# SAA - C03 Certification: Serverless ## Lambda Function ### Limits * Execution: * Memory allocation: 120 MB - 10 GB * Maximum execution time: 900 seconds (15 minutes) * Environment variables (4 KB) * Concurrency executions: 1000 (can be increased) * Disk capacity (in /tmp): 512 MB to 10 GB * Deployment: * Lambda function deployment size (compressed .zip): 50 MB * Size of uncompressed deployment: 250 MB * You can use the /tmp directory to load other files at startup * Size of environment variable: 4 KB ### Lambda SnapStart * Improves Lambda functions performance up to 10x at no extra cost for Java 11 and above * When enabled, the function is invoked from a pre-initialized state * When you publish a new version: * Lambda initialize function * Takes a snapshot of memory and disk state of the initialize function * Snapshot is cached for low-latency access ### Customization at the Edge * Edge Function: * A code that you write and attach to CloudFront * Run close to your users to minimize latency * CloudFront provides two types: **CloudFont Functions & Lambda Edge** * Use case: customize the CDN content * Pay only for what you use * Fully serverless #### Some use-cases * Website Security and Privacy * Dynamic web application at the Edge * SEO * Intelligently Route Across Origins and Data Centers * Bot mitigation at the Edge * Real-time Image Transformation * A/B Testing * Use Authen/Author * User Tracking and Analytics #### CloudFront Functions * Lightweight functions written in JavaScript * Sub-ms startup times, millions of requests/second * Used to change **Viewer requests** and **Viewer responses** * Native feature of CloudFront (manage code directly in CloudFront) * Use cases: **cache key normalization** (transform request attributes to create an optimal Cache key), **insert/modify/delete HTTP headers**, **URL rewrites** or **redirects**, **generate** * **and validate user-generated tokens** (e.g. JWT) to allow/deny requests #### Lambda Edge * Lambda functions written in NodeJS or Python * Scales to 1000s of requests/second * Used to change CloudFront requests CloudFront and responses to the origin * Author your functions in one AWS region (us-east-1) then CloudFront replicates to its locations * Use cases: Longer execution time, code depends on a 3rd library, network access to use external services for processing, file system access or access to the body of HTTP requests ### Lambda in VPC By default, the Lambda function is launched outside VPC, therefore, it cannot access resources in VPC (RDS, ElastiCache, internal ELB,…) #### Solutions * Defint the VPC ID, the Subnets and Security Groups * Lambda will create an ENI (Elastic Network Interface) in a subnet #### Lambda with RDS Proxy * To reduce the workload when lots of lambda functions directly access the database => using **RDS Proxy** * RDS Proxy * Improve scalability by pooling and sharing DB connections * Improve availability by reducing by 66% the failover time and preserving connections * Improve security by enforcing IAM authentication and storing credentials in Secrets Manager > The Lambda Function must be deployed in VPC, because RDS Proxy is never publicly accessible ## Amazon DynamoDB * NoSQL - with transaction support * Scales to massive workload, distributed database * Millions of requests per second, trillions of rows, 100s of TB of storage * Fast and consistent in performance * Low-cost and auto-scaling capabilities * There is no maintenance or patching. It is always available * Standard & Infrequent Access (IA) Table Class ### Basics * Each table has a Primary Key that needs to be defined when creating it * Each table can have an infinite number of items * Each item has attributes (can be added over time - can be null) * The maximum size of an item is 400 KB * Data types supported are: * Scalar Types - String, Number, Binary, Boolean, Null * DocumentTypes - List, Map * SetTypes - String Set, Number Set, Binary Set ### Read/Write Capacity Modes **Provisioned Mode (default)** * You specify the number of reads/writes per second * You need to plan capacity beforehand * Pay for provisioned Read Capacity Units (RCU) & Write Capacity Units (WCU) * Possibility to add auto-scaling mode for RCU & WCU **On-Demand Mode** * Read/writes automatically scale up/down with your workload * No capacity planning is needed * Pay for what you use, more expensive * Great for **unpredictable** workloads ### DynamoDB Accelerator (DAX) * Help solve read congestion by caching * Microseconds latency for cached data * Doesn’t require application logic modification (compatible with existing DynamoDB APIs) * 5 minutes TTL for cache (default) ### Stream Processing * Ordered stream of item-level modifications (create/update/delete) in a table * Use cases: * React to change in real-time * Real-time usage analytics * Insert into derivative tables * Implement cross-region replication * Invoke AWS Lambda on changes to your DynamoDB table * The characteristics of DynamoDB Streams: * 24 hours retention * Limited # of consumers * Process using AWS Lambda Triggers or Dynamoc DB Stream Kinesis adapter * The characteristics of Kinesis Data Streams (newer): * 1-year retention * High # of consumers * Process using AWS Lambda, Kinesis Data Analytics, Kinesis Data Firehose, AWS Glue Streaming ETLs,... ### Global Tables * Make a DynamoDB table accessible with low latency in multiple regions * Active-Active replication * Applications can **READ** and **WRITE** to the table in any region * Must enable **DynamoDB Stream** as a pre-requisite ### Time To Live * Automatically delete items after an expiry timestamp ### Backups for disaster recovery * Continuous backups using point-in-time recovery (PITR) * Optionally enabled for the last 35 days * Point-in-time recovery to any time in the backup window * The recovery process creates a new table * On-demand backups * Full backups for long-term retention, until explicitly deleted * It does not affect performance or latency * Can be configured and managed in AWS Backup (enables cross-region copy) * The recovery process creates a new table ### Integration with S3 * Export to S3 (must enable PITR) * It does not affect the reading capacity of the table * Perform data analysis on top of DynamoDB * Retain snapshots for auditing * ETL on top of S3 data before importing back into DynamoDB * Export in DynamoDB Json or ION format * Import from S3 * Import CSV, DynamoDB Json, or ION format * It does not consume any writing capacity * Creates a new table * Import errors are logged in CloudWatch ## API Gateway * AWS Lambda + API Gateway: no infra to manage * Support for the Websocket * Handle API versioning * Handle different environments * Handle security (authen/author) * Create API keys, handle request throttling * Swagger/Open API import to quickly define APIs * Transform and validate requests and responses * Cache API responses * Generate SDK and API specifications * **Endpoint Types:** * **Edge-Optimized (default)**: for global clients * Requests are routed through the CloudFront Edge locations * The API gateway still lives in only one region * **Regional** * For clients in the same region * Could manually combine with CloudFront * **Private** * Can only be accessed from VPC using **VPC Endpoint** (ENI) * Use a resource policy to define access ## AWS Step Functions * Build serverless visual workflow to orchestrate Lambda functions * Features: sequence, parallel, conditions, timeouts, error handling,… * Can integrate with EC2, ECS, On-premises servers, API Gateway, SQS,… * Possibility of implementing a human approval feature * Use cases: order fulfillment, data processing, web app, any workflow,… ## Amazon Cognito * Give users an identity to interact with web or mobile app * **Cognito User Pools**: * Sign-in functionality for app users * Integrate with API gateway & ALB * **Cognito Identity Pools** (Federated Identity) * Provide AWS credentials to users so they can access AWS resources directly * Integrate with Cognito User Pools as an identity provider ### Cognito User Pools (CUP) #### User Features * Create a serverless database of users for web & mobile app * Simple login: username/password * Password reset * Email & phone number verification * MFA * Federated Identities: users from Fb, Google, SAML,… #### Integrations * CUP integrates with API Gateway and ALB #### Federated Identities * Get identities for “users” so they obtain temporary AWS credentials * Users can then access AWS services directly or through API Gateway