Off-by-none: Issue #16

Premature Serverless Optimization…

Welcome to Issue #16 of Off-by-none. Thanks for joining us. 🤘🏻

Last week we looked at Lambda Layers and custom runtimes. This week we’re going to talk about when we should worry about optimizations, plus highlight some recent discussions about the term “serverless” and what that actually means. We’ve also got some interesting articles, several product announcements, and (somehow) more stuff from re:Invent.

Let’s get started. 👍

When you spend too much time optimizing the wrong things… ⚙️

Mark Schwartz published an article on the AWS Cloud Strategy Blog entitled: Micro-Optimization: Activity-Based Costing for Digital Services? In it he outlines the fact that we can now meter individual units of compute to analyze costs. Simon Wardley (and others, including me) have been talking about capital flow for quite some time. Erik Peterson over at CloudZero uses the term FinDevOps to described it. But knowing your costs is different than trying to prematurely optimize them.

I wrote a post last week about the potential to overpay when waiting on remote API calls. This was a micro-optimization, and for my use case and company, it made sense. However, there are two slippery slopes that this type of fine-grained metering can introduce. The first is to tie your costs directly to customer pricing. Some services make sense to use metered billing, but don’t let this level of cost granularity influence the value your service provides to customers.

Second, is premature optimization. Compared to building and maintaining your own systems, cloud computing is ridiculously inexpensive, especially when you’re starting out and haven’t achieved significant scale. Don’t waste your developers’ time trying to shave off nickels and dimes from your bill. Focus on creating more value by delivering and iterating on features faster and worry about cost optimizations later.

Choosing serverless, however, is a MACRO optimization. I have some thoughts on that.

When you’re still confused by what serverless actually means… 🤷‍♂️

You’re not alone. Ben Kehoe called serverless a spectrum at one point, CloudZero wrote a post about it. AWS calls it an operational construct. Simon Wardley has his definition. Jeff Hollan wasn’t happy with the mischaracterizations in this paper that argues that current serverless offerings are “a bad fit for cloud innovation.” And Paul Johnston says that teaching people to do serverless is hard because it’s not about technology, but culture.

I have plenty of my own thoughts on this as well, but one thing is for sure, this debate won’t be settled any time soon. Regardless of the exact definition, I believe many of us “know it when we see it” and are starting to embrace the benefits it brings. And if you’re looking for some of those benefits, Zack Kanter makes the business case for serverless in his new post on TechCrunch.

What to do when you’re looking for some light serverless reading… 📚

Ory Segal published some Security Considerations for AWS Lambda Runtime API and Layers. AWS does a lot to protect you and your application from security issues, opening up custom runtimes, while a good thing, means more to consider from a security standpoint. Read this post to get an idea of some of these new risks.

Serverless Latency has been a common objection amongst the anti-serverless crowd for quite some time. Tim Bray dives deep into this and gives us some things to think about regarding state hydration, database considerations, and how we should really be thinking/talking about latency in our applications.

Yan Cui (AKA The Burning Monk), talks about Holistic Problem Solving using serverless. Yan just wrapped up his Production Ready Serverless course, which is a favorite among many of us in the serverless community.

For more on custom runtimes in Lambda, you can check out Adnan Rahic’s crash course on Serverless with AWS – Running Node.js 11 on Lambda. But just because it’s possible, doesn’t mean it’s a good idea. 😃

When you’re looking for more serverless announcements… 📣

Serverless, Inc. announced the release of the Serverless Framework v1.35. Good news for you Ruby folks, plus support for cross-region CloudFormation outputs and a bunch of bug fixes.

AWS announced that Amazon SQS now Supports Amazon VPC Endpoints using AWS PrivateLink. It’s a pain to need NATs just to connect to some AWS services, so for bunkered apps, this removes another external call to the Internet.

AWS also announced support for nested applications for AWS SAM and the AWS Serverless Application Repository. Nested applications were announced at re:Invent, but now that AWS SAM supports them, I’m guessing we’ll see some interesting use cases emerging. Easier reusability in our serverless applications is a big deal.

If you really want to geek out, there’s a post on How to use the new Amazon DynamoDB key diagnostics library to visualize and understand your application’s traffic patterns. Not sure I would spend a lot of time with this one, but it’s nice to know it’s there if you need it.

Beyond some of these bigger announcements, there were also quite a few Invisible Improvements made by AWS. Alex DeBrie broke them all down for us in his new post.

When weeks go by and we’re still talking about re:Invent…

It seems that no matter how many hours you’ve spent watching re:Invent videos and reading recaps, there’s always more to discover. There’s another post here that lists several great talks, and here are two more that I really enjoyed.

Accelerate Innovation & Maximize Business Value w/ Serverless Apps (SRV212)
Linda Lian talks about how Amazon thinks about serverless. It’s explained as an operational construct, rather than an architectural model or a way to think about packaging and deploying code. Christopher Dixon from Comcast then shows us how Xfinity used serverless to integrate Netflix streaming into their set top boxes. Pretty cool stuff.
Watch the talk

CI/CD for Serverless and Containerized Applications (DEV309)
Clare Ligouro, Principal Engineer at AWS Container Services walks us through the three pillars of releasing modern applications. Lots of great information in here about blue-green and canary deployments, plus how to use Lambda to add verification hooks and automatically rollback ones that fail.  Watch the talk

Also, if you want a bit of an inside look at re:Invent, check out Marcia Villalba’s video series on her Foo Bar channel. She interviewed a lot of people, so it’ll be great when the full versions come out. Maybe start with Day 2 if you want to see a snippet of yours truly. 😉

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Ory Segal (@orysegal). Ory is the CTO and Co-Founder of PureSec, a serverless security platform. Beyond their core product, Ory and his team are responsible for a number of innovations around serverless security. These include their free FunctionShield and Least Privileged Role Generator tools for Lambda, their creation and contribution to the OWASP Serverless Top 10 project, and their collaboration with AWS to bring application security to Lambda using Layers. Ory is also active on the PureSec Blog and just launched a new eBook all about AWS Lambda Security Best Practices. Serverless empowers developers to build and release software quickly, but that can introduce significant security risks. I feel much better knowing that Ory is watching our backs. 👀

Final Thoughts 🤔

The more popular “serverless” gets, the more people try to overload the term and subscribe it to everything. I’m a firm believer that serverless is not a buzzword, and that it means something very specific, even if the definition continues to be blurred by marketing departments. If I thought this was just an argument about semantics, then I’d probably let it go. But I think there is more to it than just that, and that the distinction will become important. More thoughts to come on this.

I hope you’ve enjoyed this issue of Off-by-none. All of your feedback and suggestions are incredibly helpful, so please keep them coming. Reach out to me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and ideas for making Off-by-none better.

Until next time,

Off-by-none: Issue #14

re:Capping re:Invent…

Welcome to Issue #14 of Off-by-none. I just spent a week in Vegas at AWS re:Invent and have I got a lot to share with you!

Last week we pondered if RDBMS were a good fit for serverless, overcame some common serverless objections and geeked out over serverless security. This week we’ll recap re:Invent, take a look at some of the amazing sessions and speakers, and review another 7,000 AWS product announcements (or something like that).

Buckle your seatbelt and let’s get started! 🏎

What to do if you’re suffering from re:FOMO… 😿

Unless you’ve been asleep for the last several months, you’re probably aware that AWS threw quite the shindig last week in Las Vegas. If you weren’t able to attend, don’t worry about it, we’ve got you covered. Because remember, what happens in Vegas, ends up on the Internet.

re:Capping re:Invent: AWS goes all-in on Serverless is my post that outlines some of the key announcements and what they all mean. I think I learned enough to write several books, so expect more posts to be coming.

What I learned from AWS re:Invent 2018 by James Beswick is also another great recap with a warning for cloud consultants and an important message about TCO. Paul Swail asks the question, What new use cases do the re:Invent 2018 serverless announcements open up? (answers included, of course). And if you want to read about all the Serverless announcements at re:Invent 2018, Alex DeBrie and Jared Short from Serverless, Inc. give you the full rundown.

When you’re looking for some really good conference talks… 👨‍🏫👩‍🏫

Advanced Design Patterns for DynamoDB (DAT401) 🤯
Rick Houlihan gave one of the most impressive talks of the entire conference. There were so many insights in this session that it was hard to keep track. He said, “We invented relational databases because storage was expensive” and “When people say NoSQL is missing JOINs, you say you’re missing the point.” He stressed that modeling NoSQL is difficult because you need to know and understand your access patterns upfront. But once you do, you can create a single table that can support 20 or more access patterns with just two or three Global Secondary Indexes (GSIs). Seriously mind-blowing stuff. Plus he stressed using serverless to validate your products. One of his best quotes was, “Don’t fail fast, fail cheap.” This could be the best 60 minutes you ever spend.

Watch the talk and checkout Best Practices for DynamoDB

From Monolith to Modern Apps: Best Practices (SRV322) 🎸
Paras Bhuva and Tom Laszewski (with a little help from Fender’s VP of IT, Chris Ingraham) gave an excellent talk that outlined how enterprises are adopting serverless for a variety of use cases. Companies like Reuters and Hearst are using it for analytics, Finra is using it for fraud detection, and Expedia is using it for operations. Paras walks us through the design of a modern application and stresses that teams want/need to “reduce their undifferentiated heavy lifting.” It is a very interesting session that really highlights the power, speed, and diversity of serverless applications.

Watch the talk

Serverless Architectural Patterns and Best Practices (ARC305) 🗺
Drew Dennis and Maitreya Raganath gave another really interesting talk that explored some architectural patterns and best practices. I see many people struggle with their serverless application designs because they aren’t quite sure how to stitch together all the managed services to create efficient pipelines. This talk looks at several common patterns including those for web applications, stream data processing, and data lakes.

Watch the talk

Applying Principles of Chaos Engineering to Serverless (DVC305)
Yan Cui (aka @theburningmonk), gave an awesome talk on Chaos Engineering and how we can apply those principles to serverless. The topics in here are so good that I don’t think I can do it justice by trying to sum this session up. Just do yourself a favor and watch it.

Watch the talk

A Serverless Journey: AWS Lambda Under the Hood (SRV409) 👩‍🔧
Holly Mesrobian and Marc Booker took us on a deep dive into how Lambda actually works. Lots of really interesting information, but perhaps the best part of the talk was this…

Reducing the cold start VPC issue by using a secure tunnel with a remote NAT and no longer stealing hundreds of IPs from CIDR blocks in your VPC subnets? Yeah, that’s a pretty big deal.

Watch the talk

There were so many amazing talks that I can’t possibly list them all. Be sure to check out AWS’s playlist on YouTube for an extensive list of recorded sessions. You can also check out this post by Jennine Townsend that lists some of the more notable sessions.

Just when you think that AWS might be running out of ideas… 🚀

Nope. Not only does AWS continue to make massive investments in its global infrastructure, hardware components and product offerings, but it also continues to break through the limits of serverless computing. Here are some of the important serverless announcements from last week.

When you’re still looking for some more serverless content… 👍

Joe Emison wrote a really great article that discusses The Serverless Sea Change. The post goes deep into the impact that serverless can have on companies and outlines an example of the dramatic cost savings that can be achieved. He makes an astute point that “ten times more lines of code, is ten times more technical debt.” Spending more time researching and less time coding will make maintaining your serverless applications much easier and a heckuva lot cheaper. 💰

Marcin Zasepa pointed out that Version 3 of the AWS SDK for JavaScript is written in TypeScript, so that’s pretty cool. 🤓

If you’re looking to jump in and start using some new AWS features, you can learn How to publish and use AWS Lambda Layers with the Serverless Framework.

You can also learn What’s New with Serverless at AWS during a webinar on December 11, 2018 @ 2pm ET. There are a lot of new things happening, so this might be a good opportunity to get a crash course.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Corey Quinn (@QuinnyPig). Corey is a cloud economist that helps companies save money on their AWS bills. But he’s also the brains behind the Last Week in AWS newsletter, host of Screaming in the Cloud, occasional blogger, regular conference speaker, and all around nice guy. Don’t let the snark fool you, he is a huge proponent (and user) of serverless technologies, but also a vocal critic of AWS when necessary (which keeps them honest and on their toes). Corey shared this newsletter last week with his audience and many of you are reading this because of him. So here’s a huge thank you to Corey for helping me spread the serverless word. 🙌

Final Thoughts 🤔

This was another long one, but last week was a whirlwind of information and announcements that have cemented serverless as the future of cloud computing. I want to thank AWS and all the support staff that helped put together and run this amazing conference. And I also want to thank AWS for continuing to support their customers and pushing serverless innovation. The next few years are going to be really exciting.

I hope you’ve enjoyed this issue of Off-by-none. Your feedback is always most welcome and much appreciated. Your suggestions help me make this newsletter better each week. Please feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and if you’d like to contribute to Off-by-none.

AWS just released enough products and features to keep us busy until next year’s re:Invent. So let’s go build some amazing serverless apps!

See you next week,

Off-by-none: Issue #13

Live from AWS re:Invent…

Welcome to Issue #13 of Off-by-none. We’re coming to you LIVE from AWS re:Invent in Las Vegas!

Last week we looked at some clever use cases for Step Functions, revisited serverless microservices, and made the serverless case for startups. This week we rethink serverless+RDBMS, challenge the objections of laggards, protect ourselves from DoS and other attacks, and of course, look at some new AWS product launches.

So many amazing things to get to today, so let’s jump right in!

When you’re not sure if RDBMS and serverless mix… ☯

Many of us wished for RDS HTTP Endpoints, and the other day, AWS announced that you can now access your Amazon Aurora Serverless Database with the New Data API (Beta). No VPCs, no connection management, and automatic scaling with Aurora Serverless. Almost sounds too good to be true. 😳

And… it sort of is (for now). In Aurora Serverless Data API: A First Look, I share the results of a few experiments I ran as well as some of my initial thoughts on the implementation. TLDR; The latency is really bad and this isn’t ready for primetime. But like all things AWS, it’ll get much better before GA.

Is RDBMS in serverless applications even a good idea? Paul Johnston shares his thoughts on Serverless and Data Rigidity and argues that other technologies (like NoSQL) have removed the need for them. He’s not wrong, but there are still plenty of use cases that relational databases work well for. One thing we can definitely agree on: AVOID ORMs! 🙌

When you’re looking for some serverless inspiration… 💡

Serverless, Inc. is wrapping up #NoServerNovember with the re:Invent serverless virtual hackathon. Build a serverless app for a non-profit, feel good about yourself, and win some swag.

If you want to get a bit more complex, try building a chat application using AWS AppSync and Serverless.

Are you writing your code in Python? AWS SAM CLI just introduced the sam build Command that lets you easily package all your dependencies. Or you can learn How To Package External Code In AWS Lambda Using the Serverless Framework.

What to do when your boss won’t let you play with serverless… 👨🏻‍💻

James Beswick outlines five common objections to adopting serverless in his new post, Scared Serverless — How do you handle opposition from your IT group? Lots of ammunition in here if you find yourself needing to defend your (very wise) decision.

If they’re still not convinced, maybe this Twitter thread will help. Simon Wardley says, “The overwhelming output of most businesses is waste. Serverless is way larger than you think. More significant than cloud was.” It’s definitely worth the read (plus there’s maps).

When you realize you’re still responsible for securing your serverless application… 🔒

Avi Shulman from PureSec wrote a great post on Lambda DoS Mitigation Strategies. See how different invocation types and retry policies can be leveraged by attackers to wreak havoc on your serverless applications. Lots of practical tips in here including a number of best practices and tips to minimize your exposure.

Want to add even more security to your serverless app? Amazon API Gateway has added support for AWS WAF, which means no more creating regional endpoints and using your own CloudFront distribution. It still won’t prevent event injection, but it’s a good start.

And just when you think that npm audit will protect you from third-party package vulnerabilities, we discover another widely used open source software that contained a bitcoin-stealing backdoor. Luckily it only has 2 million weekly downloads. 🤦🏻‍♂️ A friendly reminder to minimize dependencies in your serverless applications.

What to expect when 50,000 AWS fans in Vegas are waiting for more product updates… 🚀

There’s only been one full day of re:Invent and AWS has already announced a number of products and services that are pushing serverless to a whole new level. I’ve heard a lot of whispers, so expect many more to come over the next few days. 🤘🏻

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Chris Munns (@chrismunns). Chris is a Principal Developer Advocate for Serverless at Amazon Web Services and a great resource for anyone working with (or interested in) serverless. He’s a regular speaker at events, an AWS blog contributor, a host on Serverless Bytes, and he also puts on the occasional webinar. Even though he works for AWS, he’s a huge advocate for serverless computing in general and will always jump into a good debate on Twitter. This week he’s not only giving a number of talks at re:Invent, but also finding some time to spend with members of the serverless community.

Final Thoughts 🤔

The buzz around serverless at re:Invent is absolutely amazing. Every session I’ve attended so far has been bursting with people that are either already using it in production, or are hoping to start. I know we are in a bit of bubble here, but it’s clear that AWS is continuing to make massive investments in serverless technologies and wants to continue to be the market leader. Exciting times ahead.

I hope you’ve enjoyed this issue of Off-by-none. Your feedback and suggestions are always welcome and much appreciated. It helps me make this newsletter better each week. Please feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and if you’d like to contribute to Off-by-none.

Go build some amazing serverless apps and enjoy the rest of re:Invent! ⚡️

I’ll be here all week😉

P.S. If you liked this newsletter, please share with your friends and coworkers. I’d really appreciate it. Thanks!