Connect
Ingest
Catalog & Search
Security & Auditing
API/UI
Analytics & Processing
AWS Glue
AWS
Lambda
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Operations Automation
RDP from
0.0.0.0/0
RDP from
0.0.0.0/0
CloudWatch Event Bus in
another AWS Account
New Security Group ingress rule Amazon CloudWatch Events:
Rule
AWS Lambda:
Remediate and alert
AWS SNS:
Email alert
Ingress rule deleted
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Further Reading
• Optimizing Enterprise Economics with Serverless Architectures
https://d0.awsstatic.com/whitepapers/optimizing-enterprise-economics-serverless-architectures.pdf
• Serverless Architectures with AWS Lambda
https://d1.awsstatic.com/whitepapers/serverless-architectures-with-aws-lambda.pdf
• Serverless Applications Lens - AWS Well-Architected Framework
https://d1.awsstatic.com/whitepapers/architecture/AWS-Serverless-Applications-Lens.pdf
• Streaming Data Solutions on AWS with Amazon Kinesis
https://d1.awsstatic.com/whitepapers/whitepaper-streaming-data-solutions-on-aws-with-amazon-kinesis.pdf
• AWS Serverless Multi-Tier Architectures
https://d1.awsstatic.com/whitepapers/AWS_Serverless_Multi-Tier_Archiectures.pdf
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
ServerlessDays
TLV
Thank You!
Boaz Ziniman, Technical Evangelist – Amazon Web Service
@ziniman
boaz.ziniman.aws

Serverless Architectural Patterns - ServerlessDays TLV

  • 1.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV Serverless Architectural Patterns Boaz Ziniman, Technical Evangelist – Amazon Web Service @ziniman boaz.ziniman.aws
  • 2.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV Serverless Beyond Lambda
  • 3.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV Pattern 1: Web App/Microservice/API
  • 4.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Web application Data stored in Amazon DynamoDB Dynamic content in AWS Lambda Amazon API Gateway Browser Amazon CloudFront Amazon S3 Amazon Cognito
  • 5.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon API Gateway AWS Lambda Amazon DynamoDB Amazon S3 Amazon CloudFront • Bucket Policies • ACLs • Origin Access Identity (OAI) • Geo-Restriction • Signed Cookies • Signed URLs • DDOS Protection IAM IAM Serverless web app security • Throttling • Caching • Usage Plans • ACM Static Content Browser Amazon Cognito
  • 6.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Custom Authorizer Lambda functionClient Lambda function Amazon API Gateway Amazon DynamoDB AWS Identity & Access Management SAML Two types: • TOKEN - authorization token passed in a header • REQUEST – all headers, query strings, paths, stage variables or context variables.Custom Authorizer Cognito User Pool Custom Authorizers
  • 7.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Multi-Region with API Gateway us-west-2 us-east-1 Client Amazon Route 53 Regional API Endpoint Regional API Endpoint Custom Domain Name Custom Domain Name API Gateway API Gateway Lambda Lambda api.mycorp.com CNAME CNAM E
  • 8.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV http://bit.ly/ServerlessShop https://github.com/patrick-michelberger/serverless-shop
  • 9.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV Pattern 2: Stream Processing
  • 10.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Stream processing characteristics • High ingest rate • Near real-time processing (low latency from ingest to process) • Spiky traffic (lots of devices with intermittent network connections) • Message durability • Message ordering
  • 11.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Streaming data ingestion Amazon CloudWatch: Delivery metrics Amazon S3: Buffered files Kinesis Agent Record Producers Amazon Redshift: Table loads Amazon Elasticsearch Service: Domain loads Amazon S3: Source record backup AWS Lambda: Transformations & enrichment Amazon DynamoDB: Lookup tables Raw records Lookup Transformed records Transformed recordsRaw records Amazon Kinesis Firehose: Delivery stream
  • 12.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Best practices • Tune Firehose buffer size and buffer interval • Larger objects = fewer Lambda invocations, fewer S3 PUTs • Enable compression to reduce storage costs • Enable Source Record Backup for transformations • Recover from transformation errors • Follow Amazon Redshift Best Practices for Loading Data • How to handle time series, sorted data
  • 13.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. bit.ly/AWSIoTColours
  • 14.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Colour cube voting Amazon S3 Bucket Amazon CloudFront AWS IoT Amazon Cognito Amazon Cognito
  • 15.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Real-time analytics Amazon Kinesis Streams: Ingest stream Amazon Kinesis Analytics: Time window aggregation Amazon Kinesis Streams: Aggregates stream Amazon Kinesis Firehose: Error stream Amazon S3: Error records Record Producers AWS Lambda: Alert function Amazon DynamoDB: Device thresholds AWS SNS: Notifications
  • 16.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon Kinesis Streams and AWS Lambda • Number of Amazon Kinesis Streams shards corresponds to concurrent invocations of Lambda function • Batch size sets maximum number of records per Lambda function invocation Amazon Kinesis: Stream AWS Lambda: Processor function Streaming source Other AWS services
  • 17.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Fan-out pattern Fan-out pattern trades strict message ordering vs higher throughput & lower latency Amazon Kinesis: Stream Lambda: Dispatcher function Lambda: Processor function Increase throughput, reduce processing latency Streaming source
  • 18.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Thomson Reuters – Product Insight Solution for usage analysis tracking: Capture, analyze, and visualize analytics data generated by offerings, providing insights to help product teams continuously improve the user experience Throughput: Tested 4,000 requests / second Growing to 10,000 requests / second or 25 Billion requests / month Latency: new events to user dashboards in less than 10 seconds Durable: no data loss since inception
  • 19.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV Additional Patterns
  • 20.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Serverless Data Lake S3 Bucket(s) Key Management Service Amazon Athena AWS CloudTrail Amazon Cognito AWS IAM Amazon Kinesis Streams Amazon Kinesis Firehose Amazon ES Amazon QuickSight AWS Glue Amazon DynamoDB Amazon Macie Amazon API Gateway AWS IAM Amazon Redshift Spectrum AWS Direct Connect Ingest Catalog & Search Security & Auditing API/UI Analytics & Processing AWS Glue AWS Lambda
  • 21.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Operations Automation RDP from 0.0.0.0/0 RDP from 0.0.0.0/0 CloudWatch Event Bus in another AWS Account New Security Group ingress rule Amazon CloudWatch Events: Rule AWS Lambda: Remediate and alert AWS SNS: Email alert Ingress rule deleted
  • 22.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Further Reading • Optimizing Enterprise Economics with Serverless Architectures https://d0.awsstatic.com/whitepapers/optimizing-enterprise-economics-serverless-architectures.pdf • Serverless Architectures with AWS Lambda https://d1.awsstatic.com/whitepapers/serverless-architectures-with-aws-lambda.pdf • Serverless Applications Lens - AWS Well-Architected Framework https://d1.awsstatic.com/whitepapers/architecture/AWS-Serverless-Applications-Lens.pdf • Streaming Data Solutions on AWS with Amazon Kinesis https://d1.awsstatic.com/whitepapers/whitepaper-streaming-data-solutions-on-aws-with-amazon-kinesis.pdf • AWS Serverless Multi-Tier Architectures https://d1.awsstatic.com/whitepapers/AWS_Serverless_Multi-Tier_Archiectures.pdf
  • 23.
    © 2018, AmazonWeb Services, Inc. or its Affiliates. All rights reserved. ServerlessDays TLV Thank You! Boaz Ziniman, Technical Evangelist – Amazon Web Service @ziniman boaz.ziniman.aws