Download as PDF, PPTX
Uploaded byYan Cui
Lambda and DynamoDB best practices
This document contains a summary of best practices for using Lambda and DynamoDB presented by Yan Cui. Some key recommendations include implementing observability from the start by using metrics and alerts to monitor performance, creating separate AWS accounts for each team and environment, loading secrets securely from SSM Parameter Store at runtime, following the principle of least privilege with IAM policies, parallelizing functions where possible, and various DynamoDB optimizations like using DocumentClient and PAY_PER_REQUEST billing. The document emphasizes that best practices depend on individual contexts and situations.
More Related Content
![[AKIBA.AWS] VPN接続とルーティングの基礎](https://cdn.slidesharecdn.com/ss_thumbnails/akibaaws6vpn-180510092054-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Similar to Lambda and DynamoDB best practices
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Lambda and DynamoDB best practices
- 1. Lambda & DynamoDB Best Practices atalk by Yan Cui
- 2. “Best practice isusually just someone else’s opinion” - random person on the internet
- 3. The “goodness” ofa practice is tied to the context in which it is applied
- 5. “Good ideas thatwork for most people, most of the time”
- 6.
- 7.
- 8.
- 9. Yan Cui http://theburningmonk.com @theburningmonk runningserverless in production since 2016
- 10. 01. Observability fromthe start
- 11. A measure ofhow well the internal state of a system can be inferred from its external outputs Observability
- 12.
- 13. everything fails, allthe time
- 14. happened system repaired userimpact reduce MTTR
- 15. Identify & ResolveIssues
- 16. Identify & ResolveIssues
- 17. happened system repaired userimpact MTTDiscovery
- 19. “What alerts shouldI have?”
- 20. It depends onwhat you’re building…
- 21.
- 22. Lambda error rate % throttlecount DLQ error count iterator age
- 23. Lambda error rate % throttlecount DLQ error count iterator age regional concurrency
- 24. Lambda error rate % throttlecount DLQ error count iterator age regional concurrency API Gateway p90/95/99 latency success rate % 4xx rate % 5xx rate %
- 25. API Gateway p90/95/99 latency successrate % 4xx rate % 5xx rate % SQS message age Lambda error rate % throttle count DLQ error count iterator age regional concurrency
- 26. happened system repaired userimpact finding root cause
- 27.
- 28. the needle ishere somewhere…
- 29. This is myapproach nowadays
- 30. + high-value structured logs+ metrics + alerts
- 31. + high-value structured logs+ metrics + alerts most of my troubleshooting
- 33. errors are captured andcategorized
- 34. errors are captured andcategorized frequency and trends
- 36. did errors correlate toa deployment?
- 41. invocation event, env vars,logs, etc.
- 47. + high-value structured logs+ metrics + alerts Lambda invocations + every IO-request
- 48. + high-value structured logs+ metrics + alerts Lambda invocations + every IO-request complex (non-IO) biz logic
- 49.
- 50. logs from allthe functions
- 51. + high-value structured logs+ metrics + alerts system metrics for AWS services
- 53. 02. One accountper team per environment
- 54. Mind the sharedlimits
- 55. no. of DynamoDBtables no. of API Gateway regional APIs no. of API Gateway edge-optimized APIs no. of Kinesis shards no. of IAM roles no. of S3 buckets no. of CloudFormation stacks no. of SNS subscription filters no. of SSM parameters … Resource Limits
- 56. DynamoDB read &write API Gateway requests/second Lambda concurrent executions SSM parameter ops/second … Throughput Limits
- 58.
- 59. One account perTeam per Environment
- 60. Isolate critical/high-throughput services totheir own accounts
- 62.
- 63.
- 64.
- 65.
- 66.
- 67.
- 68.
- 69.
- 70.
- 74.
- 75.
- 76. 03. Load secrets atruntime ? ? ? ? ? ? ? ? ? ? ? ?? ? ? ?
- 77. SSM Parameter Store Secret1 Secret 2
- 78. SSM Parameter Store Secret1 Secret 2 IAM Environment: SECRET_1: … SECRET_2: … Environment: SECRET_1: … SECRET_2: …
- 79. SSM Parameter Store Secret1 Secret 2 IAM Environment: SECRET_1: … SECRET_2: … Environment: SECRET_1: … SECRET_2: … yay!
- 82. Secrets should NEVERbe in plain text in env variables
- 83. SSM Parameter StoreIAM fetch at cold start, cache, invalidate every x mins Secret 1 Secret 2
- 84.
- 86. SSM Parameter StoreIAM Secret 1 Secret 2 switch to Higher Throughput for production
- 87. Secrets Manager IAM Secret1 Secret 2 built-in rotation, more expensive
- 88. 04. Principle of leastprivilege
- 91.
- 92.
- 93.
- 94. network boundary full-trust zero-trustnetworking
- 95. network boundary full-trust zero-trustnetworking compromised nodes give attackers access to our entire system
- 96.
- 97. trust no-one authenticate and authorizeevery request
- 98. trust no-one authenticate and authorizeevery request use IAM to protect internal APIs
- 99. network security isa bonus, not the only line of defense
- 100.
- 102.
- 104.
- 105.
- 106.
- 107. Set environment variable AWS_NODEJS_CONNECTION_REUSE_ENABLED to“1” (for Node.js function running AWS SDK v1.x)
- 108. Use Database Proxieswhen working with RDS
- 109. Smaller deployment artefact=== faster coldstart
- 110. Adding more memoryDOESN’T help reduce cold start duration (except for JVM functions)
- 111.
- 112. Use Lambda Layersas a deployment optimization
- 113. NOT as apackage manager Use Lambda Layers as a deployment optimization
- 117. const AWS =require(‘aws-sdk’) (for Node.js function running AWS SDK v1.x) const DynamoDB = require(‘aws-sdk/clients/dynamodb’)
- 118. Prefer Lambda Destinationover DLQs
- 119.
- 120. DLQ Lambda Destinations payloadpayload, context(s), and response
- 122.
- 123. Use DocumentClient insteadof AWS.DynamoDB (for Node.js function running AWS SDK v1.x)
- 124. Use PAY_PER_REQUEST billingmode as default
- 125. Store large blobsin S3
- 126. Use BatchGetItem andBatchWriteItem to read/write multiple items
- 127. Avoid Scan unlessyou absolutely have to
- 128. Use caching toavoid DynamoDB calls
- 129. Use high cardinalitykeys as hash key
- 130. Use ULIDs assort key
- 133. Use SSE withKMS CMK
- 134.
- 135. Learn single-table designpatterns
- 136.
- 137. Learn single-table designpatterns But don’t turn it into a religion
- 138.
- 139. single-table design Steep learningcurve. Difficult to add new access patterns.
- 140. single-table design Steep learningcurve. Difficult to add new access patterns. Can’t monitor usage cost by entity type.
- 141. single-table design Steep learningcurve. Difficult to add new access patterns. Can’t monitor usage cost by entity type. Difficult to use DynamoDB streams.
- 142. “But what aboutall the cost savings from Single-Table Design?!”
- 143. “But what aboutall the cost savings from Single-Table Design?!” Only matters when running at scale.
- 144. The “goodness” ofa practice is tied to the context in which it is applied
- 145. A best practicefor Amazon is probably not best for you.
- 147. https://theburningmonk.com/hire-me Advise Training Delivery “Fundamentally, Yanhas improved our team by increasing our ability to derive value from AWS and Lambda in particular.” Nick Blair Tech Lead
- 148.