Serverless best practices plus design principles 20m version

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Heitor Lessa, Serverless Specialist SA
lessa@amazon.com
Serverless Best Practices
a.k.a lessons learned from the field
@heitor_lessa

Agenda
• Design principles for Serverless Applications
• Best practices
• Deployment
• Testing
• Monitoring
• Security
• Performance
• Microservices

Design principles for Serverless
applications

General design principles
Speedy, simple, singular

Instead of Lambda based “monoliths”….
GET /pets
PUT /pets
DELETE /pets
GET /describe/pet/$id
PUT /describe/pet/$id
ONE LARGE LAMBDA FUNCTIONEVENT DRIVEN

Lambda based “nano-services”
EVENT DRIVEN Constellation of functions
GET /pets
PUT /pets
DELETE /pets
GET /describe/pet/$id
PUT /describe/pet/$id
Amazon
API Gateway

Think concurrent requests, not total
requests

Compute power: Don’t “guesstimate”
alexcasalboni
aws-lambda-power-tuning

Share nothing

Leverage container reuse but persistent storage for durable
state
s3 = boto3.resource('s3')
db = db.connect()
def lambda_handler(event, context):
global db
# verify if still connected
# otherwise carry on
if not db:
db = db.connect()
…
db.save(highly_durable_state)
...

Orchestrate your application with
state machines, not functions

Don’t orchestrate within your functions…STARTJOB
JOB#XSTARTED
HTTPPOST
HTTPPOST
AREWETHEREYET?
NOPE!
WE’REDONE!
ZzZz
OR
time.sleep(10)

Step Functions with AWS Batch

Design for failures and duplicates

Applying Saga pattern with AWS Step Functions
theburningmonk.com/2017/07/applying-the-saga-pattern-with-aws-lambda-and-step-functions

Best practices

Deployment

• Single responsibility principle == Single function
• Share resource information across stacks via
Export value or SSM Parameter Store
• Build out multiple environments, such as for
Development, Test, Production and even DR using
the same template, even across accounts
• Shared code == Language specific packages
Shared Event Source == Same template
SAM Template
Source
Control
Dev
Test
Prod
Deployment best practices

Testing

Testing strategies
Run Unit tests locally
Run Integration/Acceptance tests with real services
Leverage SAM Local and Lambda runtime AMI

Monitoring

Cloudwatch – Metrics and streaming
Alarm on individual and aggregate metrics
(Throttling alarm !== Errors/Duration alarm)
Create Custom Metrics via Metric Filter
(Centralize logs from multiple accounts to Amazon ES)
Drill down application insights with X-Ray
(Too much time spent at logs == Lack of metrics)
Log only what’s necessary
(Use Environment Variables to control logging level)
built-in custom
Amazon Cloudwatch

X-Ray – Application Insights

Application instrumentation (Node.js)
const AWSXRay = require('aws-xray-sdk-core');
# Wraps AWS SDK and trace subsequent AWS Services
const AWS = AWSXRay.captureAWS(require('aws-sdk'));
const dynamoDb = new AWS.DynamoDB.DocumentClient();
const sqs = new AWS.SQS();
# Wraps HTTP calls made
const https = AWSXRay.captureHTTPs(require('https'));

Security

Vulnerabilities and security scan
Application Security Best practices still apply
(Input validation/sanitization, code review, etc..)
One IAM Role per function
(permissions are easy to add but hard to remove)
Encrypt secrets with KMS integration
(Leverage EC2 SSM Parameter Store for shared secrets)
Automate security scans/controls into CI/CD
(Dependency CVEs, static/dynamic analysis, etc.)

What about cold starts?

As seen on TV…

Cold start: Understand the function lifecycle
Download
your code

Download
your code
Start new
process

Bootstrap
the runtime
Download
your code
Start new
process

Bootstrap
the runtime
Start your
code
Download
your code
Start new
process

Bootstrap
the runtime
Start your
code
Full
cold start
Partial
cold start
Warm
start
Download
your code*
Start new
process
AWS optimization Your optimization

Download
your code*
Start new
process
Create
VPC ENI
Start your
code
Attach
VPC ENI
Full
cold start
Warm
start
Bootstrap
runtime
Partial
cold start
AWS optimization Your optimization
(VPC)

Don’t panic – Prod is consistent! VPC numbers

Look at the distribution not average
TP99: 99% of reqs were
below this data point

TP99: 99% of reqs were
below this data point
TP50/Median: 50% either
above or below
Look at the distribution not average

What about Microservices?

Just because you use Lambda, it’s not a micro
service
Ingest()
sanitize()
attach_
metadata()
cache()
This fails all three tenets: it’s not decoupled, has multiple
owners, it’s still a monolith to build

We can isolate a few services here
Ingest() sanitize() attach_
metadata()
cache
• Ingestion and sanitization live together
• Metadata should be a separate database/service,
queried by the ingestion service
• Cache and frontend should be a separate service that
uses data from the previous two
• You need to own the interfaces!

Do you re-use services? APIs are the contract
Ingestion service
Ingestion
API
ingest
&
sanitize()
Metadata service
CRUD
API
read & write
metadata()
Frontend service
Frontend
API
express()
• We can create a new ingestion service that re-uses the
same metadata service
• We can modify the frontend without touching how the data is received and
processed

Recap

Key takeaways
Security application best
practices still apply
Decouple orchestration logic
from application logic
Optimize for single purpose;
leverage concurrency model

Appendix

Additional Resources - Whitepaper
Serverless Architectures
with AWS Lambda
November 2017
bit.ly/2zVvp0w
Optimizing Enterprise
Economics with
Serverless
Architectures
October 2017
bit.ly/2hQdy44
Serverless Applications
Lens
November 2017
bit.ly/serverless_lens

Additional Resources - Playlist
re:Invent 2017 – Serverless Breakout Sessions
bit.ly/serverless_playlist17

Serverless best practices plus design principles 20m version

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Serverless best practices plus design principles 20m version

Similar to Serverless best practices plus design principles 20m version (20)

More from Heitor Lessa

More from Heitor Lessa (9)

Recently uploaded

Recently uploaded (20)

Serverless best practices plus design principles 20m version