Serverless Functions Deep Dive

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Serverless functions deep dive
Danilo Poccia
Principal Evangelist, Serverless
AWS
@danilop

AWS operational responsibility models
On-Premises Cloud
Less More
Compute Virtual Machine
EC2 Elastic Beanstalk AWS LambdaFargate
Databases MySQL MySQL on EC2
RDS MySQL RDS Aurora Aurora Serverless DynamoDB
Storage Storage
S3
Messaging ESBs
Amazon MQ Kinesis SQS / SNS
Analytics
Hadoop Hadoop on EC2 EMR Elasticsearch Service Athena

Serverless applications
Services (anything)
Changes in
data state
Requests to
endpoints
Changes in
resource state
Event source Function
Node.js
Python
Java
C#
Go
Ruby
Runtime API

Anatomy of a Lambda function
Handler() function
Function to be executed
upon invocation
Event object
Data sent during Lambda
function Invocation
Context object
Methods available to
interact with runtime
information (request ID,
log group, more)
import json
def lambda_handler(event, context):
# TODO implement
return {
'statusCode': 200,
'body': json.dumps('Hello World!')
}

Lambda Layers
Lets functions easily share code: Upload layer
once, reference within any function
Promote separation of responsibilities, lets
developers iterate faster on writing business logic
Built in support for secure sharing by ecosystem

Using Lambda Layers
• Put common components in a ZIP file and
upload it as a Lambda Layer
• Layers are immutable and can be versioned
to manage updates
• When a version is deleted or permissions to
use it are revoked, functions that used it
previously will continue to work, but you
won’t be able to create new ones
• You can reference up to five layers, one of
which can optionally be a custom runtime
Lambda
Layers
arn:aws:lambda:region:accountId:layer:shared-lib
Lambda
Layers
arn:aws:lambda:region:accountId:layer:shared-lib:2
Lambda
Layers
arn:aws:lambda:region:accountId:layer:shared-lib:3

Lambda Runtime API
Bring any Linux compatible language runtime
Powered by new Runtime API - Codifies the
runtime calling conventions and integration points
At launch, custom runtimes powering Ruby
support in AWS Lambda, more runtimes from
partners (like Erlang)
Custom runtimes distributed as “layers”
Rule
Stack

Runtime Bootstrap
• The bootstrap executable act as a bridge
between the Runtime HTTP API and the
Function to be executed
• Bootstrap needs to manage response/error
handling, context creation and function
execution
• Information on the interface endpoint and the
function handler are shared as environment
variables
/runtime API
/invocation/next
/init/error /ID/error
/invocation/ID/response
/invocation/ID/error
bootstrap
Process events/headers
Clean up
Initialize and Invoke function
Response/Error handling
Lambda
Function

Build PCI and HIPAA compliant serverless applications!
Serverless platform services that can be used in both:

Start with a framework
AWS
Chalice
AWS Amplify
AWS
SAM
AWS: Third-party:
Serverless
Framework

AWS Serverless Application Model (SAM)
AWS CloudFormation extension optimized for
serverless
Special serverless resource types: Functions, APIs,
SimpleTables, Layers, and Applications
Supports anything AWS CloudFormation supports
Open specification (Apache 2.0)
https://aws.amazon.com/serverless/sam

SAM template
AWSTemplateFormatVersion: '2010-09-09’
Transform: AWS::Serverless-2016-10-31
Resources:
GetFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.get
Runtime: nodejs8.10
CodeUri: src/
Policies:
- DynamoDBReadPolicy:
TableName: !Ref MyTable
Events:
GetResource:
Type: Api
Properties:
Path: /resource/{resourceId}
Method: get
MyTable:
Type: AWS::Serverless::SimpleTable
Just 20 lines to create:
• Lambda function
• IAM role
• API Gateway
• DynamoDB table
O
pen
Source

AWS SAM Command Line Interface (AWS SAM CLI)
CLI tool for local development, debugging, testing,
deploying, and monitoring of serverless applications
Supports API Gateway “proxy-style” and Lambda service API
testing
Response object and function logs available on your local
machine
Uses open source docker-lambda images to mimic
Lambda’s execution environment such as timeout, memory
limits, runtimes
Can tail production logs from CloudWatch logs
Can help you build in native dependencies
https://aws.amazon.com/serverless/sam

SAM CLI
sam init --name my-app --runtime python
cd my-app/
sam local ...
sam validate # The SAM template
sam build
sam package --s3-bucket my-packages-bucket
--output-template-file packaged.yaml
sam deploy --template-file packaged.yaml
--stack-name my-app-prod
sam publish # To the AWS Serverless Application Repository
O
pen
Source

With the AWS Serverless Application Repository:
Developers can…
• Discover and deploy ready-made apps and
code samples
• Combine applications in the app repository
with their own via Nested Applications
• Customize open-source apps to get started
quickly
• Share apps privately or publish apps
for public use

TweetSource:
Type: AWS::Serverless::Application
Properties:
Location:
ApplicationId: arn:aws:serverlessrepo:...
SemanticVersion: 2.0.0
Parameters:
TweetProcessorFunctionName: !Ref MyFunction
SearchText: '#serverless -filter:nativeretweets'
Nested apps to simplify solving recurring problems
Standard
Component
Custom
Business
Logic
Polling schedule
(CloudWatch
Events rule)
trigger
TwitterProcessor
SearchCheckpoint
TwitterSearchPoller
Twitter
Search API

AWS SAM Template Capabilities
• Can mix in other non-SAM CloudFormation
resources in the same template
• i.e. Amazon S3, Amazon Kinesis, AWS Step Functions
• Supports use of Parameters, Mappings,
Outputs, etc
• Supports Intrinsic Functions
• Can use ImportValue
(exceptions for RestApiId, Policies, StageName attributes)
• YAML or JSON

AWS Lambda Environment Variables
• Key-value pairs that you can dynamically pass to
your function
• Available via standard environment variable APIs
such as process.env for Node.js or os.environ for
Python
• Can optionally be encrypted via AWS Key
Management Service (KMS)
• Allows you to specify in IAM what roles have access to
the keys to decrypt the information
• Useful for creating environments per stage (i.e.
dev, testing, production)

Amazon API Gateway Stage Variables
Stage variables act like environment variables
• Use stage variables to store configuration values
• Stage variables are available in the $context object
• Values are accessible from most fields in API
Gateway
• Lambda function ARN
• HTTP endpoint
• Custom authorizer function name
• Parameter mappings

AWS Lambda and Amazon API Gateway Variables + SAM
Parameters:
MyEnvironment:
Type: String
Default: testing
AllowedValues:
- test
- staging
- prod
Description: Environment of this stack of
resources
Mappings:
SpecialFeature1:
test:
status: on
staging:
status: on
prod:
status: off
#Lambda
MyFunction:
Type: 'AWS::Serverless::Function'
Properties:
…
Environment:
Variables:
ENVIRONMENT: !Ref: MyEnvironment
Spec_Feature1: !FindInMap [SpecialFeature1,
!Ref MyEnvironment, status]
…
#API Gateway
MyApiGatewayApi:
Type: AWS::Serverless::Api
Properties:
…
Variables:

Parameters:
MyEnvironment:
Type: String
Default: testing
AllowedValues:
- testing
- staging
- prod
Description: Environment of this stack of
resources
Mappings:
SpecialFeature1:
testing:
status: on
staging:
status: on
prod:
status: off
#Lambda
MyFunction:
Type: 'AWS::Serverless::Function'
Properties:
…
Environment:
Variables:
Spec_Feature1: !FindInMap [SpecialFeature1,
!Ref MyEnvironment, status]
…
#API Gateway
MyApiGatewayApi:
Type: AWS::Serverless::Api
Properties:
…
Variables:
AWS Lambda and Amazon API Gateway Variables + SAM

MyLambdaFunction:
Properties:
Handler: index.handler
Runtime: nodejs6.10
AutoPublishAlias: !Ref ENVIRONMENT
DeploymentPreference:
Type: Linear10PercentEvery10Minutes
Alarms:
# A list of alarms that you want to monitor
- !Ref AliasErrorMetricGreaterThanZeroAlarm
- !Ref LatestVersionErrorMetricGreaterThanZeroAlarm
Hooks:
# Validation Lambda functions that are run before & after traffic shifting
PreTraffic: !Ref PreTrafficLambdaFunction
PostTraffic: !Ref PostTrafficLambdaFunction
AWS SAM + Safe Deployments

AWS Lambda Alias Traffic Shifting & AWS SAM
AutoPublishAlias
By adding this property and specifying an
alias name, AWS SAM will do the
following:
• Detect when new code is being
deployed based on changes to the
Lambda function's Amazon S3 URI.
• Create and publish an updated version
of that function with the latest code.
• Create an alias with a name you
provide (unless an alias already exists)
and points to the updated version of
the Lambda function.
Deployment Preference Type
Canary10Percent30Minutes
Linear10PercentEvery10Minutes
Linear10PercentEvery1Minute
AllAtOnce
In SAM:

Alarms: # A list of alarms that you want to monitor
- !Ref AliasErrorMetricGreaterThanZeroAlarm
- !Ref LatestVersionErrorMetricGreaterThanZeroAlarm
Hooks: # Validation Lambda functions that are run before & after
traffic shifting
PreTraffic: !Ref PreTrafficLambdaFunction
PostTraffic: !Ref PostTrafficLambdaFunction
AWS Lambda Alias Traffic Shifting & AWS SAM
Note: You can specify a maximum of 10
alarms
In SAM:

Globals:
Function:
Runtime: nodejs6.10
CodeUri: s3://code-artifacts/pet_app1234.zip
MemorySize: 1024
Timeout: 30
AutoPublishAlias: !Ref ENVIRONMENT
getDogsFunction:
Properties:
Handler: getdogs.handler
Events:
GetDogs:
Type: Api
Properties:
Path: /Dogs
Method: ANY
getCatsFunction:
Properties:
Handler: getCats.handler
Events:
GetCats:
Type: Api
Properties:
Path: /Cats
Method: ANY
getBirdsFunction:
Properties:
Handler: getBirds.handler
Timeout: 15
Events:
GetBirds:
Type: Api
Properties:
Path: /Birds
Method: ANY
AWS SAM Globals

Lambda permissions model
Fine grained security controls for both
execution and invocation:
Execution policies:
• Define what AWS resources/API calls can this
function access via IAM
• Used in streaming invocations
• E.g. “Lambda function A can read from
DynamoDB table users”
Function policies:
• Used for sync and async invocations
• E.g. “Actions on bucket X can invoke Lambda
function Z”
• Resource policies allow for cross account
configst access

AWS SAM Policy Templates
MyQueueFunction:
Properties:
...
Policies:
# Gives permissions to poll an SQS Queue
- SQSPollerPolicy:
queueName: !Ref MyQueue
...
MyQueue:
Type: AWS::SQS::Queue
...

SAM Policy Templates
45+ predefined
policies
All found here:
https://bit.ly/2xWycnj

Best
Practices

AWS SAM Best Practices
• Use Parameters and Mappings when possible
to build dynamic templates based on user
inputs and pseudo parameters such as
AWS::Region
• Use the Globals section to simplify templates
• Use Export & ImportValue to share resource
information across stacks
• Build out multiple environments, such as for
Development, Test, Production and even DR
using the same template, even across
accounts
SAM Template
Source
Control
Dev
Test
Prod

AWS Cloud Development Kit (CDK)
https://awslabs.github.io/aws-cdk
AWS CDK Toolkit
+
AWS Construct Library
+
@aws-cdk/
aws-serverless
D
eveloper
Preview

Serverless Functions Deep Dive

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Serverless Functions Deep Dive

Similar to Serverless Functions Deep Dive (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Serverless Functions Deep Dive