Serverless

A Step-by-Step Guide to Securely Exposing an API Gateway with AWS Services

Amazon API Gateway is a managed service that allows developers to create, publish, maintain, monitor, and secure APIs at scale. Imagine you’re building an application where different types of clients need to interact with backend services, API Gateway steps in to bridge that communication effectively. From serverless functions, like AWS Lambda, to Java microservices running on Amazon EC2, API Gateway helps unify access and security, all while optimizing scalability and cost. It enables you to streamline development by providing a standardized interface to connect different architecture components, thereby reducing complexity and improving maintainability.

In this guide, I’ll walk you through an architecture that securely exposes an API using AWS services, such as API Gateway, CloudFront, Lambda, Network Load Balancers (NLB), and others. We’ll detail each step, referencing a diagram to illustrate how all these components work together harmoniously. I hope to make this information as approachable as possible, like a conversation over coffee, where I explain concepts clearly, even if you’re new to AWS services. By the end of this guide, you should have a solid understanding of how these pieces come together to create a secure, scalable API.

Amazon API Gateway Basics

API Gateway allows you to create APIs that can serve as a front door to your backend services. Whether you have Lambda functions executing your business logic or traditional microservices running on EC2 instances, API Gateway manages traffic, secures APIs, and integrates well with AWS’s ecosystem, ensuring high availability and scalability. It acts as the centralized gateway for all the external requests coming to your application and provides a seamless way to manage those requests without overloading your backend.

API Gateway helps you manage the entire lifecycle of your API. Imagine it as the receptionist of a large office building; it controls who comes in, directs them to the appropriate room, and even handles security checks. Your backend services, whether they are Lambda functions or Java-based microservices, don’t have to worry about authentication, logging, or rate limiting, API Gateway takes care of it all. This allows your development team to focus on the core functionality without worrying about the overhead of managing all these security and operational concerns.

The AWS Architecture to Expose an API

Let’s explore the architecture itself. The diagram accompanying this article details an architecture that effectively exposes an API to the internet, utilizing multiple AWS services to create a robust and secure environment. Each component in the architecture has a specific role, and understanding these roles will help you see how they work together to create a seamless user experience.

1. Entry Point via Amazon Route 53 and CloudFront

The entry point for users starts with Amazon Route 53, which provides domain name resolution. It ensures that your custom domain is easily discoverable by mapping it to your API Gateway endpoint. Once resolved, requests are routed through Amazon CloudFront, a content delivery network (CDN) service. This adds benefits like caching and content delivery optimization, reducing latency for clients globally. The caching provided by CloudFront can significantly reduce the number of calls to your API Gateway, which also helps in cost savings by reducing the usage of downstream resources.

Think of CloudFront as a system of shortcuts. When someone tries to access your API from the other side of the globe, they hit a CloudFront edge location, which reduces travel time and ensures a faster response, saving both your API and the user precious milliseconds. In addition, CloudFront adds a layer of security by keeping certain attacks from reaching your API Gateway, since it can use geo-restriction and SSL/TLS encryption to protect your data.

2. Security with AWS WAF and API Gateway

The next layer is AWS WAF (Web Application Firewall). WAF is the gatekeeper that examines incoming traffic to ensure it’s safe. It prevents attacks, such as SQL injection or cross-site scripting, safeguarding your API from harmful traffic. WAF rules can be configured to block, allow, or count requests based on customizable conditions, such as IP addresses, HTTP headers, or request bodies.

From there, the requests arrive at API Gateway. The API Gateway processes the incoming request, applying rate limiting, authentication, and integrating seamlessly with other AWS services. Here, you’re ensuring that only authorized requests reach your backend. It also allows you to throttle requests, ensuring your backend services do not get overwhelmed during a traffic spike.

AWS IAM (Identity and Access Management) also comes into play, managing who has permissions to access specific components. IAM policies control which entities can invoke Lambda functions or communicate with the Java microservices hosted on EC2 instances. The EC2 instances must use roles defined in IAM to securely access the RDS database, ensuring that only authorized entities can connect. By assigning specific roles, you can tightly control which services or individuals can interact with the backend, minimizing the potential for unauthorized access.

3. Lambda Functions and EC2 Microservices as Backend Services

API Gateway is versatile. In this architecture, you’ll see two main paths from API Gateway:

AWS Lambda: If your service logic is serverless, AWS Lambda handles those operations. For example, small functions that perform specific tasks can be triggered directly. Lambda provides scalability without the hassle of managing infrastructure. Lambda is ideal for event-driven applications, where you need to process incoming requests on-demand without needing a dedicated server. Each function runs in an isolated environment, which means even if there’s an issue with one execution, it doesn’t affect others.
VPC Link to EC2 Instances: When dealing with microservices hosted in a VPC (Virtual Private Cloud), VPC Link is used to securely connect the API Gateway to those services. In this architecture, the VPC Link connects to a Network Load Balancer (NLB). The NLB then distributes traffic to Java microservices running on EC2 instances within a private subnet. This layer provides isolation, ensuring that the microservices aren’t directly exposed to the internet. The use of VPC Link and NLB ensures that all communication between API Gateway and EC2 instances remains within the secure boundaries of the AWS network, enhancing security.

Think of the NLB as the traffic officer. It receives all the cars (requests) from the VPC Link and directs them to one of the EC2 instances (Java microservices), making sure none of them get overwhelmed. This ensures that your backend can handle requests efficiently, even during peak load times, by spreading the requests across multiple instances.

4. A RDS Database for Data Persistence

The backend services running on EC2 interact with an Amazon RDS (Relational Database Service) instance. The RDS instance sits within another private subnet in the VPC, providing a managed database solution that scales according to the demands of your application. It’s isolated from the public internet, with access controlled strictly by security groups to ensure that only your EC2 microservices can communicate with it. The subnet is private, meaning it has no direct route to the internet, and only the specific port used by the database (typically port 3306 for MySQL, for example) is open to allow inbound traffic from authorized EC2 instances. This minimizes the risk of unauthorized access or potential attacks.

Moreover, the IAM roles assigned to the EC2 instances ensure that each request made to the RDS database is authenticated securely. The controlled access combined with the private subnet adds a defense-in-depth approach, significantly enhancing the security posture of the application. This setup means that even if an attacker were to gain access to other parts of the infrastructure, reaching the RDS database would still be extremely challenging due to the multiple layers of protection.

5. Monitoring with AWS CloudWatch

Lastly, everything needs to be monitored. AWS CloudWatch is used to track metrics and log information across API Gateway, Lambda, and the EC2 instances. CloudWatch helps you understand how the system is behaving, allows you to define alarms for anything out of the ordinary, and ensures that you always have insight into your services’ health. By setting up CloudWatch alarms, you can automatically get notifications if something isn’t performing as expected, allowing you to respond quickly and ensure high availability.

Security groups add a further layer of control, dictating what traffic is allowed in and out of the private subnets. These configurations ensure that only legitimate requests are allowed to reach the EC2 instances or interact with the RDS database. By fine-tuning the security group rules, you can restrict access further, allowing only specific IP ranges or VPC endpoints to communicate with your services.

Final Thoughts and Recommendations

Here are two important considerations to keep in mind as you design your architecture:

Clarifying the Connection Between API Gateway and VPC Link: It’s essential to understand that the connection from API Gateway to VPC Link is designed specifically for securely communicating with services residing inside the VPC. This is different from invoking Lambda functions directly, which are handled outside the VPC context.
Balancing Security and Simplicity: The architecture presented here represents a foundational approach to securely exposing an API. It’s valuable to highlight additional security options, such as implementing Network ACLs (NACLs) or creating more granular Security Groups, as a way to enhance the balance between accessibility and security. This approach allows you to keep the initial design straightforward while providing paths for more sophisticated security as requirements evolve.

I hope this guide has demystified the architecture for you. Think of it like a well-oiled machine or even a kitchen during the dinner rush. Every part has a job, API Gateway is the head chef calling out orders, CloudFront is like the waiter running dishes out to customers quickly, and WAF is the security guard keeping everything safe. When each part knows its role and plays it well, the whole restaurant runs smoothly. Understanding these concepts will not only help you build better applications but will also give you the confidence to scale and secure your services, just like a seasoned chef confidently managing a busy kitchen.

Architecting AWS workflows, when to choose EventBridge or Batch

Selecting the right service for your workflow can often be challenging when building on AWS. You might think of it as choosing between two powerful tools in your toolbox: Amazon EventBridge and AWS Batch. While both have robust functionalities, they cater to different types of tasks. Knowing when to use each and how to combine them can make all the difference in building efficient, scalable applications.

Let’s look into each service, understand their unique roles, and explore practical scenarios where one outshines the other.

Amazon EventBridge: Real-Time reactions in action

Imagine Amazon EventBridge as a highly efficient “event router” for your system. In EventBridge, everything is an event, from user actions to system-generated notifications. This service shines when you need instant, real-time responses across multiple AWS services.

For instance, let’s consider a modern e-commerce platform. When a customer makes a purchase, EventBridge steps in to orchestrate the sequence of actions: it updates the inventory in DynamoDB, sends an email notification via SES (Simple Email Service), records analytics data in Redshift, and notifies third-party shipping services. All these tasks happen simultaneously, without delays. EventBridge acts as a conductor, keeping everything in sync in real-time.

Why EventBridge?

EventBridge is especially powerful for real-time processing, integration of different services, and flexible routing of events. When your system is composed of microservices or serverless components, EventBridge provides the glue to hold them together. It has built-in integrations with over 20 AWS services and supports custom SaaS applications. And thanks to “event schemas”, essentially standardized formats for different types of events, you can ensure consistent communication across diverse components.

To simplify: EventBridge excels in fast, lightweight operations. It’s the ideal choice when your priority is speed and responsiveness, and when you’re dealing with workflows that require instant reactions and coordinated actions.

AWS Batch: Powering through heavy lifting with batch processing

If EventBridge is your “quick response” tool, AWS Batch is your “muscle.” AWS Batch specializes in executing computationally intensive jobs that can take longer to complete. Imagine a factory floor filled with machinery working on heavy-duty tasks. AWS Batch is designed to handle these large, sometimes complex processes in an organized, efficient way.

Let’s look at data science or machine learning workloads as an example. Suppose you need to process large datasets or train models that take hours, sometimes even days, to complete. AWS Batch allows you to allocate exactly the resources you need, whether that means using more powerful CPUs or accessing GPU instances. Batch jobs can run on EC2 instances or Fargate, enabling flexibility and resource optimization.

Array Jobs: Maximizing Throughput

One of the most powerful features in AWS Batch is Array Jobs. Think of Array Jobs as a way to break down massive tasks into hundreds or thousands of smaller tasks, each working on a piece of the overall puzzle. This is especially useful in fields like genomics, where each gene sequence needs to be analyzed separately, or in video rendering, where each frame can be processed in parallel. Array Jobs allow all these smaller tasks to run at the same time, significantly speeding up the entire process.

In short, AWS Batch is ideal for heavy-duty computations, data-heavy processes, and tasks that can run in parallel. It’s the go-to choice when you need a high level of control over computational resources and are dealing with workflows that aren’t as time-sensitive but are resource-intensive.

When should You use each?

Use EventBridge when:

Real-Time monitoring: EventBridge excels in event-driven architectures where immediate responses are critical, like monitoring applications in real-time.
Serverless integration: If your architecture relies on serverless components (such as AWS Lambda), EventBridge provides the ideal connectivity.
Complex routing needs: The service’s routing rules let you direct events based on content, scheduling, and custom patterns, perfect for sophisticated integrations.
API integrations: EventBridge simplifies B2B interactions by acting as a “contract” between systems, making it easy to exchange real-time updates without directly managing API dependencies.

Use AWS Batch when:

High computational demand: For tasks like data processing, machine learning, and scientific simulations, Batch allows access to specialized resources, including EC2 instances and GPUs.
Large-Scale data processing: Array Jobs enables AWS Batch to break down and process enormous datasets simultaneously, perfect for fields that handle large volumes of data.
Asynchronous or Background processing: Tasks that don’t require immediate responses, like video processing or data analysis, are best suited to Batch’s queue-based setup.

Hybrid scenarios: Using EventBridge and AWS Batch together

In some cases, EventBridge and Batch can complement each other to form a hybrid approach. Imagine you have an image-processing pipeline for a photography website:

Image upload: EventBridge receives the image upload event and triggers a validation process to check the file type and size.
Processing trigger: If the image meets requirements, EventBridge kicks off an AWS Batch job to generate multiple versions (like thumbnails and high-resolution images).
Parallel processing with Array Jobs: AWS Batch processes each image version as an Array Job, optimizing performance and speed.
Event notification: When Batch completes the task, EventBridge routes a completion notification to other parts of the system (e.g., updating the image gallery).

In this scenario, EventBridge handles the quick actions and routing, while Batch takes care of the intensive processing. Combining both services allows you to leverage real-time responsiveness and high computational power, meeting the needs of diverse workflows efficiently.

Choosing the right tool for the job

Selecting between Amazon EventBridge and AWS Batch boils down to the nature of your task:

For real-time event handling and multi-service integrations, EventBridge is your best choice. It’s agile, responsive, and designed for systems that need to react immediately to changes.
For resource-intensive processing and background jobs, AWS Batch is unbeatable. With fine-grained control over compute resources, it’s tailor-made for workflows that require significant computational power.
In cases that demand both real-time responses and heavy processing, don’t hesitate to use both services in tandem. A hybrid approach lets you harness the strengths of each service, optimizing your architecture for efficiency, speed, and scalability.

In the end, each service has unique strengths tailored for specific workloads. With a clear understanding of what each offers, you can design workflows that are not only optimized but also built to handle the demands of modern applications in AWS.

Design patterns for AWS Step Functions workflows

Suppose you’re leading a dance where each partner is a different cloud service, each moving precisely in time. That’s what AWS Step Functions lets you do! AWS Step Functions helps you orchestrate your serverless applications as if you had a magic wand, ensuring each part plays its tune at the right moment. And just like a conductor uses musical patterns, we have design patterns in Step Functions that make this orchestration smooth and efficient.

In this article, we’re embarking on an exciting journey to explore these patterns. We’ll break down complex ideas into simple terms, so even if you’re new to Step Functions, you’ll feel confident and ready to apply these patterns by the end of this read.

Here’s what we’ll cover:

A quick recap of what AWS Step Functions is all about.
Why design patterns are like secret recipes for successful workflows.
How to use these patterns to build powerful and reliable serverless applications.

Understanding the basics

Before diving into the patterns, let’s ensure we’re all on the same page. Think of a state machine in Step Functions as a flowchart. It has different “states” (like boxes in your flowchart) that represent the steps in your workflow. These states are connected by arrows, showing the order in which things happen.

Pattern 1: The “Waiter” Pattern (Wait-for-Callback with Task Tokens)

Imagine you’re at a restaurant. You order your food, and the waiter gives you a number. That number is like a task token in Step Functions. You don’t just stand at the counter staring at the kitchen, right? You relax and wait for your number to be called.

That’s similar to the Wait-for-Callback pattern. You have a task (like ordering food) that takes a while. Instead of constantly checking if it’s done, you give it a token (like your order number) and do other things. When the task is finished, it uses the token to call you back and say, “Hey, your order is ready!”

Why is this useful?

It lets your workflow do other things while waiting for a long task.
It’s perfect for tasks that involve human interaction or external services.

How does it work?

You start a task and give it a token.
The task does its thing (maybe it’s waiting for a user to approve something).
Once done, the task uses the token to signal completion.
Your workflow continues with the next step.

// Pattern 1: Wait-for-Callback with Task Tokens
{
  "StartAt": "WaitForCallback",
  "States": {
    "WaitForCallback": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke.waitForTaskToken",
      "Parameters": {
        "FunctionName": "MyCallbackFunction",
        "Payload": {
          "TaskToken.$": "$$.Task.Token",
          "Input.$": "$.input"
        }
      },
      "Next": "ProcessResult",
      "TimeoutSeconds": 3600
    },
    "ProcessResult": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "ProcessResultFunction",
        "Payload.$": "$"
      },
      "End": true
    }
  }
}

Things to keep in mind:

Make sure you handle errors gracefully, like what happens if the waiter forgets your order?
Set timeouts so your workflow doesn’t wait forever.
Keep your tokens safe, just like you wouldn’t want someone else to take your food!

Pattern 2: The “Multitasking” Pattern (Parallel processing with Map States)

Ever wished you could do many things at once? Like washing dishes, cooking, and listening to music simultaneously? That’s what Map States let you do in Step Functions. Imagine you have a basket of apples to peel. Instead of peeling them one by one, you can use a Map State to peel many apples at the same time. Each apple gets its peeling process, and they all happen in parallel.

Why is this awesome?

It speeds up your workflow by doing many things concurrently.
It’s great for tasks that can be broken down into independent chunks.

How to use it:

You have a bunch of items (like our apples).
The Map State creates a separate path for each item.
Each path does the same steps but on a different item.
Once all paths are done, the workflow continues.

// Pattern 2: Map State for Parallel Processing
{
  "StartAt": "ProcessImages",
  "States": {
    "ProcessImages": {
      "Type": "Map",
      "ItemsPath": "$.images",
      "MaxConcurrency": 5,
      "Iterator": {
        "StartAt": "ProcessSingleImage",
        "States": {
          "ProcessSingleImage": {
            "Type": "Task",
            "Resource": "arn:aws:states:::lambda:invoke",
            "Parameters": {
              "FunctionName": "ImageProcessorFunction",
              "Payload.$": "$"
            },
            "End": true
          }
        }
      },
      "Next": "AggregateResults"
    },
    "AggregateResults": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "AggregateFunction",
        "Payload.$": "$"
      },
      "End": true
    }
  }
}

Things to watch out for:

Don’t overload your system by processing too many things at once.
Keep an eye on costs, as parallel processing can use more resources.

Pattern 3: The “Try-Again” Pattern (Error handling with Retry Policies)

We all make mistakes, right? Sometimes things go wrong, even in our workflows. But that’s okay. The “Try-Again” pattern helps us deal with these hiccups.

Imagine you’re trying to open a door, but it’s stuck. You wouldn’t just give up after one try, would you? You might try again a few times, maybe with a little more force.

Retry Policies are like that. If a step in your workflow fails, it can automatically try again a few times before giving up.

Why is this important?

It makes your workflows more resilient to temporary glitches.
It helps you handle unexpected errors gracefully.

How to set it up:

You define a Retry Policy for a specific step.
If that step fails, it automatically retries.
You can customize how many times it retries and how long it waits between tries.

// Pattern 3: Retry Policy Example
{
  "StartAt": "CallExternalService",
  "States": {
    "CallExternalService": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "ExternalServiceFunction",
        "Payload.$": "$"
      },
      "Retry": [
        {
          "ErrorEquals": ["ServiceException", "Lambda.ServiceException"],
          "IntervalSeconds": 2,
          "MaxAttempts": 3,
          "BackoffRate": 2.0
        },
        {
          "ErrorEquals": ["States.Timeout"],
          "IntervalSeconds": 1,
          "MaxAttempts": 2
        }
      ],
      "End": true
    }
  }
}

Real-world examples:

Maybe a network connection fails temporarily.
Or a service you’re using is overloaded.
With Retry Policies, your workflow can handle these situations like a champ!

Putting It All Together

Now that we’ve learned these cool patterns, let’s see how they work together in the real world. Imagine building an image processing pipeline. Think of having a batch of 100 images. You can use the “Multitasking” pattern to process multiple images concurrently, significantly reducing the total time of the pipeline. If one image fails, the “Try-Again” pattern can retry the processing. And if you need to wait for a human to review an image, the “Waiter” pattern comes to the rescue!

Key Takeaways

Design patterns are like superpowers for your workflows.
Each pattern solves a specific problem, so choose wisely.
By combining patterns, you can build incredibly powerful and resilient applications.

In a few words

These patterns are your allies in crafting effective workflows. By understanding and leveraging them, you can transform complex tasks into manageable processes, ensuring that your serverless architectures are not just operational, but optimized and resilient. The real strength of AWS Step Functions lies in its ability to handle the unexpected, coordinate complex tasks, and make your cloud solutions reliable and scalable. Use these design patterns as tools in your problem-solving toolkit, and you’ll find yourself creating workflows that are efficient, reliable, and easy to maintain.

October 26, 2024 by Fernando SRE Cloud stuff 0

Building a serverless image processor with AWS Step Functions

Let’s build something awesome together, an image-processing application using AWS Step Functions. Don’t worry if that sounds complicated; I’ll break it down step by step, just like explaining how a bicycle works. Ready? Let’s go for it.

1. Introduction

Imagine you’re running a photo gallery website where users upload their precious memories, and you need to process these images automatically, resize them, add filters, and optimize them for the web. That sounds like a lot of work, right? Well, that’s exactly what we’re going to build today.

What We’re building

We’re creating a serverless application that will:

Accept image uploads from users.
Process these images in various ways.
Store the results safely.
Notify users when the process is complete.

Here’s a simplified view of the architecture:

User -> S3 Bucket -> Step Functions -> Lambda Functions -> Processed Images

What You’ll need

An AWS account (don’t worry, most of this fits in the free tier).
Basic understanding of AWS (if you can create an S3 bucket, you’re ready).
A cup of coffee (or tea, I won’t judge!).

2. Designing the architecture

Let’s think about this as a building with LEGO blocks. Each AWS service is a different block type, and we’ll connect them to create something awesome.

Our building blocks:

S3 Buckets: Think of these as fancy folders where we’ll store the images.
Lambda Functions: These are our “workers” that will process the images.
Step Functions: This is the “manager” that coordinates everything.
DynamoDB: This will act as a notebook to keep track of what we’ve done.

Here’s the workflow:

The user uploads an image to S3.
S3 triggers our Step Function.
Step Function coordinates various Lambda functions to:
- Validate the image.
- Resize it.
- Apply filters.
- Optimize it.
Finally, the processed image is stored, and the user is notified.

3. Step-by-Step implementation

3.1 Setting Up the S3 Bucket

First, we’ll set up our image storage. Think of this as creating a filing cabinet for our photos.

aws s3 mb s3://my-image-processor-bucket

Next, configure it to trigger the Step Function whenever a file is uploaded. Here’s the event configuration:

{
    "LambdaFunctionConfigurations": [{
        "LambdaFunctionArn": "arn:aws:lambda:region:account:function:trigger-step-function",
        "Events": ["s3:ObjectCreated:*"]
    }]
}

3.2 Creating the Lambda Functions

Now, let’s create the Lambda functions that will process the images. Each one has a specific job:

Image Validator
This function checks if the uploaded image is valid (e.g., correct format, not corrupted).

import boto3
from PIL import Image
import io

def lambda_handler(event, context):
    s3 = boto3.client('s3')
    
    bucket = event['bucket']
    key = event['key']
    
    try:
        image_data = s3.get_object(Bucket=bucket, Key=key)['Body'].read()
        image = Image.open(io.BytesIO(image_data))
        
        return {
            'statusCode': 200,
            'isValid': True,
            'metadata': {
                'format': image.format,
                'size': image.size
            }
        }
    except Exception as e:
        return {
            'statusCode': 400,
            'isValid': False,
            'error': str(e)
        }

Image Resizer
This function resizes the image to a specific target size.

from PIL import Image
import boto3
import io

def lambda_handler(event, context):
    s3 = boto3.client('s3')
    
    bucket = event['bucket']
    key = event['key']
    target_size = (800, 600)  # Example size
    
    try:
        image_data = s3.get_object(Bucket=bucket, Key=key)['Body'].read()
        image = Image.open(io.BytesIO(image_data))
        resized_image = image.resize(target_size, Image.LANCZOS)
        
        buffer = io.BytesIO()
        resized_image.save(buffer, format=image.format)
        s3.put_object(
            Bucket=bucket,
            Key=f"resized/{key}",
            Body=buffer.getvalue()
        )
        
        return {
            'statusCode': 200,
            'resizedImage': f"resized/{key}"
        }
    except Exception as e:
        return {
            'statusCode': 500,
            'error': str(e)
        }

3.3 Setting Up Step Functions

Now comes the fun part, setting up our workflow coordinator. Step Functions will manage the flow, ensuring each image goes through the right steps.

{
  "Comment": "Image Processing Workflow",
  "StartAt": "ValidateImage",
  "States": {
    "ValidateImage": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:region:account:function:validate-image",
      "Next": "ImageValid",
      "Catch": [{
        "ErrorEquals": ["States.ALL"],
        "Next": "NotifyError"
      }]
    },
    "ImageValid": {
      "Type": "Choice",
      "Choices": [
        {
          "Variable": "$.isValid",
          "BooleanEquals": true,
          "Next": "ProcessImage"
        }
      ],
      "Default": "NotifyError"
    },
    "ProcessImage": {
      "Type": "Parallel",
      "Branches": [
        {
          "StartAt": "ResizeImage",
          "States": {
            "ResizeImage": {
              "Type": "Task",
              "Resource": "arn:aws:lambda:region:account:function:resize-image",
              "End": true
            }
          }
        },
        {
          "StartAt": "ApplyFilters",
          "States": {
            "ApplyFilters": {
              "Type": "Task",
              "Resource": "arn:aws:lambda:region:account:function:apply-filters",
              "End": true
            }
          }
        }
      ],
      "Next": "OptimizeImage"
    },
    "OptimizeImage": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:region:account:function:optimize-image",
      "Next": "NotifySuccess"
    },
    "NotifySuccess": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:region:account:function:notify-success",
      "End": true
    },
    "NotifyError": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:region:account:function:notify-error",
      "End": true
    }
  }
}

4. Error Handling and Resilience

Let’s make our application resilient to errors.

Retry Policies

For each Lambda invocation, we can add retry policies to handle transient errors:

{
  "Retry": [{
    "ErrorEquals": ["States.TaskFailed"],
    "IntervalSeconds": 3,
    "MaxAttempts": 2,
    "BackoffRate": 1.5
  }]
}

Error Notifications

If something goes wrong, we’ll want to be notified:

import boto3

def notify_error(event, context):
    sns = boto3.client('sns')
    
    error_message = f"Error processing image: {event['error']}"
    
    sns.publish(
        TopicArn='arn:aws:sns:region:account:image-processing-errors',
        Message=error_message,
        Subject='Image Processing Error'
    )

5. Optimizations and Best Practices

Lambda Configuration

Memory: Set memory based on image size. 1024MB is a good starting point.
Timeout: Set reasonable timeout values, like 30 seconds for image processing.
Environment Variables: Use these to configure Lambda functions dynamically.

Cost Optimization

Use Step Functions Express Workflows for high-volume processing.
Implement caching for frequently accessed images.
Clean up temporary files in /tmp to avoid running out of space.

Security

Use IAM policies to ensure only necessary access is granted to S3:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::my-image-processor-bucket/*"
        }
    ]
}

6. Deployment

Finally, let’s deploy everything using AWS SAM, which simplifies the deployment process.

Project Structure

image-processor/
├── template.yaml
├── functions/
│   ├── validate/
│   │   └── app.py
│   ├── resize/
│   │   └── app.py
└── statemachine/
    └── definition.asl.json

SAM Template

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  ImageProcessorStateMachine:
    Type: AWS::Serverless::StateMachine
    Properties:
      DefinitionUri: statemachine/definition.asl.json
      Policies:
        - LambdaInvokePolicy:
            FunctionName: !Ref ValidateFunction
        - LambdaInvokePolicy:
            FunctionName: !Ref ResizeFunction

  ValidateFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/validate/
      Handler: app.lambda_handler
      Runtime: python3.9
      MemorySize: 1024
      Timeout: 30

  ResizeFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: functions/resize/
      Handler: app.lambda_handler
      Runtime: python3.9
      MemorySize: 1024
      Timeout: 30

Deployment Commands

# Build the application
sam build

# Deploy (first time)
sam deploy --guided

# Subsequent deployments
sam deploy

After deployment, test your application by uploading an image to your S3 bucket:

aws s3 cp test-image.jpg s3://my-image-processor-bucket/raw/

Yeah, You have built a robust, serverless image-processing application. The beauty of this setup is its scalability, from a handful of images to thousands, it can handle them all seamlessly.

And like any good recipe, feel free to tweak the process to fit your needs. Maybe you want to add extra processing steps or fine-tune the Lambda configurations, there’s always room for experimentation.

October 24, 2024 by Fernando SRE Cloud stuff 0

AWS Lambda vs. Azure Functions: Which is the Best Choice for Your Serverless Project?

Let’s explore the exciting world of serverless computing. You know, that magical realm where you don’t have to worry about managing servers, and your code runs when needed. Pretty cool, right?

Now, imagine you’re at an ice cream parlor. You don’t need to know how the ice cream machine works or how to maintain it. You order your favorite flavor, and voilà! You get to enjoy your ice cream. That’s kind of how serverless computing works. You focus on writing your code (picking your flavor), and the cloud provider takes care of all the behind-the-scenes stuff (like running and maintaining the ice cream machine).

In this tasty tech landscape, two big players are serving up some delicious serverless options: AWS Lambda and Azure Functions. These are like the chocolate and vanilla of the serverless world, popular, reliable, and each with its unique flavor. Let’s take a closer look at these two and see which one might be the best scoop for your next project.

A Detailed Comparison

The Language Menu

Just like how you might prefer chocolate in English and chocolat in French, AWS Lambda and Azure Functions support a variety of programming languages. Here’s what’s on the menu:

AWS Lambda offers:

JavaScript (Node.js)
Python
Java
C# (.NET Core)
Go
Ruby
Custom Runtime API for other languages

Azure Functions serves:

C#
JavaScript (Node.js)
F#
Java
Python
PowerShell
TypeScript

Both offer a pretty extensive language buffet, so you’re likely to find your favorite flavor here. Azure Functions, though, has a slight edge with PowerShell support, which can come in handy for Windows-centric environments.

Pricing Models. Counting Your Pennies

Now, let’s talk about cost, because even in the cloud, there’s no such thing as a free lunch (well, almost).

AWS Lambda charges you based on:

The number of requests
The duration of your function execution
The amount of memory your function uses

Azure Functions has a similar model, but with a few twists:

They offer a pay-as-you-go plan (similar to Lambda)
They also have a Premium plan for more demanding workloads
There’s even an App Service plan if you need dedicated resources

Both services have generous free tiers, so you can start small and scale up as needed. However, Azure’s variety of plans, like the Premium one, might give it an edge if you need more flexibility in resource allocation.

Scaling. Growing with Your Appetite

Imagine your code is like a popular food truck. On busy days, you need to serve more customers quickly. That’s where auto-scaling comes in.

AWS Lambda:

Scales automatically
Can handle thousands of concurrent executions
Has a default limit of 1000 concurrent executions (but you can request an increase)
Execution duration is capped at 15 minutes per request

Azure Functions:

Also scales automatically
Offers different scaling options depending on the hosting plan (Consumption, Premium, or Dedicated)
Premium plans allow for always-on instances, keeping functions “warm”
Depending on the plan, the execution duration can extend beyond Lambda’s 15-minute limit

Both services handle spikes in traffic well, but Azure’s different hosting plans might offer more control over how your functions scale and how long they run.

Integrations. Playing Well with Others

In the cloud, it’s all about teamwork. How well do these services play with others?

AWS Lambda:

Integrates seamlessly with other AWS services
Works great with API Gateway, S3, DynamoDB, and more
Can be triggered by various AWS events

Azure Functions:

Integrates nicely with other Azure services
Works well with Azure Storage, Cosmos DB, and more
Can be triggered by Azure events and supports custom triggers
Supports cron-based scheduling with Timer triggers, great for automated tasks

Both services shine when it comes to integrations within their own ecosystems. Your choice might depend on which cloud provider you’re already using. If you’re using AWS or Azure heavily, sticking with the respective function service is a natural fit.

Development Tools. Your Coding Kitchen

Every chef needs a good kitchen, and every developer needs good tools. Let’s see what’s in the toolbox:

AWS Lambda:

AWS CLI for deployment
AWS SAM for local testing and deployment
Integration with popular IDEs like Visual Studio Code
AWS Lambda Console for online editing and testing

Azure Functions:

Azure CLI for deployment
Azure Functions Core Tools for Local Development
Visual Studio and Visual Studio Code integration
Azure Portal for online editing and management

Both providers offer a rich set of tools for development, testing, and deployment. Azure might have a slight edge for developers already familiar with Microsoft’s toolchain (like Visual Studio), but both platforms offer robust developer support.

Ideal Use Cases. Finding Your Perfect Recipe

Now, when should you choose one over the other? Let’s cook up some scenarios:

AWS Lambda shines when:

You’re already heavily invested in the AWS ecosystem
You need to process large amounts of data quickly (think real-time data processing)
You’re building event-driven applications
You want to create serverless APIs

Azure Functions is a great choice when:

You’re working in a Microsoft-centric environment
You need to integrate with Office 365 or other Microsoft services
You’re building IoT solutions (Azure has great IoT support)
You want more flexibility in hosting options or need long-running processes

Making Your Choice

So, which scoop should you choose? Well, like picking between chocolate and vanilla, it often comes down to personal taste (and your project’s specific needs).

AWS Lambda is like that classic flavor you can always rely on. It’s robust and scales well, and if you’re already in the AWS universe, it’s a no-brainer. It’s particularly great for data processing tasks and creating serverless APIs.

Azure Functions, on the other hand, is like that exciting new flavor with some familiar notes. It offers more flexibility in hosting options and shines in Microsoft-centric environments. If you’re working with IoT or need tight integration with Microsoft services, Azure Functions might be your go-to.

Both services are excellent choices for serverless computing. They’re reliable, scalable, and come with a host of features to make your serverless journey smoother.

My advice? Start with the platform you’re most comfortable with or the one that aligns best with your existing infrastructure. And don’t be afraid to experiment, that’s the beauty of serverless. You can start small, test things out, and scale up as you go.

September 10, 2024 by Fernando SRE Cloud stuff 0

Let’s Party, Understanding Serverless Architecture on AWS

Imagine you’re throwing a big party, but instead of doing all the work yourself, you have a team of helpers who each specialize in different tasks. That’s what we’re doing with serverless architecture on AWS, we’re organizing a digital party where each AWS service is like a specialized helper.

Let’s start with AWS Lambda. Think of Lambda as your multitasking friend who’s always ready to help. Lambda springs into action whenever something happens, like a guest arriving (an API request) or someone bringing a dish (uploading a file). It doesn’t need to be told what to do beforehand; it just responds when needed. This is great because you don’t have to keep this friend around always, only when there’s work to be done.

Now, let’s talk about API Gateway. This is like your doorman. It greets your guests (user requests), checks their invitations (authenticates them), and directs them to the right place in your party (routes the requests). It works closely with Lambda to ensure every guest gets the right experience.

For storing information, we have DynamoDB. Imagine this as a super-efficient filing cabinet that can hold and retrieve any piece of information instantly, no matter how many guests are at your party. It doesn’t matter if you have 10 guests or 10,000; this filing cabinet works just as fast.

Then there’s S3, which is like a magical closet. You can store anything in it, coats, party supplies, even leftover food, and it never runs out of space. Plus, it can alert Lambda whenever something new is put inside, so you can react to new items immediately.

For communication, we use SNS and SQS. Think of SNS as a loudspeaker system that can make announcements to everyone at once. SQS, on the other hand, is more like a ticket system at a delicatessen counter. It makes sure tasks are handled in an orderly fashion, even if a lot of requests come in at once.

Lastly, we have Step Functions. This is like your party planner who knows the sequence of events and makes sure everything happens in the right order. If something goes wrong, like the cake not arriving on time, the planner knows how to adjust and keep the party going.

Now, let’s see how all these helpers work together to throw an amazing party, or in our case, build a photo-sharing app:

When a guest (user) wants to share a photo, they hand it to the doorman (API Gateway).
The doorman calls over the multitasking friend (Lambda) to handle the photo.
This friend puts the photo in the magical closet (S3).
As soon as the photo is in the closet, S3 alerts another multitasking friend (Lambda) to create smaller versions of the photo (thumbnails).
But what if lots of guests are sharing photos at once? That’s where our ticket system (SQS) comes in. It gives each photo a ticket and puts them in an orderly line.
Our multitasking friends (Lambda functions) take photos from this line one by one, making sure no photo is left unprocessed, even during a photo-sharing frenzy.
Information about each processed photo is written down and filed in the super-efficient cabinet (DynamoDB).
The loudspeaker (SNS) announces to interested parties that a new photo has arrived.
If there’s more to be done with the photo, like adding filters, the party planner (Step Functions) coordinates these additional steps.

The beauty of this setup is that each helper does their job independently. If suddenly 100 guests arrive at once, you don’t need to panic and hire more help. Your existing team of AWS services can handle it, expanding their capacity as needed.

This serverless approach means you’re not paying for helpers to stand around when there’s no work to do. You only pay for the actual work done, making it very cost-effective. Plus, you don’t have to worry about managing these helpers or their equipment, AWS takes care of all that for you.

In essence, serverless architecture on AWS is about having a smart, flexible, and efficient team that can handle any party, big or small, without needing to micromanage. It lets you focus on making your app amazing, while AWS ensures everything runs smoothly behind the scenes.

In conclusion, understanding how to integrate AWS services is crucial for building effective serverless architectures. By leveraging the strengths of Lambda, API Gateway, DynamoDB, S3, SNS, SQS, and Step Functions, you can create robust applications that meet your business needs with minimal operational overhead. And just like that, you can enjoy the party with your guests, knowing everything is running smoothly in the background! 🥳🎉

July 26, 2024 by Fernando SRE Cloud stuff 0

Scaling for Success. Cost-Effective Cloud Architectures on AWS

One of the most exciting aspects of cloud computing is the promise of scalability, the ability to expand or contract resources to meet demand. But how do you design an architecture that can handle unexpected traffic spikes without breaking the bank during quieter periods? This question often comes up in AWS Solution Architect interviews, and for good reason. It’s a core challenge that many businesses face when moving to the cloud. Let’s explore some AWS services and strategies that can help you achieve both scalability and cost efficiency.

Building a Dynamic and Cost-Aware AWS Architecture

Imagine your application is like a bustling restaurant. During peak hours, you need a full staff and all tables ready. But during off-peak times, you don’t want to be paying for idle resources. Here’s how we can translate this concept into a scalable AWS architecture:

Auto Scaling Groups (ASGs): Think of ASGs as your restaurant’s staffing manager. They automatically adjust the number of EC2 instances (your servers) based on predefined rules. If your website traffic suddenly spikes, ASGs will spin up additional instances to handle the load. When traffic dies down, they’ll scale back, saving you money. You can even combine ASGs with Spot Instances for even greater cost savings.
Amazon EC2 Spot Instances: These are like the temporary staff you might hire during a particularly busy event. Spot Instances let you take advantage of unused EC2 capacity at a much lower cost. If your demand is unpredictable, Spot Instances can be a great way to save money while ensuring you have enough resources to handle peak loads.
Amazon Lambda: Lambda is your kitchen staff that only gets paid when they’re cooking, and they’re really good at their job, they can whip up a dish in under 15 minutes! It’s a serverless compute service that runs your code in response to events (like a new file being uploaded or a database change). You only pay for the compute time you actually use, making it ideal for sporadic or unpredictable workloads.
AWS Fargate: Fargate is like having a catering service handle your entire kitchen operation. It’s a serverless compute engine for containers, meaning you don’t have to worry about managing the underlying servers. Fargate automatically scales your containerized applications based on demand, and you only pay for the resources your containers consume.

How the Pieces Fit Together

Now, let’s see how these services can work together in harmony:

Core Application on EC2 with Auto Scaling: Your main application might run on EC2 instances within an Auto Scaling Group. You can configure this group to monitor the CPU utilization of your servers and automatically launch new instances if the average CPU usage reaches a threshold, such as 75% (this is known as a Target Tracking Scaling Policy). This ensures you always have enough servers running to handle the current load, even during unexpected traffic spikes.
Spot Instances for Cost Optimization: To save costs, you could configure your Auto Scaling Group to use Spot Instances whenever possible. This allows you to take advantage of lower prices while still scaling up when needed. Importantly, you’ll also want to set up a recovery policy within your Auto Scaling Group. This policy ensures that if Spot Instances are not available (due to high demand or price fluctuations), your Auto Scaling Group will automatically launch On-Demand Instances instead. This way, you can reliably meet your application’s resource needs even when Spot Instances are unavailable.
Lambda for Event-Driven Tasks: Lambda functions excel at handling event-driven tasks that don’t require a constantly running server. For example, when a new image is uploaded to your S3 bucket, you can trigger a Lambda function to automatically resize it or convert it to a different format. Similarly, Lambda can be used to send notifications to users when certain events occur in your application, such as a new order being placed or a payment being processed. Since Lambda functions are only active when triggered, they can significantly reduce your costs compared to running dedicated EC2 instances for these tasks.
Fargate for Containerized Microservices: If your application is built using microservices, you can run them in containers on Fargate. This eliminates the need to manage servers and allows you to scale each microservice independently. By decoupling your microservices and using Amazon Simple Queue Service (SQS) queues for communication, you can ensure that even under heavy load, all requests will be handled and none will be lost. For applications where the order of operations is critical, such as financial transactions or order processing, you can use FIFO (First-In-First-Out) SQS queues to maintain the exact order of messages.

Monitoring and Optimization: Imagine having a restaurant manager who constantly monitors how busy the restaurant is, how much food is being wasted, and how satisfied the customers are. This is what Amazon CloudWatch does for your AWS environment. It provides detailed metrics and alarms, allowing you to fine-tune your scaling policies and optimize your resource usage. With CloudWatch, you can visualize the health and performance of your entire AWS infrastructure at a glance through intuitive dashboards and graphs. These visualizations make it easy to identify trends, spot potential issues, and make informed decisions about resource allocation and optimization.

The Outcome, A Satisfied Customer and a Healthy Bottom Line

By combining these AWS services and strategies, you can build a cloud architecture that is both scalable and cost-effective. This means your application can gracefully handle unexpected traffic spikes, ensuring a smooth user experience even during peak demand. At the same time, you won’t be paying for idle resources during quieter periods, keeping your cloud costs under control.

Final Analysis

Designing for scalability and cost efficiency is a fundamental aspect of cloud architecture. By leveraging AWS services like Auto Scaling, EC2 Spot Instances, Lambda, and Fargate, you can create a dynamic and responsive environment that adapts to your application’s needs. Remember, the key is to understand your workload patterns and choose the right tools for the job. With careful planning and the right AWS services, you can build a cloud architecture that is both powerful and cost-effective, setting your business up for success in the cloud and in the restaurant. 😉

July 24, 2024 by Fernando SRE Cloud stuff 0

The Power of Event-Driven Scaling in Kubernetes: KEDA

Kubernetes is a compelling platform for managing containerized applications but can be complex. One area where Kubernetes shines is its ability to scale applications based on demand. However, traditional scaling methods in Kubernetes might not always be the most efficient, especially when dealing with event-driven workloads. This is where KEDA (Kubernetes Event-Driven Autoscaling) comes into play.

What is KEDA?

KEDA stands for Kubernetes Event-Driven Autoscaling. It is an open-source component that allows Kubernetes to scale applications based on events. This means that instead of only scaling your applications based on metrics like CPU or memory usage, you can scale them based on specific events or external metrics such as the number of messages in a queue, the rate of requests to an endpoint, or custom metrics from various sources.

Key Features and Functionalities

Event-Driven Scaling: KEDA enables scaling based on the number of events that need to be processed, rather than just CPU or memory metrics.
Lightweight Component: KEDA is designed to be a lightweight addition to your Kubernetes cluster, ensuring it doesn’t interfere with other components.
Flexibility: It integrates seamlessly with Kubernetes’ Horizontal Pod Autoscaler (HPA), extending its functionality without overwriting or duplicating it.
Built-In Scalers: KEDA comes with over 50 built-in scalers for various platforms, including cloud services, databases, messaging systems, telemetry systems, CI/CD tools, and more.
Support for Multiple Workloads: It can scale various types of workloads, including deployments, jobs, and custom resources.
Scaling to Zero: KEDA allows scaling down to zero pods when there are no events to process, optimizing resource usage and reducing costs.
Extensibility: You can use community-maintained or custom scalers to support unique event sources.
Provider-Agnostic: KEDA supports event triggers from a wide range of cloud providers and products.
Azure Functions Integration: It allows you to run and scale Azure Functions in Kubernetes for production workloads.
Resource Optimization: KEDA helps build sustainable platforms by optimizing workload scheduling and scaling to zero when not needed.

Advantages of Using KEDA

Efficiency: By scaling based on actual events, KEDA ensures that your application only uses the resources it needs, improving efficiency and potentially reducing costs.
Flexibility: With support for a wide range of event sources and integration with HPA, KEDA provides a flexible scaling solution.
Simplicity: It simplifies the configuration of event-driven scaling in Kubernetes, abstracting the complexities of integrating different event sources.
Seamless Integration: KEDA works well with existing Kubernetes components and can be easily integrated into your current infrastructure.

Optimizing a Retail Application

Imagine you are managing an online retail application. During normal hours, traffic is relatively steady, but during sales events, the number of orders can spike dramatically. Here’s how KEDA can help:

Order Processing: Your application uses a message queue to handle order processing. Normally, the queue has a manageable number of messages, but during a sale, the number of messages can skyrocket.
Scaling with KEDA: KEDA can monitor the message queue and automatically scale the order processing service based on the number of messages. This ensures that as more orders come in, additional instances of the service are started to handle the load, preventing delays and improving customer experience.
Cost Management: Once the sale is over and the message count drops, KEDA will scale down the service, ensuring that you are not paying for unused resources.
Scaling to Zero: When there are no orders to process, KEDA can scale the order processing service down to zero pods, further reducing costs.

In a few words

KEDA is a powerful tool that brings the benefits of event-driven scaling to Kubernetes. Its ability to scale applications based on events makes it an ideal choice for dynamic workloads. By integrating with a variety of event sources and providing a simple yet flexible way to configure scaling, KEDA helps optimize resource usage, enhance performance, and manage costs effectively. Whether you’re running an e-commerce platform, processing data streams, or managing microservices, KEDA can help ensure your applications are always running efficiently.

In essence, KEDA is about making your applications responsive to real-world events, ensuring they are always ready to meet demand without wasting resources. It’s a valuable addition to any Kubernetes toolkit, offering a smarter, more efficient way to handle scaling.

July 11, 2024 by Fernando SRE DevOps stuff Kubernetes SRE stuff 0

AWS EventBridge Essentials. A Guide to Rules and Scheduler

Let’s take a look into AWS EventBridge, a powerful service designed to connect applications using data from our own apps, integrated Software as a Service (SaaS) apps, and AWS services. In particular, we’ll focus on the two main features: EventBridge Rules and the relatively new EventBridge Scheduler. These features overlap in many ways but also offer distinct functionalities that can significantly impact how we manage event-driven applications. Let’s explore what each of these features brings to the table and how to determine which one is right for our needs.

What is AWS EventBridge?

AWS EventBridge is a serverless event bus that makes it easy to connect applications using data from our applications, integrated SaaS applications, and AWS services. EventBridge simplifies the process of building event-driven architectures by routing events from various sources to targets such as AWS Lambda functions, Amazon SQS queues, and more. With EventBridge, we can set up rules to determine how events are routed based on their content.

EventBridge Rules

Overview

EventBridge Rules allow you to define how events are routed to targets based on their content. Rules enable you to match incoming events and send them to the appropriate target. There are two primary types of invocations:

Event Pattern-Based Invocation
Timer-Based Invocation

Event Pattern-Based Invocation

This feature lets us create rules that match specific patterns in event payloads. Events can come from various sources, such as AWS services (e.g., EC2 state changes), partner services (e.g., Datadog), or custom applications. Rules are written in JSON and can match events based on specific attributes.

Example:

Suppose we have an e-commerce application, and we want to trigger a Lambda function whenever an order’s status changes to “pending.” We would set up a rule that matches events where the orderState attribute is pending and routes these events to the Lambda function.

{
  "detail": {
    "orderState": ["pending"]
  }
}

This rule ensures that only events with an orderState of pending invoke the Lambda function, ignoring other states like delivered or shipped.

Timer-Based Invocation

EventBridge Rules also support timer-based invocations, allowing you to trigger events at specific intervals using either rate expressions or cron expressions.

Rate Expressions: Trigger events at regular intervals (e.g., every 5 minutes, every hour).
Cron Expressions: Provide more flexibility, enabling us to specify exact times for event triggers (e.g., every day at noon).

Example:

To trigger a Lambda function every day at noon, we would use a cron expression like this:

{
 "scheduleExpression": "cron(0 12 * * ? *)"
}

Limitations of EventBridge Rules

Fixed Event Payload: The payload passed to the target is static and cannot be changed dynamically between invocations.
Requires an Event Bus: All rule-based invocations require an event bus, adding an extra layer of configuration.

EventBridge Scheduler

Overview

The EventBridge Scheduler is a recent addition to the AWS arsenal, designed to simplify and enhance the scheduling of events. It supports many of the same scheduling capabilities as EventBridge Rules but adds new features and improvements.

Key Features

Rate and Cron Expressions: Like EventBridge Rules, the Scheduler supports both rate and cron expressions for defining event schedules.
One-Time Events: A unique feature of the Scheduler is the ability to create one-time events that trigger a single event at a specified time.
Flexible Time Windows: Allows us to define a time window within which the event can be triggered, helping to stagger event delivery and avoid spikes in load.
Automatic Retries: We can configure automatic retries for failed event deliveries, specifying the number of retries and the time interval between them.
Dead Letter Queues (DLQs): Events that fail to be delivered even after retries can be sent to a DLQ for further analysis and handling.

Example of One-Time Events

Imagine we want to send a follow-up email to customers 21 days after they place an order. Using the Scheduler, we can create a one-time event scheduled for 21 days from the order date. When the event triggers, it invokes a Lambda function that sends the email, using the context provided when the event was created.

{
 "scheduleExpression": "at(2023-06-01T00:00:00)",
 "target": {
 "arn": "arn:aws:lambda:region:account-id:function:sendFollowUpEmail",
 "input": "{\"customerId\":\"123\",\"email\":\"customer@example.com\"}"
 }
}

Comparing EventBridge Rules and Scheduler

When to Use EventBridge Rules

Pattern-Based Event Routing: If we need to route events to different targets based on the event content, EventBridge Rules are ideal. For example, routing different order statuses to different Lambda functions.
Complex Event Patterns: When we have complex patterns that require matching against multiple attributes, EventBridge Rules provide the necessary flexibility.

When to Use EventBridge Scheduler

Timer-Based Invocations: For any time-based scheduling (rate or cron), the Scheduler is preferred due to its additional features like start and end times, flexible time windows, and automatic retries.
One-Time Events: If you need to schedule events to occur at a specific time in the future, the Scheduler’s one-time event capability is invaluable.
Simpler Configuration: The Scheduler offers a more straightforward setup for time-based events without the need for an event bus.

AWS Push Towards Scheduler

AWS seems to be steering users towards the Scheduler for timer-based invocations. In the AWS Console, when creating a new scheduled rule, you’ll often see prompts suggesting the use of the EventBridge Scheduler instead. This indicates a shift in focus, suggesting that AWS may continue to invest more heavily in the Scheduler, potentially making some of the timer-based functionalities of EventBridge Rules redundant in the future.

Summing It Up

AWS EventBridge Rules and EventBridge Scheduler are powerful tools for building event-driven architectures. Understanding their capabilities and limitations will help us choose the right tool for our needs. EventBridge Rules excel in dynamic, pattern-based event routing, while EventBridge Scheduler offers enhanced features for time-based scheduling and one-time events. As AWS continues to develop these services, keeping an eye on new features and updates will ensure that we leverage the best tools for our applications.

May 20, 2024 by Fernando SRE Cloud stuff SRE stuff 0

Simplifying AWS Lambda. Understanding Reserved vs. Provisioned Concurrency

Let’s look at the world of AWS Lambda, a fantastic service from Amazon Web Services (AWS) that lets you run code without provisioning or managing servers. It’s like having a magic box where you put in your code, and AWS takes care of the rest. But, as with all magic boxes, understanding how to best use them can sometimes be a bit of a head-scratcher. Specifically, we’re going to unravel the mystery of Reserved Concurrency versus Provisioned Concurrency in AWS Lambda. Let’s break it down in simple terms.

What is AWS Lambda Concurrency?

Before we explore the differences, let’s understand what concurrency means in the context of AWS Lambda. Imagine you have a function that’s like a clerk at a store. When a customer (or in our case, a request) comes in, the clerk handles it. Concurrency in AWS Lambda is the number of clerks you have available to handle requests. If you have 100 requests and 100 clerks, each request gets its own clerk. If you have more requests than clerks, some requests must wait in line. AWS Lambda automatically scales the number of clerks (or instances of your function) based on the incoming request load, but there are ways to manage this scaling, which is where Reserved and Provisioned Concurrency come into play.

Reserved Concurrency

Reserved Concurrency is like reserving a certain number of clerks exclusively for your store. No matter how busy the mall gets, you are guaranteed that number of clerks. In AWS Lambda terms, it means setting aside a specific number of execution environments for your Lambda function. This ensures that your function has the necessary resources to run whenever it is triggered.

Pros:

Guaranteed Availability: Your function is always ready to run up to the reserved limit.
Control over Resource Allocation: It helps manage the distribution of concurrency across multiple functions in your account, preventing one function from hogging all the resources.

Cons:

Can Limit Scaling: If the demand exceeds the reserved concurrency, additional invocations are throttled.
Requires Planning: You need to estimate and set the right amount of reserved concurrency based on your application’s needs.

Provisioned Concurrency

Provisioned Concurrency goes a step further. It’s like not only having a certain number of clerks reserved for your store but also having them come in before the store opens, ready to greet the first customer the moment they walk in. This means that AWS Lambda prepares a specified number of execution environments for your function in advance, so they are ready to immediately respond to invocations. This is effectively putting your Lambda functions in “pre-warm” mode, significantly reducing the cold start latency and ensuring that your functions are ready to execute with minimal delay.

Pros:

Instant Scaling: Prepared execution environments mean your function can handle spikes in traffic from the get-go, without the cold start latency.
Predictable Performance: Ideal for applications requiring consistent response times, thanks to the “pre-warm” mode.
No Cold Start Latency: Functions are always ready to respond quickly, making this ideal for time-sensitive applications.

Cons:

Cost: You pay for the provisioned execution environments, whether they are used or not.
Management Overhead: Requires tuning and management to ensure cost-effectiveness and optimal performance.

E-Commerce Site During Black Friday Sales

Let’s put this into a real-world context. Imagine you run an e-commerce website that experiences a significant spike in traffic during Black Friday sales. To prepare for this, you might use Provisioned Concurrency for critical functions like checkout, ensuring they have zero cold start latency and can handle the surge in traffic. For less critical functions, like product recommendations, you might set a Reserved Concurrency limit to ensure they always have some capacity to run without affecting the critical checkout function.

This approach ensures that your website can handle the spike in traffic efficiently, providing a smooth experience for your customers and maximizing sales during the critical holiday period.

Key Takeaways

Understanding and managing concurrency in AWS Lambda is crucial for optimizing performance and cost. Reserved Concurrency is about guaranteeing availability, while Provisioned Concurrency, with its “pre-warm” mode, is about ensuring immediate, predictable performance, eliminating cold start latency. Both have their place in a well-architected cloud environment. The key is to use them wisely, balancing cost against performance based on the specific needs of your application.

So, the next time you’re planning how to manage your AWS Lambda functions, think about what’s most important for your application and your users. The goal is to provide a seamless experience, whether you’re running an online store during the busiest shopping day of the year or simply keeping your blog’s contact form running smoothly.

April 5, 2024 by Fernando SRE Cloud stuff 0