Off-by-none: Issue #23

The State of Serverless…

Welcome to Issue #23 of Off-by-none. It’s so great to have you all here! 🤗

Last week we looked at recent investments into the serverless ecosystem, highlighted some serverless events, and offered some thoughts for picking a database for your next project. This week we’re going to look at how we can use serverless to deal with third-party API quotas, watch some helpful videos, introduce “Serverless Stories”, and so much more.

It’s been another really busy week for serverless, so let’s get right to the good stuff. 🚀

When your third-party API imposes quota limits… 🙅‍♂️

In the serverless world, we often get the impression that our applications can scale without limits. With the right design (and enough money), this is theoretically possible. But in reality, many components of our serverless applications DO have limits. Whether these are physical limits, like network throughput or CPU capacity, or soft limits, like AWS Account Limits or third-party API quotas, our serverless applications still need to be able to handle periods of high load. And more importantly, our end users should experience minimal, if any, negative effects when we reach these thresholds.

One way in which our serverless applications can be limited, is when using third-party APIs that enforce quotas. In my new post, Throttling Third-Party API calls with AWS Lambda, we look at how we can use a combination of SQS, CloudWatch Events, and Lambda functions to implement a precisely controlled throttling system. We also discuss how you can implement (almost) guaranteed ordering, state management (for multi-tiered quotas), and how to plan for failure. Not only is this solution extremely robust and flexible, it’s also very cost effective (like < $2/mth).

When AWS has a slow week… 🐌

I’m sure the AWS teams are all working hard on their next big releases, but in the meantime, they managed to release a few interesting serverless-related updates.

Speaking of state management, AWS Step Functions are an excellent way to add orchestration to your serverless workflows. Now you can Develop and Test AWS Step Functions Workflows Locally, which is a pretty cool feature. Integration testing in the cloud is still necessary, but the more we can do locally, the better.

And for more local testing goodness, Amazon DynamoDB Local Added Support for Transactional APIs, On-Demand Capacity Mode, and 20 GSIs. For many of us that use DynamoDB, these features for the local version are a welcome addition. Uber cool feature: track and return the capacity units consumed by your queries. 👍

Not so serverless, but perhaps “server-less”, is the announcement that AWS Ops Automator v2 now features vertical scaling. Unfortunately, most of us still have to use servers for some of our workloads. But this new vertical scaling feature lets you increase instance sizes instead of simply adding more instances. Scaling up instead of scaling out can be much more cost effective (plus it uses Lambda to do the work 😉).

When you’re looking for innovations in serverless… 👩‍🔬

Epsagon introduced their new Issues Manager that allows you to easily track issues in your serverless applications, identify trends, and quickly jump to Trace Search to troubleshoot them.

IOPipe now enables auto-tracing of HTTP/S calls by default, giving you insight into what external (and internal) API calls are being made and how long they take. You can read all about this new feature at The Secret Life of HTTP(S) Calls in a Serverless World.

Braintree, the payments service, is Introducing Serverless Payment Functions. According to this, “developers will be able to use Braintree to write and deploy serverless functions to instrument their transaction lifecycles, enable 3rd party connections, hook into existing business processes, streamline data exports, and more, all via Braintree tooling.” Not quite sure how this will all work yet, but could be an interesting approach for other SaaS companies to allow for more seamless serverless integrations.

CloudFlare introduced the Workers Cache API, which now lets you modify the REQUEST and RESPONSE objects from within your workers. This is similar to the functionality that Lambda@Edge provides, which is very cool functionality for many use cases.

And Google announced that Cloud Firestore has gone GA. Cloud Firestore is Google’s answer to DynamoDB, but they’ve sprinkled in a handy little feature that lets you export data directly to BigQuery to do additional analysis. Nice way to reduce a data replication step.

What to do if you prefer Prime Video over the Kindle store… 🍿

Good news, the serverless community has been busy producing some really helpful and interesting video content.

Chris Munns and AWS take you on a Deep Dive into AWS SAM and the SAM CLI, plus another Deep Dive Into Lambda Layers and the Lambda Runtime API. Lots of great information packed into these sessions.

James Hood from AWS also shows us how to Accelerate Serverless Development Using AWS SAM & the AWS Serverless Application Repository. This is an excellent intro to Nested Applications, which can be a very handy feature.

Alex Ellis’ talk from GOTO 2018 is now available. Serverless Beyond the Hype is a great talk that starts by giving you an overview of the serverless landscape, and then gets into the nuts and bolts of what makes OpenFaaS different from alternatives such as Knative. If you’re a member of the “serverless on top of containers” crowd, you’ll enjoy this.

The team at Epsagon held a webinar with plenty of insights into Serverless Monitoring in Practice. Interesting look at how complex tracing can be, and what companies like theirs are doing to make it easier.

Our friend Marcia Villabla released two more re:Invent interviews. In the first interview she is Talking about Serverless with Forrest Brazeal, another AWS Serverless Hero and all around serverless expert. She then talks about building AWS communities with Martin Buberl.

I also discovered this site (thanks to Corey Quinn) that organizes a collection of AWS re:Invent videos and podcasts of past and current breakout sessions. Plus they’re searchable, which is really helpful. And if you missed re:Invent last year, you can sign up for the on-demand version of AWS Innovate re:Invent Recap 2018.

Where to look for some interesting serverless use cases… 🕵️‍♀️

I love seeing people apply serverless in new and interesting ways. Below is a handful of nifty little use cases that will hopefully inspire you to do something amazing. 😉

In Lord of the Patch — Story of the PatchBot, Vladyslav Cherednychenko from About You, explains how his team used AWS Lambda to automate vulnerability scans on their EC2 cluster.

Maxime Preaux built a simple Serverless Mailchimp Subscription service using Webtask.io, but you could easily apply this to other providers.

If you’d prefer that your applications do more listening, Apoorva Dave walks us through Building your own Alexa Skill from scratch. I think voice control is only going to become more prevalent, so my advice: start thinking about how your apps can leverage it to create better user experiences.

How to build a Serverless Twitter bot demonstrates another great serverless use case. Lorenzo Tenti builds one using the Serverless Framework, Python and Lambda. Bots are another useful tool when done correctly, and running them on serverless makes a whole ton of sense.

Maybe more of a tool rather than a use case, but Running Jenkins Pipelines in AWS Lambda is possible with a tool called Jenkinsfile-Runner-Lambda. This might be one of those square peg, round hole situations, but Carlos Sanchez points out that “it could make sense to run Jenkinsfiles in Lambda when you are building AWS related stuff.” Maybe, but I think the point is that Lambda is a potential fit for any type of automation.

Finally, Sam Breed (aka Baby Wolfman) created a Lambda WebSocket chess ♟ demo. Could your next MMO be 100% serverless? Might be worth thinking about.

When you’re looking for some encouraging Serverless Stories… 🏆

I’ve been speaking with several people lately about new voices in the serverless community. While I try to recognize people that create helpful content and companies that are innovating in the space, we tend to get stuck in our own echo chamber. This week I’m introducing “Serverless Stories” (or maybe Serverless Voices 🤔), that shares posts from people who are just starting out with serverless or have been adopting serverless in their organizations. I think there is a lot to learn from these folks, especially for those of us trying to foster and build the community. I’d love to know your thoughts on this.

My Serverless Story is a short read that outlines a developer’s foray into the serverless world. It’s interesting to hear their thoughts on the cost of API Gateway, the limited interfaces into managed services (as opposed to traditional methods), and how they believe that it’s not ready for latency-sensitive workloads.

Jordan Finneran wrote a post about Going Serverless where he discusses the migration of an Express.js app. Lack of tooling, reliance on a single provider, cold starts, and of course, event-driven architecture, are his top concerns.

In Lessons learned from launching TubeStats: a completely serverless service, Joshua Khan talks about the execution timeout limits of AWS Lambda functions and how they built their own state management component to overcome it. Interesting takeaway here: he didn’t use Step Functions for orchestration because of “unfamiliarity” and wanting to get “something launched” as soon as possible.

In part 2 of Dirty Old Code, Pierre Bails discusses the process his company used to move their monolithic Ruby on Rails application to a serverless infrastructure. Interesting step-by-step approach which could be a useful template for other companies looking to make the switch.

When you’re looking for some insights into the state of the serverless ecosystem… 📈

John Demian says that Businesses are overcoming challenges with serverless and that “2019 will be the year of serverless.” He points out that cost and speed of development continue to be the motivating factors for companies to push for adoption.

Likewise, TechRadar points out that 2019 will be A year of reckoning for digital transformation. Key takeaway here is the prediction that serverless will be central to a company’s success.

Then there are stories like this: Developers find cautious optimism for serverless platforms. There is a lot of FUD here that purports that tools don’t work as expected and that the developer learning curve is causing problems. 🤦🏻‍♂️

This doesn’t seem to be stopping investment into the space, however, especially since a new report says that Global Serverless Architecture Market Share will Hit USD 18.04 billion by 2024. Serverless is still new, and it has its share of challenges, but the market is growing, and every day implementation gets easier.

The 2019 Microservices Ecosystem by Tobias Kunze is a great read that outlines all the major players and gives some insights into how they all fit in to the larger ecosystem. Serverless is mentioned, of course, but the vast majority are supporting containers and other types of “server-full” approaches.

Why Amazon’s AWS Cloud Business Will Continue to Grow is another interesting piece that gives a bit of insight into AWS’s growth strategy. While they continue to grow their virtual machine business with EC2, they are also supporting container management, and obviously, serverless. More interestingly (which we saw at re:Invent), AWS is saying, “if you don’t want to come to the cloud, we’ll bring the cloud to you.” Support for On-prem, along with the multitude of other offerings, is helping to build up the cloud computing market for all providers.

And speaking of growing the cloud market, a recent piece titled Capital One’s public cloud strategy at odds with industry, points out the benefits of using a public cloud versus a private one. Perhaps most importantly for a bank, the combined security expertise of public cloud providers supplies the trust needed to let Capital One focus on other parts of their stack.

When you’re finally ready to abandon WordPress… 🤬

In case you missed it, generating static sites is all the rage nowadays, and for good reason. I’d venture a guess that 99.9999% of all website traffic are simple GET requests to essentially static pages. Serving those pages up from an edge location cache makes a whole bunch of sense. But whether you’re looking to go fully-static, or leverage new features to reduce your dependencies on servers, there are plenty of options available.

A Greater Gatsby: Modern, Static-Site Generation by Toby Fee answers all your Gatsby-related questions.

If you’re not ready to go fully static, try Going serverless with React and AWS Amplify. Peter Mbanugo walks you through creating a single page app that uses GraphQL to power your dynamic features.

Adam Henson points out that You Might Not Need Server Side Rendering. But what about SEO? Adam does a pretty good job answering why not.

On the other hand, Dan Quackenbush would probably disagree. He talks about how Caching SPAs for SEO with Lamdba@Edge actually increased their crawl rate by 900%.

And let’s not forget that AWS can help you move ALL THE WAY up the stack in some cases. So What AWS service should you use to publish a web site?  Adrian Hall might have the answer for you.

When serverless security shows up on your cloud audit questionnaire… 🔐

Chris Tozzi outlines some Serverless security best practices for cloud dev and ops teams. Pretty standard stuff, but it seems that best practices need to be repeated over and over again.

If you want a really in-depth look at serverless security, you can now watch the Foundations of AWS Lambda Security webinar that Ory Segal and I did, on-demand. Lots of really good stuff in there.

We talked about adding voice control to ours apps a bit earlier, but how do we secure those, especially if they control sensitive internal components?  Aravind Kodandaramaiah from AWS shows us how to Secure and distribute Alexa skills with Alexa for Business. Which, besides the security aspect, could also make for some great internal tooling for your business.

While this story isn’t about serverless, it is a cautionary tale about being a little too paranoid when it comes to security. Digital exchange loses $137 million as founder takes passwords to the grave is an example of failed redundancy. Be smart about your secrets management, even if you think you’re invincible.

When you need the right tool for your serverless job… 🔨

Remember that time you were asking for more serverless frameworks? Well, here you go. Meet TyX, a TypeScript-based serverless backend framework designed for deployment into AWS Lambda.

If you want some more TypeScript, try IFTO: A simple debugging module for AWS Lambda (λ) timeouts.

OPTASY points out the 6 Best Serverless Plugins to tailor the Serverless Framework to your project-specific needs.

If you’re using Lambda@Edge to do redirects, middy-reroute can make your life a lot simpler.

And if you need to debug your serverless applications, Yan Cui shows us how to do it with Dashbird.

StackShare announce their Top 50 Developer Tools of 2018. There were some nice serverless mentions in there including Architect, OpenWhisk, CloudFlare Workers and AWS CloudFront.

What to do if you’re an audiophile, but also love serverless… 🔊

A recent episode of the ThoughtWorks Podcast does some Diving into serverless architecture.  Mike Roberts offers some of his insights.

The Cloudcast: A Serverless Look Ahead for 2019 features special guest, Paul D. Johnston, chatting about the current state of serverless, how to economically think about functions, and areas where serverless needs to improve.

In Diving into Data with Amazon Athena, Simon Elisha shares how Amazon Athena can give you powerful SQL querying capabilities over text files in your S3 buckets. If you’re not familiar with Amazon Athena, you seriously need to check it out.

When you want to get hands-on with serverless tutorials… 👨🏻‍💻

Here is an insanely complete, and step-by-step guide to building a full-stack application using AWS Lambda and React-native.

Binaris also has a Full Stack Tutorial with Serverless & React that includes all the code you need to get up and running in no time.

Yan Cui offers a quick Lambda optimization tip that can speed up HTTP API calls from your serverless applications. TLDR; enable HTTP keep-alive.

For those of you that might be interested in Connecting to AWS DocumentDB from a Lambda function, this post will walk you through it in painstaking detail.

Step Functions can be a bit confusing, but in AWS Step Functions – Doing Serverless is Easier Than You Think, the team at Thundra gives you the all basics.

James Beswick teaches us How to add file upload features to your website with AWS Lambda and S3.

Richard Freeman, PhD, has a great tutorial for Building a Serverless Microservice CRUD RESTful API with MongoDB.

Another thing that can trip you up is Configuration management for serverless AWS applications. Marcin Z-Pa has some thoughts on how to make it easier for you.

If you’re a GitLab CI user, Forrest Brazeal will show you How to set up multi-account AWS SAM deployments.

And finally, if you’re interested in Migrating an Express App into AWS Lambda the Easy Way, this post will give you some practical tips.

Where to go for some interesting serverless reads… 📚

Finding Serverless’ Hidden Costs is an important reminder that pay-per-use can lead to costly mistakes if you aren’t properly monitoring your serverless functions.

In AWS SLA: Are you able to keep your availability promise?, Andreas Wittig show us how to use the new AWS SLAs to calculate our own SLAs. Key point is to make sure you account for other variables besides just AWS’s promises.

Debunking Serverless Tropes by Ryan Marsh has a bit of fun at serverless naysayers’ expense. It made me laugh. 😀

🔥 Multi-region serverless backend — reloaded by Adrian Hornsby is an updated version of his old post on the topic. This time he discusses how the new Global Accelerator service works to eliminate DNS caching for better DR. Highly recommended read for anyone building out a serious, highly-available serverless application.

Raoul Meyer’s AppSync: Basically GraphQL as a service, is a good overview of what AppSync is and provides a few examples to help you get your head around it.

The Top 7 Takeaways from our 2018 Serverless Shows is a look back at Protego’s podcast episodes from last year. They had some great guests with some very good insights.

Nuweba published their Top Serverless Resources You Should Know About. A good list for those interested in staying current with what’s happening in the serverless world.

In Why DevOps Engineers Love AWS Lambda, Ran Ribenzaft from Epsagon gives us a number of great Lambda use cases for automating DevOps processes. These types of practical use cases are a great way for companies to get started with serverless.

Think you can run Kubernetes better than a cloud provider? Think again. Matt Asay argues that building your own Kubernetes cluster is a waste of valuable time. This is based off of a great Twitter thread from Ben Kehoe.

On Infrastructure at Scale: A Cascading Failure of Distributed System by Dan Woods, isn’t really about serverless, but I thought it highlighted some interesting challenges that arise from running distributed systems.

When you want to try something other than AWS… 🤷‍♂️

Ride the Serverless Wave with DigitalOcean’s One-click Droplet shows you how to get OpenFaaS up and running in DigitalOcean with just one click (sort of).

Azure Functions now has moves like Swagger (sorry, bad joke). Introducing Swagger UI on Azure Functions show you how to use a few services to generate your own API docs.

The Mixology Playbook: Kubernetes and Serverless is a well-written piece that talks about the values of a hybrid approach. While I believe there is room for a lot of players at this point, I think serverless (in whatever form it ends up taking) will ultimately win the war.

Hey Google, help me use Cloud Functions is another piece that points out how voice automation could be used to enhance a user experience. Susie Coleman works for the Guardian’s Voice Lab, which is trying to bring the “Guardian’s voice” to Google Assistant. If you’re not thinking about voice automation for your app, you might miss out on a huge opportunity.

Anchal Bhalla teaches you how to Build a Serverless App with Facial Recognition using IBM Cloud Functions. Simple tutorial, but it shows you how powerful some of this stuff is.

And last but not least, Simona Cotin shows us how to use the Azure Resource Manager to write Infrastructure as code for Serverless APIs using just a bit of JSON.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is James Beswick (@jbesw). James is a developer, author, AWS-Certified builder, and cofounder of Indevelo, a consulting firm that builds products on AWS. He’s also a speaker, a blogger, and an active member of the serverless community. He recently launched Ask James About AWS, a video series that walks you through a number of common AWS tasks. Through his writings, videos, and talks, James is helping to spread the benefits of serverless, as well as providing useful insights and education to those looking to adopt the cloud. Thanks for what you do, James!

Final Thoughts 🤔

I’ve had a number of really interesting talks with people over the last few weeks about the overall state of serverless. There is a tremendous amount of innovation, lots of great use cases emerging, and new people joining the community every day. However, we have a long way to go before serverless becomes top of mind. We need to continue to encourage collaboration between everyone in this space so that we can educate and spread the word.

Speaking of spreading the word, there are a number of ServerlessDays events coming up that are a great way to support and expand the community. ServerlessDays Boston just announced an amazing speaker lineup, and Hamburg and Austin are right around the corner. I hope you all get a chance to attend one of these events.

I hope you enjoyed this issue of Off-by-none. I love hearing your feedback and suggestions, it helps me make this newsletter better each week. Feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, or how you’d like to contribute to Off-by-none.

Take care,
Jeremy

Off-by-none: Issue #22

Investing in the future of serverless…

Welcome to Issue #22 of Off-by-none. I’m so happy you’ve joined us this week! 😁

Last week we looked at ways to scale your serverless apps, highlighted some recent innovations, and examined how serverless and the cloud is affecting the IT landscape. This week, we look at some recent investments into the serverless ecosystem, highlight some upcoming events, help you pick the right database for your next project, and share plenty of great serverless resources and reads.

There is so much happening in serverless right now! Let’s get to it. 💥

When you see people jumping on the serverless investment train… 🚂

This past week, Lumigo raised an $8M seed round to help manage serverless operations. I love seeing companies that are focusing on serverless raising money. It means that investors are seeing the value, which means they can see a market for it, which means that more companies will begin to invest in serverless technology, which means more options, which means great adoption, and ultimately, world domination… Okay, maybe I pushed that a bit too far.

Torsten Volk recently posted the Top 10 VC investments in serverless startups in 2018: $33M for Twistlock, $15M for Pulumi, $11M for Solo.io, $7M for Puresec, $10M for Serverless Inc., $5.5M for Stackery, $5M for CloudZero, $4.1M for Epsagon, $2M for IOpipe, and $2M for Protego Labs.

I really hope to see companies like this succeed and continue to push the limits of serverless!

When you’re trying to think of some useful serverless use cases… 🤔

Authentication at Edge with StackPath by Jason Byrne is an interesting look at how his company is attempting to eliminate an extra round trip to authenticate requests.

Centralized Logging System for Lambda Functions walks you through the process Mohamed Labouardy and the team over at Foxintelligence followed to deliver near real-time feed of logs from CloudWatch to ELK.

CloudFetch released an open source project called cloudquery that lets you turn any website to serverless API, including support for single-page applications.

Ricardo Trindade shows us a super simple way to create Slack Notifications via AWS Lambda and SQS. Great example of how you can add serverless to your existing workflows to reduce the complexity of your “serverfull” systems.

Our data lake story: How Woot.com built a serverless data lake on AWS is a great article that shows how Woot.com was able to reduce their operational costs by 90%. Plus, it’s a great use case that you can apply to your business straight away.

When your database selection process is down to eeny meeny Dyna-mo… 🤷‍♂️

You’re not alone. Choosing the right database for your application isn’t always easy. AWS has a great post that shows you How to determine if Amazon DynamoDB is appropriate for your needs, and then plan your migration. DynamoDB is an excellent choice for many different types of workloads, but it’s not right for everything.

If you do choose DynamoDb, getting started with writing interactions can be a bit overwhelming. You might want to check out Begin Data: DynamoDB made ridiculously easy!

Another often confusing concept is figuring out How to calculate a DynamoDB item’s size and consumed capacity. Zac Charles has got you covered in his recent piece.

Sasidhar Sekar from Hotels.com has a great piece about creating Efficient Indexes in DynamoDB. It’s the fifth post their DynamoDB series and definitely worth checking out.

Of course, if you want to push serverless data to the extreme, you can always Analyze and visualize nested JSON data with Amazon Athena and Amazon QuickSight. Mariano Kamp’s piece is incredibly useful.

When serverless observability just keeps getting better… 🕵️‍♀️

Thundra now supports observability for .NET functions. For those of you that thought (or were hoping) that C# was dead, Microsoft has news for you. Azure Functions is gaining a tremendous amount of popularity, and where there’s Microsoft, there’s .NET. Learn more by ready Sarjeel Yusuf’s post about Monitoring .NET Lambda Functions with Thundra.

If you want to learn a bit more about Serverless Observability Fundamentals, check out Christina Wong’s post about Breaking down your options when collecting data from AWS Lambda.

And Epsagon, another amazing observability platform, just released their public changelog. I really like this type of radical transparency, especially when you’re trusting companies like this to support your applications. They also initiated a fun Twitter contest. Export a picture of your architecture from Epsagon and tweet #ThisIsMyEpsagon to win a prize.

When you’re looking for deep thoughts on serverless… 🤓

Julian Friedman has a really interesting post titled What comes after Serverless? In it he argues that there is a “Deployless” future, where we’ll skip passed code repos and staging environments, and essentially just edit code. It might seemed a bit far-fetched, but it is worth a read.

From Servers to Serverless recounts Avner Braverman’s journey through infrastructure and cloud innovation. Interesting read with some good history and insights into why serverless is so powerful.

NoOps in a serverless world is an interesting piece that talks about shifting IT’s focus from operations to outcomes. The authors point out that in a 2018 Deloitte global CIO survey, 69% of respondents identified “process automation and transformation” as the primary focus of their digital agendas. NoOps is still a ways off, but as the authors argue, serverless is a powerful tool for companies to reduce their operational overhead.

Sujith Reddy Komma argues the PRO’s & CON’s of Serverless Architectures. It’s a fairly simple list, but I’ve included it because his “cons” are quickly being solved thanks to observability startups, multi-region deployments and SLAs. And the cost argument is starting to get a bit old (at least to me). Need to figure TCO, not just your services bill.

And speaking of costs, The Great Serverless Cost Debate: Serverless ≠ Costless is a great piece by John Demian that explains the cost benefits of going serverless. He makes the extremely salient point that “Running back-end operations is a business in itself.” For larger companies, this may be fine, but for smaller ones looking for a competitive advantage, it’s probably not a business you want to be in.

If you’re looking for more reasons to go serverless, Ryan Jones from Serverless Guru’s piece, Serverless Impact — Developer Velocity explains how serverless speeds up developers and lets them accelerate the delivery features faster.

Greg Simons also wrote about the added benefits of serverless. In Serverless; it’s more than a FaaS, he outlines a number of reasons why serverless is much more than just hype. Plus, there was a nice mention in there. 👍

9 trends to watch in systems engineering and operations from O’Reilly Media touches on a few interesting topics. They waver on whether Knative will become the standard (I don’t think so), the importance that cloud security will play in both automation and DevOps culture, and, of course, AIOPs, because we don’t have enough buzzwords right now.

They also noted that the “serverless craze is in full swing,” with a growth of over 17% from 2017. Erez Berkner, CEO & co-founder of Lumigo says, “2019 could be serverless’ breakthrough year.”

Of course, security should always be top of mind when deploying services to the public cloud. Serverless And The Evolution In Cloud Security, How FaaS Differs From IaaS is a great piece by Ory Segal from Puresec that will give you a side-by-side look so you know what you’re responsible for.

If you’re looking for some visuals, check out How to Fold a Fitted Sheet by Joe Emison from Monktoberfest 2018. If you don’t take away a higher meaning from it, at least you’ll know how to fold a fitted sheet.

Also, Slobodan Stojanovic was interviewed on the The Serverless Show talking about The Importance of Open Source & Community Involvement. Always love listening to Slobodan.

Finally, The Rise of “No Code” by Ryan Hoover isn’t about serverless, but it makes some interesting points about the people who are becoming makers. Thanks to products that allow “non-developers” to build MVPs (or even full-scale working applications), everyone is becoming a maker. What does this mean and how does it affect an IT world that is already being eaten up by automation? Something to think about.

When you’re looking to up your Lambda Layers game… 🚀

Ever wanted to publish your Docker containers as Lambda Layers? Well, now you can with aws-lambda-container-image-converter. This should open up some people’s imaginations.

Serverless Anything: Using AWS Lambda Layers to build custom runtimes by Ben Ellerby shows you how to use layers to build a custom PHP runtime. Sure, we’ve seen this before, but this piece provides an important reminder: “Don’t forget to terminate your large EC2 instance.” 😉

AWS already created a custom Rust runtime for us, but Doug Tangren took it a step further and built the serverless-rust plugin for the Serverless Framework. Love this type of community support!

Just recently, Gojko Adzic gave us some utility Lambda Layers for FFmpeg, SOX, Pandoc and RSVG. Nathan Glover used them to create Serverless Watermarks. Very cool.

When you’re trying to simplify your serverless development… 👩‍💻

Serverless, Inc. announced the release of Serverless Framework v1.36.3. Lots of enhancements and bug fixes in this one.

Brian Leroux published Introducing Architect 5.0: fully serverless WebSockets. More great updates and, of course, support for WebSockets.

And it seems that more frameworks are emerging everyday. Osiris is a new library for building and deploying serverless web apps on AWS. Haven’t spent much time with it, but give it a look.

I also came across the functional-typescript project, a TypeScript standard for rock-solid serverless functions. Looks pretty interesting.

And Eslam Hefnawy created a project called backend.js. It’s a super light module that lets you import your Lambda functions into the browser as a backend library. Not sure what I’d do with this, but kind of a cool concept.

Where to go to find some great serverless events… ✈️

If you’d like to go sans travel, there are a number of webinars scheduled to up your serverless game.

Nested Applications: Accelerate Serverless Development Using AWS SAM and the AWS Serverless Application Repository is on January 31. This is a good opportunity to learn more about SAM and how to reuse your serverless components.

Trend Micro also has a webinar on the 31st to help you Make Sense of the Cloud, Containers, and Serverless. There are some promises of security principles in there, a topic I’m always interested in.

If you’re in the area, or just feel like taking a trip, Serverless, Inc. is running a Serverless workshop on March 1 in San Francisco. Lots of topics covered in here for the serious serverless professional.

AWS is running a Serverless Solution Provider Day in London on February 12th. There will be three great talks by three great companies: Epsagon, Stackery and Puresec. Definitely worth the visit.

Serverlessconf announced that it is coming to the east coast this fall. Exact location and date to drop in February. 🤞 for Boston. 😉

Serverless Computing London 2019 announced that their call for papers is now open. This was a great conference last year, so no doubt it will be amazing again.

The Serverless Architecture Conference in The Hague, Netherlands is running from April 8th through the 10th. Lots of great speakers, plus yours truly will be giving a talk about Serverless Microservice Patterns for AWS. Definitely looking forward to this one.

And don’t forget ServerlessDays Cardiff, Hamburg, and Austin are all coming up. Plus ServerlessDays Boston will be announcing speakers later today!

When you’re looking for some good serverless tips and tricks… 💡

Tom McLaughlin wrote a post titled, AWS Lambda And Python Boto3: To Bundle Or Not Bundle With Your Function. Quite a bit of research went into finding out that “you should not be using the AWS Lambda runtime’s boto3 and botocore module.” If you’re developing serverless apps with Python, take a few minutes to review this post.

Subscribe SQS to a SNS topic in another AWS account with CloudFormation, and gotchas! is another time-saver provide by Yan Cui. It’s a common pattern to connect to services from other accounts, and configuring it correctly with CloudFormation is with Yan’s help.

Danielle Heberling from Stackery gives us some Chaos Engineering Ideas for Serverless. Unit tests and integration tests are a necessity for serverless applications, but testing failures in distributed systems is a surefire way to make sure your systems are resilient and can handle different types of failures.

When you realize that serverless is much bigger than just AWS… 🤯

The Serverless360 team put together the Top 15 Azure Serverless Blogs of 2018. Lots of interesting posts here.

Doug Stevenson from Google answers Firebase & Google Cloud: What’s different with Cloud Functions?

An introduction to Azure Durable Functions: patterns and best practices is a great introduction to some common patterns that you can use in Azure. Only caveat, the examples are in Java. 😬

Serverless on Google Cloud Platform: an Introduction with Serverless Store gives a bit of background on serverless, event-driven computing and how it all fits together with Google Cloud Platform. There is also a link to download the Serverless Store demo app.

IBM Cloud Functions is raising the memory execution level to 2Gb to better handle Monte Carlo methods, genetic algorithms, map-reduce, and a host of other combinatorial optimization and operations research algorithms that lend themselves to running in a serverless environment.

Getting started with Custom Dockerfiles for Node.js for Serverless Functions will show you how to us the Fn project to build functions that you can run on Kubernetes.

And if you’re looking for better secrets managment, Unifying Secrets for OpenFaaS will point you in the right direction. Hint: don’t check them into source control.

Finally, if you’re interested in doing more serverless computing at the edge, Taking a look at Cloudflare Workers might be worth your time.

When the teams at AWS are forced to listen to “We can’t stop, we won’t stop” by Miley Cyrus on constant repeat… 👩‍🎤

AWS Introduced Python Shell Jobs in AWS Glue. Now you can leverage your Python skills to build things like serverless ETL tasks without learning Apache Spark.

TLS Termination for Network Load Balancers has also been added. Not applicable for serverless yet, but it could just be a matter of time.

The AWS CloudFormation UpdateReplacePolicy Attribute allows you to specify an update policy to delete, retain, or create a snapshot of old resources once the new ones have been created. Handy feature for automated serverless deployments.

The AWS Amplify CLI now supports IAM roles including MFA flows, which is a nice way of adding some extra security to the set up process.

AWS Cloud9 Supports AWS CloudTrail Logging now. So if you’re using that as your IDE, CloudTrail can track configuration changes to your environment.

Amazon Cognito Announces 99.9% Service Level Agreement, which is nice. Serverless authentication out of the box, now with guaranteed uptime.

And if you’re using Elasticsearch to handle analytics or full-text searches, you’ll be happy to hear that Amazon Elasticsearch Service doubles maximum cluster capacity with 200 node cluster support. And they announced support for Elasticsearch 6.4.

Also, be sure to check out Jerry Hargrove’s visual notes for AWS AppSync.

When you’re looking for spirited serverless discussions on Twitter… 🍿

@rakyll had some thoughts on Kubernetes being about “never having to wait for your cloud provider for a feature because you can build it yourself.” Ben Kehoe and some others whole-heartedly disagreed.

Paul Johnston posted that “Relational databases are the swiss army knife of databases”, meaning that there are likely better choices, especially for your serverless projects. The Internet did what the Internet does best and generated a lot of opinions. Very interesting thread.

Not to be outdone by others, I too sparked a heated discussion around Event Injection in your serverless apps. There was some candid feedback, and perhaps my point of “developer responsibility” was lost a bit in my wording. However, even though event injection existed before Lambda wasn’t the point, it’s still something to be aware of, especially those that are new to event-driven architectures.

The good news about the above discussion is that it actually highlighted some confusion around the “47” service integrations that Lambda has. Ajay Nair thought this was “good feedback”, so hopefully we’ll get some better documentation out of it. Silver linings. ☁️

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Brian Leroux (@brianleroux). Brian is the co-founder of @begin, a serverless application platform that promises “Serverless in seconds.” He’s also working on the open-source Architect project, another powerful framework for building and deploying serverless applications. Brian is a regular speaker, blogger, and always welcome voice in the serverless community.

Final Thoughts 🤔

When I first started this newsletter almost six months ago, I was scouring the web each week trying to find interesting and relevant serverless content. Now every week I have to narrow down the list, and there are still over 75 links in this week’s issue alone!

I love serverless, and I love how more and more people are embracing it, experimenting with it, and seeing how it can transform the way they are building applications and their businesses. Erez from Lumingo said 2019 could be the breakout year for serverless. With all this momentum, I think he could be right.

I hope you enjoyed this issue of Off-by-none. I love hearing your feedback and suggestions, it helps me make this newsletter better each week. Feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, or how you’d like to contribute to Off-by-none.

See you next week,
Jeremy

Off-by-none: Issue #21

The serverless takeover…

Welcome to Issue #21 of Off-by-none. I hope you’re ready to talk serverless! 😃

Last week we got hands-on and learned how to handle “not-so-scalable” systems in our serverless applications. This week we look at some more ways to scale your serverless apps, highlight some recent innovations, examine how serverless and the cloud is affecting the IT landscape, and so much more.

Lots to get to, so let’s jump right in! 🏊‍♂️

When you’re trying to get your serverless application to scale… 📈

Mikhail Shilkov has a brilliant post titled: Serverless at Scale: Serving StackOverflow-like Traffic. In this post he runs experiments across AWS, GCP, and Azure, to test how serverless functions and blob-storage scales to 1,000 requests per second. The results are quite fascinating.

We often talk about scaling “non-serverless” downstream systems in this newsletter, and Tirumarai Selvan has presented us with another option for Scaling RDBMS for GraphQL backends on serverless. Connection management is an ongoing problem with serverless functions. AWS is working to fix this with their Data API for Aurora Serverless (and of course there’s my serverless-mysql package), but overall, not a bad (albeit, non-serverless) approach.

Paul Johnston has some thoughts on Serverless Compute and Serverless Data. It is an interesting way to compartmentalize serverless applications. Without the proper design, ephemeral compute is certainly limited by the underlying datastore. Designing for scale is the new default, and this is a skill that many developers have never really needed to worry about.

Tim Bray started this thread on Twitter that goes deep into microservices and temporal coupling through synchronous communication. 🤓 I love these types of discussions, especially when Marc Brooker and Sam Newman jump in.

And James Thomas tells us about loosely-coupled serverless functions with Apache Openwhisk. Good read that looks at the difference between triggers and queues and how they can affect the scalability of your severless application. A bit specific to Openwhisk, but I think the general concepts are quite universal.

When people are having way too much fun with custom runtimes… 👩‍💻

Danil Smirnov shows you how to access the latest JavaScript SDK from Lambda functions using Layers. You might think that AWS would keep this updated, but you’d be wrong. I ran into this problem a few times, which means you must package the aws-sdk with your Lambda functions. This way is much better. 👍

The team over at Thundra developed their own Node.js Custom Runtime to let you monitor your Lambda functions without making any changes to your code. We’ve seen this type of use case before, but Thundra went the extra step to show us how they actually built it.

Have you ever wondered how to run Elixir on Lambda? Me neither, but Arjan Molenaar has figured it out for us just in case. Building an Elixir runtime for AWS Lambda gives you a brief overview of his motivations, and ultimately leads you to the GitHub repository if you’d like to try it yourself.

And PHP fans can also rejoice! Bref, a serverless framework for PHP, is incorporating a custom PHP runtime into v0.3. Look forward to better performance, PHP-FPM support, and local development with Docker and AWS SAM.

Where to look for serverless events… 🗓

ServerlessDays Cardiff is coming up on January 30th. Tickets are still available, so if you’re going to be in the area, I’d highly suggest you attend. Can’t go wrong with talks from the likes of Yan Cui, Simona Cotin, the Ian MassinghamSlobodan Stojanović and so many more.

And if you’re state-side, ServerlessDays Boston is coming up on March 12th. We just announced the one and only Charity Majors as our opening keynote speaker. And I’m happy to announce that the, wait for it… legendary Chris Munns from AWS will be giving the closing keynote. The remaining speakers will be announced early next week. This is going to be good. 🙌

If you’re looking for something a bit more remote-friendly, Stackery has some upcoming serverless webinars that you can join. They’ll walk you through how to build your serverless applications without needing to write a bunch of YAML.

Feel like doing some traveling? Thundra put together a great list of Serverless Events You Should Be Aware Of in 2019. I’m going to try and get to a few of these myself.

For those of you that are visual learners… 👀

I stumbled across some videos that Cloud Path had created, and I was impressed with how well-produced they were. In AWS S3 & AWS Lambda Integration, they walk you through setting up an S3 trigger and the code required to process the event. Beginner level stuff, but I’m going to keep my eye on this channel.

Marcia Villalba dropped another re:Invent interview where she’s Talking about testing Serverless applications with Slobodan Stojonovic. Slobodan was our very first Serverless Star at Off-by-none and is an awesome serverless resource.

If you can’t get enough of Marcia, check out her Getting ready for AWS reInvent 2018 vlog series. If you’re thinking about going to re:Invent this year, these videos provide a first hand look at this amazing experience.

CloudFlare workers are a relatively new addition to the serverless ecosystem, and they’re quite passionate about how this type of edge computing could change how applications run. How Serverless Platforms are Changing to Enable New Applications is a talk by Zack Bloom that digs deep into this concept.

What to do if you’ve been ignoring serverless security and user privacy… 🔒

If you thought that you didn’t need to worry about GDPR, think again. It was just reported that France fined Google nearly $57 million for an alleged violation. Now this might just be France being France, or it’s a sign of things to come. If you’re not familiar with GDPR, or you’ve already forgot the requirements, Stripe has a great guide to help you out. C’est la vie. 🇫🇷

Last time I’ll mention this (promise). Ory Segal and I are hosting a Foundations of Lambda Security webinar on January 24, 2019 at 11am ET. It will be packed full of practical serverless security advice including risks associate with AWS Lambda, IAM permissions, governance and regulatory compliance, and scalability.

When you’re looking for innovation in the serverless ecosystem… 🔍

Epsagon continues to make serverless observability easier with the introduction of Trace Search. This is a very cool feature that lets you find and drill down into traces using a bunch of different filters. Plus they have created plug-in packages to make integrating tracing and cleaning up your old Lambda versions much easier.

But serverless observability and tracing is a hot space to be in, and Adam Johnson and the team over at IOpipe has their own long list of accomplishments and future plans. In Auld Lang Servers, Adam outlines IOpipe’s milestones and innovations over the last year. Their product continues to get better and better, giving serverless practitioners plenty of options when choosing an observability tool.

And don’t count out OpenWhisk. Release 0.17.0 (18.01.2019) of the Serverless Framework OpenWhisk plugin was recently released, with added support for concurrent actions, which should speed up your deployments.

When you find out that Google Cloud Functions finally supports Go… 🤷‍♂️

Google announced that Go 1.11 is now a supported language for Google Cloud Functions. You’d think that since they invented it, they might have beat Amazon to the punch. Oh well, at least GCP is still innovating its serverless offerings.

Not to be outdone by AWS’s classic serverless example, Adil H has put together a post showing us how to do Image Resizing with Go and Cloud Functions. Code included.

If you’re looking to push the envelope a bit more, Saurabh Deoras has a great article on combining TensorFlow, Go and Cloud Functions. I like when people experiment with stuff like this, and even though his final solution isn’t ideal, it still works. He even waxes-poetic at the end. #deep

When the zombie apocalypse might not be the apocalypse you need to worry about… 🧟‍♂️

Forrest Brazeal wrote a rather depressing (but necessary) piece about the The Creeping IT Apocalypse. With AWS reportedly working on a secretive low-code/no-code project, there is an entire class of engineers that could get automated out of existence. TLDR; learn to code and keep your skills current.

Along the same lines, James Beswick’s latest post, The cloud skills shortage and the unemployed army of the certified, comes at it from a slightly different angle. Of course IT head counts are dropping because of automation, but James argues it isn’t just about keeping your skills current. It’s about the unreasonable expectation that a single developer must now do the jobs of what used to require several highly-specialized people to do. TLDR; become a coding superstar.

Other people are writing about this trend, perhaps without even realizing it. Nader Dabit gives his take on what it means to do Full-Stack Development in the Era of Serverless Computing“This means you basically have a team of specialized engineers that have built out and iterated on something that you or your team simply could not do alone without investing an impractical number of hours.” I think this type of innovation is great, but don’t get caught watching shadows on the wall, this type of undifferentiated development work is going away. Now look who’s being poetic. 😉

When you really like seeing serverless use cases… 🤗

I think we are all in agreement that CloudWatch is not the best place to be digging into our application logs. There are plenty of options out there, but the team at BBC iPlayer shows us how they put Lambda Logs in ELK. It’s a DIY option, but highly effective for their needs.

This is a bit of an old post, but in How I export, analyze, and resurface my Kindle highlights, Sawyer Hollenshead show us how he created a serverless pipeline that extracted his highlights, analyzed them with NLP, and published them to his site to reflect on what he read. Pretty interesting use case, IMO.

Gavin Lewis shows us How To Build a Serverless CI/CD Pipeline On AWS. There is quite a bit of complexity to his approach, but he has it all laid out for you.

When you’re a big fan of the horror genre… 👹

Henning Jacobs has compiled a list of wonderful Kubernetes Failure Stories for us. He claims that these stories “should make it easier for people dealing with Kubernetes operations… to learn from others and reduce the unknown unknowns of running Kubernetes in production.” I say it’s just another opportunity for serverless fans to say I told you so 😂. But seriously, if you want to take a stab at Kubernetes, this is a good list to get you started (or maybe scare you away).

Corey Quinn recounts a horror story of his own in this Twitter thread. The story of an ambitious young man trying to set up his own infrastructure in a shared datacenter goes horribly awry, hilarity ensues. I remember these days myself, but now that the cloud is here, this type of tragedy can easily be avoided.

Where to go for some more serverless reading… 📚

Chris Feist wrote a post called Making serverless variables work for you to accompany his new serverless-plugin-composed-vars plugin for the Serverless framework. I do this a bit differently, but this looks like a handy plugin.

Migrating a Serverless application backend to the Serverless Framework highlights Tai Nguyen Bui’s journey moving away from the console and into the world of serverless deployment automation.

Speaking of serverless journeys, How I Got Comfortable Building with Serverless highlights how Jun Fritz went from code bootcamp graduate, to Stackery employee, to confident serverless builder in just a few months. There is still much to learn, but it is fascinating how quickly people can get things up and running.

The state of serverless: 6 trends to watch highlights a fairly obvious (IMO) evolution of any new technology. However, I think that betting Knative will drive standardization is a bit off. We can argue about what serverless means all day long, but with CloudFlare workers moving compute to the edge, and AWS loading VMs closer to the metal with Firecracker, I personally see anything that adds more layers of abstraction to ephemeral functions being a step in the wrong direction. Maybe it’s just me.

In Dear Go — Thank You For Teaching Me PHP Was A Waste of My Time, Vern Keenan is pretty harsh about the future prospects of PHP. Not sure I agree with him on that, but he does make some good points about Go potentially becoming the dominant serverless runtime.

And finally, Zac Charles asks, What happens to running threads when a Lambda finishes executing? If you’re interested in the inner workings of Lambda functions and container reuse, give this short article a read.

When you’re curious what AWS has been working on… ☁️

There were a lot of serverless announcements and innovations at AWS over the last few months. If you’re having a hard time keeping up, take a look at Eric Johnson’s full recap: ICYMI: Serverless Q4 2018

The new AWS Backup lets you automate and centrally manage your backups across AWS services. Jerry Hargrove (aka @awsgeek) wasted no time putting together a cloud diagram for you. He’s also got a great one for the new Amazon DocumentDB service as well.

AWS also added S3 as a deployment action provider in CodePipeline. Check out this tutorial to learn how to Create a Pipeline That Uses Amazon S3 as a Deployment Provider. Plenty of cool use cases with this.

Two weeks ago AWS announced that AWS Step Functions would support resource tagging. Now they’re getting their very own Service Level Agreement with three 9s.

And Step Functions isn’t the only one getting SLAs. Amazon announced 99.9% Service Level Agreements for Amazon Kinesis Data Streams and Amazon Kinesis Data Firehose.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Mikhail Shilkov (@MikhailShilkov). Mikhail is a Microsoft Azure MVP, a frequent conference speaker, and an advocate for all things serverless. His blog is loaded with insanely thorough articles about serverless (and functional programming) that are sure to help you level up your own skills. He mostly focuses on Microsoft, but has articles like this and this that can give you some much needed perspective in the overall serverless ecosystem. And today is his birthday, so Happy Birthday, Mikhail, and thanks for what you do! 🎂🎉🎈

Final Thoughts 🤔

Thank you for all the responses from last week. Everyone that sent me a message said they like the length and that they found it easy to skim and pick out the articles they were interested in. I’m glad you all like it. If you have any other thoughts, I’d be happy to hear them.

I hope you enjoyed this issue of Off-by-none. I love hearing your feedback and suggestions, it helps me make this newsletter better. Feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, or how you’d like to contribute to Off-by-none.

Take care,
Jeremy

Off-by-none: Issue #20

Let’s get hands-on…

Welcome to Issue #20 of Off-by-none. It’s great to have you here! 🤘🏻

Last week we sifted through quite a bit of serverless content to start the new year. This week we’re going to get a bit more hands-on, and dig into some useful applications of serverless that we can start using right now. We also have some more insights into the future of serverless, plus some really compelling research regarding TCO of serverless infrastructures.

We’ve got a bunch of stuff to get to today, so let’s get into it! 👇

When your downstream systems aren’t infinitely scalable… 😳

There is an ongoing debate about the “serverlessness” of certain services and downstream systems. While that may be a useful exercise from an operational perspective, from a practical standpoint, the bigger issue has to do with scalability. It is likely that most of the services that make up your serverless applications will not scale as well as Lambda. This can create significant pressure on downstream services during heavy traffic spikes, sometimes resulting in unplanned downtime. So what can we do when certain parts of our application simply can’t scale?

An extremely useful pattern is to distribute an event to one or more SQS queues using SNS. This gives us the ability to use multiple queues to “buffer” events so that we can throttle processing to alleviate pressure on downstream resources. For example, if we have an event that needs to write information to a relational database AND trigger another process that calls a third-party API, this pattern would be a great fit.

In my new post, How To: Use SNS and SQS to Distribute and Throttle Events, I walk you through how to automate this and add it to your serverless applications. Full working code examples are provided and explained, so give it look, and see if this would be right for your application.

When you want more serverless use cases… 🙋‍♀️

Last week I shared some interesting serverless use cases that I came across. I think it’s helpful to see how other people are using serverless, and then be able to apply some of those ideas to your own systems. Here are a few I found this week.

Creating A Serverless Answer For eCommerce  shows us how a team created a completely serverless ecommerce system and the resulting benefits. The quote at the end of the article may seem a bit obvious to those of use who live and breathe serverless, but it sums up the business case quite nicely: “By moving to a Serverless solution, businesses can achieve an affordable solution that will rapidly scale up and down with demand, removing wasted resources and expenditure during down times, while ensuring you’re able to handle larger peak volumes whenever they occur.”

Bob Thomas shows us how and why KYD joined the serverless train. There are some great insights into why they went serverless as well as some code examples for CI/CD with Gitlab.

There are plenty of third party ESPs to choose from, but Vinicius Kiatkoski Neves gives us a complete walk-through and shows us how to send e-mails through AWS SES and Lambda.

When serverless security should be your #1 concern… 🔒

Marcia Villalba is back with another great interview from re:Invent. This week she is Talking about Serverless Security with Ory Segal.

Speaking of Vegas and serverless security, I came across this talk from Erez Yalon at BSides called Serverless Infections. It has some really good security tips in there, plus there are some demos that show how hackers can both infiltrate and exfiltrate your serverless functions.

And don’t forget that Ory Segal and I are hosting a Foundations of Lambda Security webinar on January 24, 2019 at 11am ET. Make sure you signup to see how the OWASP Top 10 applies to your serverless applications.

When you want to build serverless apps on something other than AWS… ⚡️

I’m a big AWS fan, and with 70% of the serverless market, it’s hard to ignore. But others continue to make strides in the space, and lots of developers are utilizing the service offerings of other cloud providers. Here are few interesting resource I came across this week that do serverless sans AWS.

Serverless Notes is a site dedicated to helping developers build applications on Azure. They’ve recently launched there Azure Serverless Tips series with helpful bits of information from technology leaders and experienced people, all in one place.

Another great resource is the Azure Serverless Community Library. Think of it a bit like the AWS Serverless Application Repository. I browsed through these and there are A LOT of covered use cases already built for you.

And if you’re using the Microsoft cloud and you need to Scale Azure Functions to Make 500,000 Requests to Weather.com in Under 3 minutes, David Barkol has you covered.

And let’s not leave Google out! Wassim Chegham wrote a great post called Building Your Next Serverless Application: The Complete Guide. It is an in-depth, step-by-step, code included walk-through that’s a great resource for those working in the Google Cloud.

When you think about the future of serverless… 🔮

Nate Taggart from Stackery has some predictions for Serverless in 2019. According to him, we can look forward to monolith conversions and executive buy-in, but will face resistance from the IT-Industrial complex.

Ben Moore from ChannelLife New Zealand reports that KBV research predicts the Serverless architecture market to reach $14B by 2024. That’s a compound annual growth rate of 23.4%. 🐨

Adrian Colyer has some thoughts on the Serverless computing: one step forward, two steps back paper that was released recently. Lots of us saw the paper as highly critical of serverless, especially since it focused on use case that were not a good fit. Adrian has a bit of a different perspective on this.

And whenever we look at the future, it’s always helpful to take look at the past. Our friends over at Thundra have a nice post that recaps their journey in 2018. It is really exciting to see companies in the serverless space growing up and being successful. There are so many opportunities in the serverlesss space, and Thundra is just one example.

When you’re finally thinking about migrating to serverless… 🤷‍♂️

Ready to move all your applications to a serverless architecture? Yan Cui says Not so FaaS! He points out that there are lots of viable use cases for serverless, but that user experience should trump everything else. TLDR; don’t try to fit a square peg into a round hole, even if the square peg is serverless. 😜

The team at Nuweba has put together a serverless ebook to help you understand The Top 4 Challenges In Serverless. Handy little guide if you’re new to the serverless world.

There’s also an interesting interview with Red Hat’s Michael Hausenblas on learning to walk before running into a Serverless mess. There are some good points in here about the operations culture changing as well as pointing out a few places where serverless might not make sense.

And if you are planning on going serverless, the biggest culture shock will most likely be with observability, or the lack thereof. The team over at Epsagon has an upcoming webinar that will explain Serverless Monitoring in Practice. Definitely worth a look.

What to do if you can’t let go of your Ruby or PHP framework… 👋

Are you a Ruby on Rails developer that is feeling left out by this whole serverless thing? Check out Jets: Ruby Serverless Framework, and see if that gets you excited.

What about all the PHP fans? I’ve heard that Laravel is doing some work to make the framework more serverless, but in the meantime, Rob Allen will show you how to run Serverless PHP on AWS Lambda. AWS also has a post that can help you as well.

When you’re curious if serverless will actually reduce your costs… 💰

Remember that Serverless computing: one step forward, two steps back paper that we previous mentioned? Well it also got Yan Cui fired up. He tells us why You are thinking about serverless costs all wrong and points out that TCO (total cost of ownership) is the better metric to evaluate costs.

Kevin O’Hara shared a typical #AWS bill for a startup building their MVP primarily on serverless technology like Lambda. Production APIs, static sites, databases, and messaging all for under a few bucks a month. This is not uncommon.

Mark Schwartz had some recent thoughts on Switching Costs and Lock-In that are worth reading. However, the new Generating Value Through IT Agility and Business Scalability with AWS Serverless Platform report is definitely worth a skim. Some of the highlights include a 33% increase in developer productivity, 18% increase in applications/logic created, and an over 200% increase in the number of features. Add to this massive drops in unexpected downtime and MTTR, 60% lower operations costs, and a 53% reduction in infrastructure and hardware costs over a five year period. This is some great data if you’re trying to make the serverless case to the higher-ups.

When you’re looking for some interesting serverless reads and resources… 📚

Your Quintessential Guide to AWS Athena is just that. No need to be paying for RedShift if you store your data correctly in S3.

Mike Roberts and John Chapin over at Symphonia created a lambda-benchmarking project that generates and saves benchmarks for cold start latencies of the AWS Lambda service. It will be really interesting to see these latencies decrease as AWS continues to optimize for them.

And Ray Camden has a new article about Adding Serverless Functions to Your Netlify Static Site. I think I’ve read most of Ray’s books, so it will be awesome if he becomes a serverless advocate too!

When you get overly excited about AWS announcements…🗣

There was an AWS Fargate Price Reduction – Up to 50%. This is thanks to the Firecracker virtualization technology they announced at re:Invent last year. Good news for those of you that still need containers.

AWS also announced Amazon DocumentDB (with MongoDB Compatibility). I wouldn’t suggest building greenfield on it, but if you are moving an existing workload, this could make your managing a MongoDB cluster nightmares go away.

Speaking of migrating MongoDB, AWS Database Migration Service Now Supports Amazon DocumentDB with MongoDB compatibility as a target. Live migrate right from your replica sets or sharded clusters.

And AWS Step Functions Now Supports Resource Tagging, which is pretty cool. The more you tag the better. Read How To: Tag Your Lambda Functions for Smarter Serverless Applications for a bunch of reasons why.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Heitor Lessa (@heitor_lessa). Heitor is a Specialist Solutions Architect at AWS that focuses on serverless. Beside being an all around nice guy and serverless expert, Heitor is the host of the Build on Serverless Twitch series. The first season featured a number of great guests with lots of hands-on, real-world serverless problem solving. Season 2 is in the works, so be sure to RSVP so you can learn more best practices while watching Heitor and his guests build a Serverless Airline App from scratch. Great stuff!

Final Thoughts 🤔

I realize that this newsletter keeps getting longer every week. Maybe I’m looking too hard for serverless content, or maybe there is just a lot more of it out there. Either way, I feel like it is getting a little unwieldy. There is obviously a lot of information to share each week, but I don’t want it to be too overwhelming. Should I cut this down a bit? Do you like all this content? Should I add more!? I’d love to hear your thoughts on it.

I hope you enjoyed this issue of Off-by-none. Please send me your feedback and suggestions so I can continue to make this newsletter better. Feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, or how you’d like to contribute to Off-by-none.

See you next time,
Jeremy

Off-by-none: Issue #19

Starting off the new year with a serverless bang… 💥

Welcome to Issue #19 of Off-by-none. I’m so glad you’re here to talk about serverless! 🙌

Last week we reminisced about 2018 and laid out some plans for the new year. This week we’ll sort through all the serverless content that people created over the holiday break. Plus we look at some serverless use cases, share some upcoming webinars, and give you links to plenty of great talks to keep you busy for awhile.

We’ve got a lot to get to today, but before we jump in, I wanted to share that Lambda API v0.10 was released. Lambda API is a lightweight web framework for your serverless applications. It’s open source, fast, free, and now supports seamless integration with ALBs. v0.10 also added support for multi-value headers and query string parameters, plus new method-based middleware and much more. I’d love for you to check it out and send me feedback.

Okay, back to our regularly scheduled program. Here we go! 🚀

When you’d rather just sit back and watch some serverless videos… 🍿

ServerlessDays Milan 2018 released videos of all the talks from their event in October of last year. Lots of really great talks in here from Yan Cui, Ian Massingham, Danilo Poccia, and many more.

Serverless Computing London has also released some additional videos including Mikhail Shilkov’s Performance Tales of Serverless, Nate Taggart’s Rethinking Testing For Serverless, and Guy Podjarny’s Serverless Security: What’s Left To Protect?

Heitor Lessa announced that the second season of Build on Serverless is going to be about “Building a Serverless Airline App from scratch + leading practices applied.” This is a fun (and educational) thing to watch. You can (and should) RSVP on Twitch.

Also, Marcia Villalba released the first video in her Serverless Interviews series which just so happens to feature yours truly. So if you want to see me ramble on about serverless for 15 minutes while admiring the view of the Mirage in the background, this video is for you.

When you want to learn more about serverless security… 🔒

The team over at Protego created a Damn Vulnerable Serverless Application and donated it to OWASP so that you can learn what not to do when building serverless application. You can read more about it here. Now we have this AND the Serverless GOAT project that PureSec donated last month. These are both great resources to see how easily serverless vulnerabilities can be exploited and what to do to protect your application.

If you’re interested in discussing the OWASP Top 10 and how they apply to serverless applications, Ory Segal and I are hosting a Foundations of Lambda Security webinar on January 24, 2019 at 11am ET. Lots on information to cover, plus an interactive Q&A session at the end. Should be fun. 😉

What to do when you’re ready to use Lambda Layers… 🍰

Injecting Chaos to AWS Lambda functions using Lambda Layers by Adrian Hornsby, introduces us to a great use case for Layers. Werner said it best, “Everything fails all the time.” Using Chaos Engineering to test the resiliency of your distributed cloud applications is a great way to ensure that when things do fail, that your application will handle those issues gracefully and minimize the blast radius.

Gojko Adzic and his team created some public layers so you can now use FFmpeg, SOX, Pandoc and RSVG with your AWS Lambda projects. One more thing you don’t have worry about.

And if you want to take a Deep Dive Into Lambda Layers and the Lambda Runtime API, sign up for this webinar hosted by Chris Munns, Principal Developer Advocate at AWS. It’s scheduled for January 31, 2019 at 2pm ET.

When you’re having trouble choosing the right database for your serverless app… ⚖️

Alex DeBrie posted a tweet mentioning Rick Houlihan’s Match Your Workload to the Right Database (DAT301) talk at re:Invent. If you thought his Advanced Design Patterns for DynamoDB (DAT401) talk was amazing, prepare for another mind-blowing experience watching this one. Lots of practical advice to help you choose the right backend for your workload. 🤯

Speaking of DynamoDB, Forrest Brazeal from Trek10 spent his holiday break resurrecting the Northwind database from the annals of MS Access and teaches us how to convert it to NoSQL. From relational DB to single DynamoDB table: a step-by-step exploration is a great guide that shows us both the pros and cons of attempting to move relational workflows to DynamoDB. If you’re thinking about moving to NoSQL, please take a few minutes to read this.

When you’re wondering what AWS has been up to… Δ

AWS announced the Amazon API Gateway Service Level Agreement, which may have you scratching your head thinking, don’t all AWS services have SLAs? Just ask Scott Piper from SummitRoute. He put together an AWS Service Support table that shows just how few AWS services actually have them. Something for the 2019 #AWSwishlist.

The AWS Toolkit for Visual Studio Code project seems to be coming along nicely as well. Whether you just want to try it out, or contribute in some way, it’s pretty cool to see AWS developing more things like this out in the open.

They also keep making strides with Nested Applications. If you’d like to learn more, there is a Nested Applications: Accelerate Serverless Development Using AWS SAM and the AWS Serverless Application Repository webinar scheduled for January 31, 2019.  It’s hosted by James Hood, Sr. Software Dev Engineer at AWS, so you know it’s going to be good.

When you’re looking for some sample serverless use cases… 🔍

I love finding people that are applying serverless to new and interesting use cases. Whether they are solving complex workflows, or just a simple function that accomplishes a single task that makes your life easier, seeing the broad application of serverless is quite fascinating. Here are a few I found this week.

Building a serverless data analytics pipeline by Rodrigo Reis shows us a simple, but effective way to capture a stream of web events. They use an SQS queue and reserved concurrency to help throttle requests to their Elasticsearch cluster, which is both simple, and a great approach at their stage. They’re also smartly using IOpipe for observability.

Blog URL to PDF to Amazon Kindle by Dhaval Nagar outlines a simple app for automatically sending blog posts to a Kindle. There are probably multiple ways that this type of workflow could be used.

Serverless Function to Sync Data from a Database to Google Spreadsheet is another simple workflow that would be perfect for marketing teams, sales, or your billing department. No need to build interfaces for reporting data when there are already tools that people are familiar with.

If you want to get a bit more complex, check out How to build a React chat app with AWS API Gateway WebSockets, Custom Lambda Authorizer. Lots to chew on here, but if you’re heading down the WebSockets path, this is a good resource for you.

When you just want some interesting serverless content… 🤓

Save time and money with AWS Lambda using asynchronous programming by James Beswick provides some great tips for handling synchronous calls in your serverless functions. Also be sure that you Don’t overpay when waiting on remote API calls either.

Mike Vizard predicts the Battle Over Serverless Computing Frameworks to Heat Up in 2019. There is a lot of discussion in this piece about other companies (read: NOT AWS) embracing Knative and other open source “serverless” middleware to power their FaaS solutions. I think this goes to show how popular serverless is becoming and the thrashing that’s going on to catch up with AWS. I’m not sure this is going to play out the way these companies think it will.

There’s a new serverless framework called BAM! I haven’t used it yet, but let’s just add this to the list.

Jerry Hargrove continues to create more Cloud Diagrams & Notes for our viewing pleasure. His AWS Lambda and Aurora Serverless ones are awesome.

Yan Cui shows us how to perform Error Handling in AWS Lambda With Wrappers. He talks about the need for middleware in our serverless applications and how we can use it to capture errors and help us debug our systems.

Speaking of debugging, Hamit Burak Emre over at Thundra shows us how to Debug Your Python Functions Locally. Step-by-step debugging in Lambda functions with breakpoints? Yes, please.

Finally, Slobodan Stojanović, author and serverless wizard, answers the question, “What do you use for scheduling AWS Lambdas?” His answer gives us cron jobs and delayed triggers, all without servers to manage or maintain. 👍

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Farrah Campbell (@FarrahC32). Farrah is the Ecosystems Manager at Stackery, a visual tool for building serverless applications. Farrah has become another positive voice in the serverless community, helping to organize ServerlessDays Portland and other workshops, and an ever present figure at conferences helping to spread the serverless word. She was also recently featured as a Serverless Superhero in How serverless is breaking down barriers in tech. Diversity in tech has always been a challenge, so it’s great to have people like Farrah as part of the serverless community working to make it more inclusive.

Final Thoughts 🤔

Week #1 of 2019 is in the books, and if this is any indication, it is going to be a banner year for the serverless community! There has already been a ton of great serverless content so far, plus Paul Johnston pointed out that there are EIGHT ServerlessDays conferences between now and April 11th. One of which is Boston, so be sure to buy your tickets soon! I know I’m excited.

I hope you enjoyed this issue of Off-by-none. Please send me your feedback and suggestions so I can continue to make this newsletter better. Feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, or how you’d like to contribute to Off-by-none.

Take care,
Jeremy

Off-by-none: Issue #18

Happy (Serverless) New Year! 🎉

Welcome to Issue #18 of Off-by-none. It’s 2019, and it’s going to be a great year for serverless! 🙌

Last week we looked at the new WebSocket support for API Gateway, saw some more serverless love from startups, and I argued that we should Stop Calling Everything Serverless! This week we’re going to reflect back on 2018, I’ll share my 2019 plans for Off-by-none, and we’ve got plenty of great stories from the community.

Let’s jump right in. It’s going to be another busy year! 👨🏻‍💻👨🏻‍🔬👨🏻‍🎨👨🏻‍🏫

When you need to look back so you can look forward… 🔭

2018 was quite a busy year. Being the CTO of a startup certainly keeps my to-do list full, plus I consulted for several additional companies in the serverless space. However, my passion for creating, writing and helping out others (or at least trying to) is too powerful a force to keep contained.

Even though I have been blogging for quite some time, last year was when I started writing almost exclusively about serverless. I also spent time working on some open source projects and thinking about new ones I’d like to create. I thought it would be a proper exercise to look back at all the things I worked on last year, reflect on what was helpful, and then plan to do more of that in 2019.

In January, I launched the first stable version of Lambda API and then wrote How To Build a Serverless API with Serverless, AWS Lambda and Lambda API. Soon thereafter, I created Securing Serverless: A Newbie’s Guide to capture some serverless security best practices for those just starting out.

Then I shared some tips on How To: Manage RDS Connections from AWS Lambda Serverless Functions as well as How To: Stub “.promise()” in AWS-SDK Node.js. I weighed in on Solving the Cold Start Problem and proposed some additional solutions with How To: Optimize the Serverless Optimizer Plugin. I also came up with a list of 10 Things You Need To Know When Building Serverless Applications.

I did some more security research and wrote about Event Injection: A New Serverless Attack Vector and then shared 5 Reasons Why Your Serverless Application Might Be A Security Risk. I ran some experiments using Serverless Consumers with Lambda and SQS Triggers as soon as AWS announced support. I also started to share serverless microservice concepts and published Mixing VPC and Non-VPC Lambda Functions for Higher Performing Microservices.

In July, I met Chris Munns for the first time and wrote 15 Key Takeaways from the Serverless Talk at AWS Startup Day. This gave me more insight into the cold start issue, so I created the open source package, Lambda Warmer, so you could Optimize AWS Lambda Function Cold Starts. I then shared some thoughts on Thinking Serverless (Big and Small) and why serverless is great for workloads of all sizes.

As I converted several workflows over to serverless applications, I started making use of tags to keep things organized. I captured my best practices in How To: Tag Your Lambda Functions for Smarter Serverless Applications. The more I wrote about serverless, the more people I found in the community, so I published my list of Serverless Peeps You Need To Follow. 😃

I put together a guide on How To: Add Test Coverage to your Serverless Applications, and then wrote a fictional story called A Tale of Two Teams, about two startups that made vastly different technology choices (serverless versus containers). It was fun to write and there was a lot of interesting feedback. Next up was Aurora Serverless: The Good, the Bad and the Scalable, an in-depth look at AWS’s new “serverless” MySQL database offering.

In August I published Serverless Microservice Patterns for AWS, which is a really handy resource. It eventually made its way to #7 on Hacker News and crashed my site. FYI: WordPress does not scale. Speaking of scaling, I created a solution for Managing MySQL at Serverless Scale with the open source serverless-mysql NPM package. I’ve been using it in production ever since.

In September I launched Off-by-none! It’s been quite a bit of work, but all of your feedback has been incredibly encouraging (more on this later). I then shared a piece called Serverless Security: Locking Down Your Apps with FunctionShield, and wrote up An Introduction to Serverless Microservices. In What 15 Minute Lambda Functions Tells Us About the Future of Serverless, I shared some thoughts about AWS’s new execution limits and why it’s an important step forward.

I also shared some Takeaways from ServerlessNYC 2018, took a first look at the Aurora Serverless Data API, and then spent a week in Las Vegas for AWS re:Invent. My re:Capping re:Invent: AWS goes all-in on Serverless post explains why AWS is lightyears ahead of other providers in the serverless space. I also shared a serverless tip so you Don’t overpay when waiting on remote API calls, and I finished up the year with my Stop Calling Everything Serverless rant.

I’m exhausted just thinking about all that, but at the same time, I’m super excited for 2019. I received a tremendous amount of constructive feedback, met some really amazing people, and learned a ton in the processes. I’ve got plenty of content planned for this year, most of which will be highly practical so that you can apply the concepts straight away. I’m also working on a course or two, plus some other creative ways to talk about and explore serverless applications and the methodology used to build them. I’m hoping you’ll find all of this useful.

When you’re wondering what’s next for Off-by-none… 🧙‍♂️

When I first launched Off-by-none, it was a bit of an experiment. I wanted to create a sort of “un-newsletter”, something that was more interactive than just some links to recent articles, blog posts, and handy tools. Don’t get me wrong, I love getting my weekly newsletters, and there are plenty of good ones to choose from, but I still think we can do something even bigger and more helpful.

Don’t worry, I’m still going to write the weekly newsletter, but in the next couple of weeks, Off-by-none will be launching its own site. This new site will host archives, resources, and plenty of additional ways for the community to interact, contribute, and help steer the conversation. I’m really excited about this and the possibilities it creates. I still believe that Off-by-none is about working together to build better cloud-based products, so I’m hoping this new site will open it up to a bigger audience and help to expand the serverless community.

When you’ve heard enough about me and just want some good serverless content… 📚

Gal Bashan over at Epsagon wrote The Hitchhiker’s Guide to Serverless. Earlier this year we talked quite a bit about the serverless echo-chamber and how foreign some of these concepts are to those that are new to serverless. Gal outlines a number of key components that make up serverless applications and explains what they are and when to use them.

Getting started with AWS Lambda Layers for Python is a new post from Adrian Hornsby that lays out the basics for harnessing the power of Lambda Layers. Lots of really good stuff in here.

I also came across Contemporary Views on Serverless and Implications by Subbu Allamaraju the other day. Subbu is an engineer with Expedia and wrote this really interesting piece about the differing views of serverless and the conflicting nature of the term. Another piece that shows just how much further we have to go to bring serverless to the masses.

Syed Jaffry, a solutions architect at Amazon Web Services, wrote a really great article regarding Best practices for securing sensitive data in AWS data stores. When we’re building serverless applications (or any application in the cloud), understanding how to keep sensitive data secure is extremely important. This piece gives you an overview of some general security patterns that you can use. Definitely worth the read.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Erik Peterson (@silvexis). Erik is the Founder and CEO of CloudZero (@cloudzeroinc), a startup that helps you monitor your cloud computing costs. Erik has been building on AWS for over a decade, he’s a frequent speaker at conferences and meetups, and is a regular contributor to the CloudZero blog. He’s a big proponent of #FinDevOps, which is all about leveraging cost as a first class metric when designing serverless systems. Serverless applications generally have a lower TCO than most traditional applications, so it’s good to have people like Erik think through how cost affects our organizations up and down the value chain.

Final Thoughts 🤔

Last year was quite a whirlwind. There were so many amazing advancements in the serverless space, that it’s hard to keep track. AWS announced a number of new services that will be available in 2019, plus I’m hoping that other cloud providers will continue to invest heavily in this space as well. I’m thinking that 2019 is going to be a very good year for the serverless community. ⚡️

I plan on producing lots of serverless content this year, plus I’m co-organizing ServerlessDays Boston on March 12, 2019, and I hope to do some speaking as well. I look forward to spending 2019 with all of you!

I hope you’ve enjoyed this issue of Off-by-none. Your feedback and suggestions are always helpful, so please feel free to reach out to me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and ideas for making Off-by-none even better.

Here’s to 2019, 🍾🥂
Jeremy

Off-by-none: Issue #17

WebSockets are so hot right now…

Welcome to Issue #17 of Off-by-none. Thanks for being here! 👋

Last week we talked about when to optimize our apps and discussed what the term “serverless” actually means. This week I’ll share some more thoughts on that, plus we’ll explore the new API Gateway WebSocket support, share some great serverless articles, and look at a few more announcements from the world of serverless.

Let’s get to it. 😀

What to do when you want to call every managed service and SaaS app “serverless”… 😳

Maybe let’s not. Last week there was a bit of Twitter chatter about what “serverless” actually meant. Is it a technology, a compute model, an architectural pattern, a spectrum, an operational construct? I contend that it can’t be all of these things. I went into rant mode and wrote a post called Stop Calling Everything Serverless! It’s quite a long post, but I think it’s important that we don’t overload the term to the point that it no longer has any meaning.

In my opinion, serverless is a methodology for planning, building, and deploying software in a way that maximizes value by minimizing undifferentiated heavy lifting. It touches everything up and down the value chain, not only affecting how engineers approach development, but also influencing product strategy, design, budgeting, resource planning and much more.

I got a lot of feedback on this post. Several people disagreed with me, but I think it is a healthy debate. I’d love to hear your feedback as well.

When you’re looking for a reason to use serverless WebSockets just because you can…

AWS finally released support for WebSocket APIs in Amazon API Gateway. Which is very cool. I spent some time playing around with them and the implementation is really good. I can see lots of great use cases for this.

If you want to get a thorough walk-through of how they work, George Mao from AWS has a webinar that covers Building Real Time Applications using WebSocket APIs Supported by Amazon API Gateway.

There is also a simple-websockets-chat-app available on GitHub that you can launch using SAM. Or if you prefer, you can start Using API Gateway WebSockets with the Serverless Framework. Jared Short shows you how to use the new serverless-websockets-plugin, plus gives us a really cool DynamoDB streams pattern that we can use in all sorts of scenarios. 🤘🏻

When you realize that serverless and startups are a perfect match… 💖

Serverless and startups, the beginning of a beautiful friendship by Slobodan Stojanović, takes us through how he and his team built Vacation Tracker using serverless and a hexagonal architecture. He’s not the first to say it, but it’s certainly worth repeating: serverless give startups a huge advantage.

Speaking of Slobodan, he and Aleksandar Simović have finished their book: Serverless Applications with Node.js. Definitely worth taking a look if you’re building your serverless apps with Node.js.

If you’re looking for other startups that bet big on serverless, check out SQQUID: a 100% serverless startup. It seems like there are more and more stories like this every day.

When you can’t get enough serverless input… 🤖

Michael Vargas wrote a great piece about Using Design Patterns with AWS Lambda. Some good lessons in there about separating our business logic from the cloud provider’s interface.

Yan Cui shares his Thoughts on the Serverless Announcements at re:Invent 2018. He also lays out some Considerations for the Beginner Serverless Developer. Good place to start for those of you just getting into serverless.

I’ve spent some time working with the new Lambda support for Application Load Balancers, and there are plenty of pitfalls in there. If you’re interested in finding out more, Jeremy Thomerson has got you covered with his post API Gateway vs Application Load Balancer—Technical Details.

Serverless & SaaS — Part 1: The New Build Versus Buy by Tom McLaughlin is an interesting piece that advocates the use of SaaS products over AWS building blocks whenever possible. It might be easy to glue services together, but that doesn’t mean that your team has the right domain expertise.

Building sandcastles and securing WordPress by James Beswick is a great piece that talks about the state of content management and how it is starting to evolve to serverless backends. WordPress may be the 800 pound guerrilla, but James contends that its days may be numbered.

When you’re looking beyond relational database patterns… 🤓

How to use Amazon DynamoDB global tables to power multi-region architectures by Adrian Hornsby is a pretty cool look at how to geographically disperse your applications for lower latency and disaster recovery.

And if you’re looking for more DynamoDB goodies, Faux-SQL or NoSQL? Examining four DynamoDB Patterns in Serverless Applications by Alex DeBrie is great way to expand your mind and start drinking the NoSQL Kool-Aid.

“Serverless” CQRS using Azure Event Grid and Durable Functions by Duncan Edwards Jones, is great primer on the CQRS pattern and how you could apply that to your serverless applications. Decoupling commands and queries makes for a tremendously scalable approach.

When you’re looking for some more hands-on serverless tutorials…

Angela Wang put together A curated collection of hands-on workshops for learning AWS. There’s a few great serverless ones in there, but plenty of other AWS services are covered too.

Authentication & Authorization in GraphQL with AWS AppSync (MOB402) with Karthik Saligrama is another awesome re:Invent talk. If you’re using AppSync, I really hope you’ve got your authentication locked down. You might want to double check after you watch this video.

Eric Hammond has some ideas on Using AWS SSM Parameter Store With Git SSH Keys. Interesting approach that you might find useful.

And Marcia Villalba released a new video: Lambda layers with Serverless Framework and good practices.

When AWS keeps pumping out new features… 🏭

I was all excited when they introduced AWS Client VPN to Securely Access AWS and On-Premises Resources. Too bad the pricing is quite ridiculous.

Amazon Route 53 Adds Alias Record Support For API Gateway and VPC Endpoints, so no more additional Route 53 charges when mapping your domains to your regional or edge-optimized endpoints.

Amazon DynamoDB Accelerator (DAX) Adds Support for DynamoDB Transactions, which closes the open loop with the new DynamoDB transactions.

Amazon DynamoDB Increases the Number of Global Secondary Indexes and Projected Index Attributes You Can Create Per Table. For those of you that found five global secondary indexes to be too few, now you automatically get 20. Plus you can always ask for more if you need them.

Plus, a New SAM PUBLISH Command Simplifies Publishing Applications to the AWS Serverless Application Repository. This is a nice little addition. Hopefully we’ll see more apps in the repository soon.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Alex DeBrie (@alexbdebrie). Alex is a big part of the team over at Serverless, Inc., you know, the ones that brought us the amazing Serverless Framework ⚡️. Alex is constantly working to bring us new features to make our lives easier as serverless developers. He is a regular contributor to the Serverless blog, but has also started posting some great stuff to his personal blog as well. I’m looking forward to keeping up with his content and his continued work on the Serverless Framework.

Final Thoughts 🤔

WebSockets are awesome, I just need to find a reason to use them with some of my apps 😂. But seriously, there are a few use cases that are still beyond the scope of serverless. All the recent additions to DynamoDB, plus now with WebSockets, that list is getting smaller every single day. I’m really excited about what the future of serverless holds, just so long as we don’t keep misappropriating the term. 😉

🎄 Merry Christmas and Happy Holidays to all of you! I wish you all a happy, healthy and prosperous new year!

I hope you’ve enjoyed this issue of Off-by-none. Your feedback and suggestions are always incredibly helpful, so please feel free to reach out to me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and ideas for making Off-by-none better.

See you next year,
Jeremy

Stop Calling Everything Serverless!

I’ve been building serverless applications since AWS Lambda went GA in early 2015. I’m not saying that makes me an expert on the subject, but as I’ve watched the ecosystem mature and the community expand, I have formed some opinions around what it means exactly to be “serverless.” I often see tweets or articles that talk about serverless in a way that’s, let’s say, incompatible with my interpretation. This sometimes makes my blood boil, because I believe that “serverless” isn’t a buzzword, and that it actually stands for something important.

I’m sure that many people believe that this is just a semantic argument, but I disagree. When we refer to something as being “serverless”, there should be an agreed upon understanding of not only what that means, but also what it empowers you to do. If we continue to let marketers hijack the term, then it will become a buzzword with absolutely no discernible meaning whatsoever. In this post, we’ll look at how some leaders in the serverless space have defined it, I’ll add some of my thoughts, and then offer my own definition at the end.

Continue Reading…

Off-by-none: Issue #16

Premature Serverless Optimization…

Welcome to Issue #16 of Off-by-none. Thanks for joining us. 🤘🏻

Last week we looked at Lambda Layers and custom runtimes. This week we’re going to talk about when we should worry about optimizations, plus highlight some recent discussions about the term “serverless” and what that actually means. We’ve also got some interesting articles, several product announcements, and (somehow) more stuff from re:Invent.

Let’s get started. 👍

When you spend too much time optimizing the wrong things… ⚙️

Mark Schwartz published an article on the AWS Cloud Strategy Blog entitled: Micro-Optimization: Activity-Based Costing for Digital Services? In it he outlines the fact that we can now meter individual units of compute to analyze costs. Simon Wardley (and others, including me) have been talking about capital flow for quite some time. Erik Peterson over at CloudZero uses the term FinDevOps to described it. But knowing your costs is different than trying to prematurely optimize them.

I wrote a post last week about the potential to overpay when waiting on remote API calls. This was a micro-optimization, and for my use case and company, it made sense. However, there are two slippery slopes that this type of fine-grained metering can introduce. The first is to tie your costs directly to customer pricing. Some services make sense to use metered billing, but don’t let this level of cost granularity influence the value your service provides to customers.

Second, is premature optimization. Compared to building and maintaining your own systems, cloud computing is ridiculously inexpensive, especially when you’re starting out and haven’t achieved significant scale. Don’t waste your developers’ time trying to shave off nickels and dimes from your bill. Focus on creating more value by delivering and iterating on features faster and worry about cost optimizations later.

Choosing serverless, however, is a MACRO optimization. I have some thoughts on that.

When you’re still confused by what serverless actually means… 🤷‍♂️

You’re not alone. Ben Kehoe called serverless a spectrum at one point, CloudZero wrote a post about it. AWS calls it an operational construct. Simon Wardley has his definition. Jeff Hollan wasn’t happy with the mischaracterizations in this paper that argues that current serverless offerings are “a bad fit for cloud innovation.” And Paul Johnston says that teaching people to do serverless is hard because it’s not about technology, but culture.

I have plenty of my own thoughts on this as well, but one thing is for sure, this debate won’t be settled any time soon. Regardless of the exact definition, I believe many of us “know it when we see it” and are starting to embrace the benefits it brings. And if you’re looking for some of those benefits, Zack Kanter makes the business case for serverless in his new post on TechCrunch.

What to do when you’re looking for some light serverless reading… 📚

Ory Segal published some Security Considerations for AWS Lambda Runtime API and Layers. AWS does a lot to protect you and your application from security issues, opening up custom runtimes, while a good thing, means more to consider from a security standpoint. Read this post to get an idea of some of these new risks.

Serverless Latency has been a common objection amongst the anti-serverless crowd for quite some time. Tim Bray dives deep into this and gives us some things to think about regarding state hydration, database considerations, and how we should really be thinking/talking about latency in our applications.

Yan Cui (AKA The Burning Monk), talks about Holistic Problem Solving using serverless. Yan just wrapped up his Production Ready Serverless course, which is a favorite among many of us in the serverless community.

For more on custom runtimes in Lambda, you can check out Adnan Rahic’s crash course on Serverless with AWS – Running Node.js 11 on Lambda. But just because it’s possible, doesn’t mean it’s a good idea. 😃

When you’re looking for more serverless announcements… 📣

Serverless, Inc. announced the release of the Serverless Framework v1.35. Good news for you Ruby folks, plus support for cross-region CloudFormation outputs and a bunch of bug fixes.

AWS announced that Amazon SQS now Supports Amazon VPC Endpoints using AWS PrivateLink. It’s a pain to need NATs just to connect to some AWS services, so for bunkered apps, this removes another external call to the Internet.

AWS also announced support for nested applications for AWS SAM and the AWS Serverless Application Repository. Nested applications were announced at re:Invent, but now that AWS SAM supports them, I’m guessing we’ll see some interesting use cases emerging. Easier reusability in our serverless applications is a big deal.

If you really want to geek out, there’s a post on How to use the new Amazon DynamoDB key diagnostics library to visualize and understand your application’s traffic patterns. Not sure I would spend a lot of time with this one, but it’s nice to know it’s there if you need it.

Beyond some of these bigger announcements, there were also quite a few Invisible Improvements made by AWS. Alex DeBrie broke them all down for us in his new post.

When weeks go by and we’re still talking about re:Invent…

It seems that no matter how many hours you’ve spent watching re:Invent videos and reading recaps, there’s always more to discover. There’s another post here that lists several great talks, and here are two more that I really enjoyed.

Accelerate Innovation & Maximize Business Value w/ Serverless Apps (SRV212)
Linda Lian talks about how Amazon thinks about serverless. It’s explained as an operational construct, rather than an architectural model or a way to think about packaging and deploying code. Christopher Dixon from Comcast then shows us how Xfinity used serverless to integrate Netflix streaming into their set top boxes. Pretty cool stuff.
Watch the talk

CI/CD for Serverless and Containerized Applications (DEV309)
Clare Ligouro, Principal Engineer at AWS Container Services walks us through the three pillars of releasing modern applications. Lots of great information in here about blue-green and canary deployments, plus how to use Lambda to add verification hooks and automatically rollback ones that fail.  Watch the talk

Also, if you want a bit of an inside look at re:Invent, check out Marcia Villalba’s video series on her Foo Bar channel. She interviewed a lot of people, so it’ll be great when the full versions come out. Maybe start with Day 2 if you want to see a snippet of yours truly. 😉

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Ory Segal (@orysegal). Ory is the CTO and Co-Founder of PureSec, a serverless security platform. Beyond their core product, Ory and his team are responsible for a number of innovations around serverless security. These include their free FunctionShield and Least Privileged Role Generator tools for Lambda, their creation and contribution to the OWASP Serverless Top 10 project, and their collaboration with AWS to bring application security to Lambda using Layers. Ory is also active on the PureSec Blog and just launched a new eBook all about AWS Lambda Security Best Practices. Serverless empowers developers to build and release software quickly, but that can introduce significant security risks. I feel much better knowing that Ory is watching our backs. 👀

Final Thoughts 🤔

The more popular “serverless” gets, the more people try to overload the term and subscribe it to everything. I’m a firm believer that serverless is not a buzzword, and that it means something very specific, even if the definition continues to be blurred by marketing departments. If I thought this was just an argument about semantics, then I’d probably let it go. But I think there is more to it than just that, and that the distinction will become important. More thoughts to come on this.

I hope you’ve enjoyed this issue of Off-by-none. All of your feedback and suggestions are incredibly helpful, so please keep them coming. Reach out to me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and ideas for making Off-by-none better.

Until next time,
Jeremy

Off-by-none: Issue #14

re:Capping re:Invent…

Welcome to Issue #14 of Off-by-none. I just spent a week in Vegas at AWS re:Invent and have I got a lot to share with you!

Last week we pondered if RDBMS were a good fit for serverless, overcame some common serverless objections and geeked out over serverless security. This week we’ll recap re:Invent, take a look at some of the amazing sessions and speakers, and review another 7,000 AWS product announcements (or something like that).

Buckle your seatbelt and let’s get started! 🏎

What to do if you’re suffering from re:FOMO… 😿

Unless you’ve been asleep for the last several months, you’re probably aware that AWS threw quite the shindig last week in Las Vegas. If you weren’t able to attend, don’t worry about it, we’ve got you covered. Because remember, what happens in Vegas, ends up on the Internet.

re:Capping re:Invent: AWS goes all-in on Serverless is my post that outlines some of the key announcements and what they all mean. I think I learned enough to write several books, so expect more posts to be coming.

What I learned from AWS re:Invent 2018 by James Beswick is also another great recap with a warning for cloud consultants and an important message about TCO. Paul Swail asks the question, What new use cases do the re:Invent 2018 serverless announcements open up? (answers included, of course). And if you want to read about all the Serverless announcements at re:Invent 2018, Alex DeBrie and Jared Short from Serverless, Inc. give you the full rundown.

When you’re looking for some really good conference talks… 👨‍🏫👩‍🏫

Advanced Design Patterns for DynamoDB (DAT401) 🤯
Rick Houlihan gave one of the most impressive talks of the entire conference. There were so many insights in this session that it was hard to keep track. He said, “We invented relational databases because storage was expensive” and “When people say NoSQL is missing JOINs, you say you’re missing the point.” He stressed that modeling NoSQL is difficult because you need to know and understand your access patterns upfront. But once you do, you can create a single table that can support 20 or more access patterns with just two or three Global Secondary Indexes (GSIs). Seriously mind-blowing stuff. Plus he stressed using serverless to validate your products. One of his best quotes was, “Don’t fail fast, fail cheap.” This could be the best 60 minutes you ever spend.

Watch the talk and checkout Best Practices for DynamoDB

From Monolith to Modern Apps: Best Practices (SRV322) 🎸
Paras Bhuva and Tom Laszewski (with a little help from Fender’s VP of IT, Chris Ingraham) gave an excellent talk that outlined how enterprises are adopting serverless for a variety of use cases. Companies like Reuters and Hearst are using it for analytics, Finra is using it for fraud detection, and Expedia is using it for operations. Paras walks us through the design of a modern application and stresses that teams want/need to “reduce their undifferentiated heavy lifting.” It is a very interesting session that really highlights the power, speed, and diversity of serverless applications.

Watch the talk

Serverless Architectural Patterns and Best Practices (ARC305) 🗺
Drew Dennis and Maitreya Raganath gave another really interesting talk that explored some architectural patterns and best practices. I see many people struggle with their serverless application designs because they aren’t quite sure how to stitch together all the managed services to create efficient pipelines. This talk looks at several common patterns including those for web applications, stream data processing, and data lakes.

Watch the talk

Applying Principles of Chaos Engineering to Serverless (DVC305)
Yan Cui (aka @theburningmonk), gave an awesome talk on Chaos Engineering and how we can apply those principles to serverless. The topics in here are so good that I don’t think I can do it justice by trying to sum this session up. Just do yourself a favor and watch it.

Watch the talk

A Serverless Journey: AWS Lambda Under the Hood (SRV409) 👩‍🔧
Holly Mesrobian and Marc Booker took us on a deep dive into how Lambda actually works. Lots of really interesting information, but perhaps the best part of the talk was this…

Reducing the cold start VPC issue by using a secure tunnel with a remote NAT and no longer stealing hundreds of IPs from CIDR blocks in your VPC subnets? Yeah, that’s a pretty big deal.

Watch the talk

There were so many amazing talks that I can’t possibly list them all. Be sure to check out AWS’s playlist on YouTube for an extensive list of recorded sessions. You can also check out this post by Jennine Townsend that lists some of the more notable sessions.

Just when you think that AWS might be running out of ideas… 🚀

Nope. Not only does AWS continue to make massive investments in its global infrastructure, hardware components and product offerings, but it also continues to break through the limits of serverless computing. Here are some of the important serverless announcements from last week.

When you’re still looking for some more serverless content… 👍

Joe Emison wrote a really great article that discusses The Serverless Sea Change. The post goes deep into the impact that serverless can have on companies and outlines an example of the dramatic cost savings that can be achieved. He makes an astute point that “ten times more lines of code, is ten times more technical debt.” Spending more time researching and less time coding will make maintaining your serverless applications much easier and a heckuva lot cheaper. 💰

Marcin Zasepa pointed out that Version 3 of the AWS SDK for JavaScript is written in TypeScript, so that’s pretty cool. 🤓

If you’re looking to jump in and start using some new AWS features, you can learn How to publish and use AWS Lambda Layers with the Serverless Framework.

You can also learn What’s New with Serverless at AWS during a webinar on December 11, 2018 @ 2pm ET. There are a lot of new things happening, so this might be a good opportunity to get a crash course.

Serverless Star of the Week ⭐️

There is a very long list of people that are doing #ServerlessGood and contributing to the Serverless community. These people deserve recognition for their efforts. So each week, I will mention someone whose recent contribution really stood out to me. I love meeting new people, so if you know someone who deserves recognition, please let me know.

This week’s star is Corey Quinn (@QuinnyPig). Corey is a cloud economist that helps companies save money on their AWS bills. But he’s also the brains behind the Last Week in AWS newsletter, host of Screaming in the Cloud, occasional blogger, regular conference speaker, and all around nice guy. Don’t let the snark fool you, he is a huge proponent (and user) of serverless technologies, but also a vocal critic of AWS when necessary (which keeps them honest and on their toes). Corey shared this newsletter last week with his audience and many of you are reading this because of him. So here’s a huge thank you to Corey for helping me spread the serverless word. 🙌

Final Thoughts 🤔

This was another long one, but last week was a whirlwind of information and announcements that have cemented serverless as the future of cloud computing. I want to thank AWS and all the support staff that helped put together and run this amazing conference. And I also want to thank AWS for continuing to support their customers and pushing serverless innovation. The next few years are going to be really exciting.

I hope you’ve enjoyed this issue of Off-by-none. Your feedback is always most welcome and much appreciated. Your suggestions help me make this newsletter better each week. Please feel free to contact me via Twitter, LinkedIn, Facebook, or email and let me know your thoughts, criticisms, and if you’d like to contribute to Off-by-none.

AWS just released enough products and features to keep us busy until next year’s re:Invent. So let’s go build some amazing serverless apps!

See you next week,
Jeremy