Lambda Functions

Pricing

Based on CloudBurn’s blog on aws lambda pricing, following information is abstracted:

Quick example

Lambda pricing has two main usage-based costs:

• Requests: After the free tier, you pay $0.20 for every 1 million requests.
• Duration: You pay for the compute time your function uses, measured in GB-seconds. Lambda calculates this by multiplying the function’s execution time (rounded up to the nearest millisecond) by the memory configured for the function.

In US East (N. Virginia), the base on-demand duration rates are:

Architecture	Price per GB-second
x86	$0.0000166667
arm64	$0.0000133334

Simple rule:

• Requests → free tier still works with Provisioned Concurrency
• Compute time → free tier only works when Provisioned Concurrency is disabled
• Keeping Lambda warm → always paid

To Stay Free

It is not well documented but stay within 400,000 GB-seconds duration and 500,000 total requests. Lambda Functions send logs to cloudwatch, you need to disable that too (if you are brusting free limits provided by AWS for cloudwatch).

For more detailed information, see detailed blog on aws lambda pricing.

Notes

• serverless architecture (fully managed by AWS) meaning hardware, firewall, server side encryption, security, etc. is managed by AWS — you manage your data and client side encryption if necessary
• runs code you defined on response to the event triggered (you define events too), for eg: when new items added to s3, notify via email

The General Workflow

1. You upload your code to Lambda as a Lambda Function.
2. You set events to trigger the code such as: HTTPS request, s3 upload, etc.
3. Lambda runs code when event it triggered — it handles bootstrap, scaling, infra, security, etc. without you spending time on managing server environment and configuration.
4. You pay only for the compute time (down to millisecond) depending on the amount of memory you allocate to your function.

When To Use Lambda

• real time social media app image processing (when image is uploaded, lambda is triggered to resize, apply filter and optimize image for storage) — Lambda because it scales automatically based on uploads and what you pay is only for processing time
• handling real time events for an online game where there are multiple events (scrolling, tapping, etc.) per seconds

Lambda For Devops Engineer

• security and compliance → scanning ec2 instances with gp3 volumes, scanning s3 with encryption disabled and report, etc.
• cost optimization → check if any large instances are created or idle instance, etc.

Observation

• seems like functions are stored in some s3 bucket (not in your account)
• default name of program is lambda_function.py and default function is lambda_handler, you can change it but not necessary
• a role will be created automatically if you don’t create one with one policy attached (this is also newly created)
• create and put logs to cloudwatch logs

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:ap-south-1:<uid>:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:ap-south-1:<account-id>:log-group:/aws/lambda/<func_name>:*"
            ]
        }
    ]
}

but it’s better you create role for more granular control

Demo

• each time you change code, you need to Deploy
• returned output is shown, stdout outputs are sent to cloudwatch log groups
• the value of event will be different a/c to different triggers
• context is almost similar irrespective of events or triggers because it is general information about your lambda function

Hot Start and Cold Start

• lambda is run in some execution enviornment (maybe container, ec2, whatever AWS does internally)
• when you first invoke lambda, AWS need to prepare that env to execute with the programming lang you choose, dependencies, etc. therefore first execution of that function takes more time for eg: 90ms
• but if you again invoke that function, it will take very less time for eg: 5ms because execution env is already ready
• it doesn’t mean it will always be ready i.e. if you invoke today and you invoke after one day (in one day gap), it is not feasible for AWS to keep your env till that period because it is costing money so AWS will tear down that execution env after certain time
• but you can configure that time i.e. how much time to keep that execution env

Sync vs Async Invocation

• you can’t invoke Async using UI, you need cli or programmatic access
• Async is useful when you don’t wanna wait for particular task to complete (task running in bg or whatever)

Sync Call:

aws lambda invoke --function-name what-ever-is-your-func-name output.txt

    flowchart LR
    Clients -- Events --> LambdaFunction -- Outputs --> Clients
  

Eg: When ALB calls Lambda, it’s Sync call.

Async Call:

aws lambda invoke --function-name what-ever-is-your-func-name --invocation-type Event

Eg: When S3 calls Lambda, it’s Async call.

    flowchart LR
    Clients -- Events --> EventQueue
    EventQueue -- Events --> LambdaFunction -- Outputs --> EventQueue
  

Using External Libraries

Without Layers

• to use external libraries, install them in root of your folder and upload as zip

pip3 install -t . requests

With Layers

• without layers, when you install deps in root, your root folder structure is clutterd with all different folders but what you actually need is your lambda_function.py, so better install deps in layers
• see aws docs to install deps in layers per programming lang

Share your code as Lambda Layers

Lambda Versions

• go to Versions tab and publish
• helps with canary deployment model
  • first send all traffic to old version
  • send 10% traffic to new
  • if no problem to 10%, send 30%
  • if no problem to 30%, send 50% and so on till 100% goes on new version

Lambda and VPC

A Lambda function attached to a VPC doesn’t receive a public IP address, even if it’s placed in a public subnet. Therefore, a route to an Internet Gateway alone cannot provide internet access. If the Lambda needs outbound internet access, we place it in a private subnet and route its traffic through a NAT Gateway located in a public subnet.

Test Event

• if event trigger is S3PutObject, it is not necessary to upload object just to test your lambda
• go to Test tab and configure the event you want to simulate and test it

Reserved Concurrency

• if you want only 100 invocation of lambda function at the same time, you can set reserved concurrency to 100
• but this will be deducted from your account limit
• if your acc has limit for function concurrency of 1000 and you have reserved 100 for Lambda func1, then you have remaining 900 for rest of the functions
• if N functions are already talking all the limits of 1000, then function N+1 won’t be able to execute at that time and will throw error:

  Calling the invoke API action failed with this message: Rate Exceed

Provisioned Concurrency

• each time when lambda is invoked concurrently (say you put 1000 obj at once on S3), new executation env is created (if old execution env is busy (serving some request) or already tear down)
• new execution env goes thorough init phase of setting up programming lang, dependencies, your application global environment, etc. which takes time
• that time can be critical delay for mission cricital application
• so through Provisioned Concurrency, you can tell AWS that “please give me 40(or N) execution env preconfigured even if invokation is not happening”
• this makes your app HA and low error BUT it has direct impact on your cost

Lambda Destination (Generally Applicable For Developers)

• sending output to some destination like: SQS, SNS, S3, Lambda Function etc.
• desitnation can be configured per fail or success scenario -> so at most you can have two dest, if you try to add third it will override the previous value dest
• only when your lambda is triggered aysncly (not syncly), output is sent to some destination

Error handling

Timeout -> increate timeout in Configuration but max is only 15m. If you Lambda function takes more than that then using Lambda is not the solution you want.

Deletion

• delete lambda func
• delete role associate with it
• delete log group