Improved VPC Networking for AWS Lambda • Hacker News Board

Re: Improved VPC Networking for AWS Lambda

#11

Post by saurik » Tue, Sep 03, 2019, 10:21 PM UTC

paulddraper wrote: post #8

Iconoclast view ahead (change my mind please): AWS does tons of stuff around VPCs....I feel like they really want me to use them (or their customers really want to use them), but I just don't see why. I just run RDS on the internet. I don't have to muck with the complexity or cost of NATs or peering or Lambda slow start or any other weird networking issues. I know it's "public", but that seems irrelevant in the era o…

So making the actual listening port for a database server "public" is generally a bad idea as that is another attack surface of code that honestly is hardly ever made public... but if when you say "public" you mean you are using security groups (which are super trivial to use and easy to understand) to define which other AWS devices can access the port, then yeah: I have never seen any reason why this entire feature should exist and the concept of having to think about IP address ranges as if they somehow matter is one of the things I was escaping when I moved to cloud in the first place, and somehow they wanted to reintroduce it? Why?!? It doesn't even work well (!!), and introduces tons of latency into everything it touches (not just Lambda) :/.

Re: Improved VPC Networking for AWS Lambda

#12

Post by saurik » Tue, Sep 03, 2019, 10:21 PM UTC

enitihas wrote: post #10

paulddraper wrote: post #8

Iconoclast view ahead (change my mind please): AWS does tons of stuff around VPCs....I feel like they really want me to use them (or their customers really want to use them), but I just don't see why. I just run RDS on the internet. I don't have to muck with the complexity or cost of NATs or peering or Lambda slow start or any other weird networking issues. I know it's "public", but that seems irrelevant in the era o…

VPCs are very useful when running things like elasticache though( memcache and redis), because AFAIK those don't have an authentication ecosystem so making them public would be a terrible idea.

Just use security groups, which fully solved this problem without all of the overhead and complexity of VPC.

Re: Improved VPC Networking for AWS Lambda

#13

Post by Scarbutt » Tue, Sep 03, 2019, 10:21 PM UTC

paulddraper wrote: post #8

Iconoclast view ahead (change my mind please): AWS does tons of stuff around VPCs....I feel like they really want me to use them (or their customers really want to use them), but I just don't see why. I just run RDS on the internet. I don't have to muck with the complexity or cost of NATs or peering or Lambda slow start or any other weird networking issues. I know it's "public", but that seems irrelevant in the era o…

Firebase was made specifically for the cloud, RDS is the cloud atop postgres, I don't know how secure RDS is (against the myriads of attacks) but it wouldn't be bad idea to use the built-in aws firewall to at least restrict access to trusted IPs ;)

Also, VPCs are really useful if you have many systems and services(yours or theirs) inside AWS.

Re: Improved VPC Networking for AWS Lambda

#14

Post by momokoko » Tue, Sep 03, 2019, 10:23 PM UTC

paulddraper wrote: post #8

Iconoclast view ahead (change my mind please): AWS does tons of stuff around VPCs....I feel like they really want me to use them (or their customers really want to use them), but I just don't see why. I just run RDS on the internet. I don't have to muck with the complexity or cost of NATs or peering or Lambda slow start or any other weird networking issues. I know it's "public", but that seems irrelevant in the era o…

You need to realize that the point of AWS is lock in. Once your service becomes a ball of various AWS pieces, it becomes almost impossible to leave once you start scaling.

So there is always a priority towards things that cause more lock in like VPC.

Re: Improved VPC Networking for AWS Lambda

#15

Post by paulddraper » Tue, Sep 03, 2019, 10:27 PM UTC

enitihas wrote: post #10

paulddraper wrote: post #8

Iconoclast view ahead (change my mind please): AWS does tons of stuff around VPCs....I feel like they really want me to use them (or their customers really want to use them), but I just don't see why. I just run RDS on the internet. I don't have to muck with the complexity or cost of NATs or peering or Lambda slow start or any other weird networking issues. I know it's "public", but that seems irrelevant in the era o…

VPCs are very useful when running things like elasticache though( memcache and redis), because AFAIK those don't have an authentication ecosystem so making them public would be a terrible idea.

Memcache has had reliable authentication (SASL) for some time. Redis has authentication meant to be a secondary protection.

But that's a good point.

I suppose all the services I use already have security models (usually more complex, multi-user ones, so agent X can read but not modify, etc.).

HOWEVER...this could be solved with security groups, but it seems that's not the model AWS has emphasized. Security groups are orthogonal to NAT and private networks; AWS had security groups before it had VPCs.

Re: Improved VPC Networking for AWS Lambda

#16

Post by whalesalad » Tue, Sep 03, 2019, 10:28 PM UTC

anherome21003 wrote: post #4

I dont understand why people use AWS Lambda. Here in France, people use PHP with docker and it works just fine. Another scam from amazon?

I don't understand why people drive cars. Here in XYZ we ride horses everywhere and it works just fine.

Re: Improved VPC Networking for AWS Lambda

#17

Post by k__ » Tue, Sep 03, 2019, 10:33 PM UTC

paulddraper wrote: post #6

gazzini wrote: post #3

This is huge for Lambda. It allows devs to create “serverless” apps [1], with relational databases, without 10+ second cold-start times. In the article, they measure it as 988ms. I have tried building an API using API Gateway Lambda, but had to choose between using DynamoDB to store data (no-SQL, so challenging to query) or suffering unacceptably long response times whenever a request happens to cause a cold-start. T…

*It allows devs to create those apps _within a VPC_. You could always have fast startup with Lambda + database outside the VPC.

Also, wasn't Aurora Serverless created because of that problem?

Re: Improved VPC Networking for AWS Lambda

#18

Post by k__ » Tue, Sep 03, 2019, 10:36 PM UTC

anherome21003 wrote: post #4

I dont understand why people use AWS Lambda. Here in France, people use PHP with docker and it works just fine. Another scam from amazon?

You can use PHP on AWS Lambda if you wish.

If you use Lambda instead of Docker, you don't have to mess with container orchestration.

Re: Improved VPC Networking for AWS Lambda

#19

Post by paulddraper » Tue, Sep 03, 2019, 10:36 PM UTC

saurik wrote: post #11

paulddraper wrote: post #8

Iconoclast view ahead (change my mind please): AWS does tons of stuff around VPCs....I feel like they really want me to use them (or their customers really want to use them), but I just don't see why. I just run RDS on the internet. I don't have to muck with the complexity or cost of NATs or peering or Lambda slow start or any other weird networking issues. I know it's "public", but that seems irrelevant in the era o…

So making the actual listening port for a database server "public" is generally a bad idea as that is another attack surface of code that honestly is hardly ever made public... but if when you say "public" you mean you are using security groups (which are super trivial to use and easy to understand) to define which other AWS devices can access the port, then yeah: I have never seen any reason why this entire feature…

My theory is that a bunch of entrenched network engineers just really like subnets and IPv4 and NAT and don't realize how mostly unnecessary it is in an era of cloud infrastructure and IPv6.

My grandchildren are still going to be NAT'ing.

Re: Improved VPC Networking for AWS Lambda

#20

Post by k__ » Tue, Sep 03, 2019, 10:40 PM UTC

whalesalad wrote: post #16

anherome21003 wrote: post #4

I dont understand why people use AWS Lambda. Here in France, people use PHP with docker and it works just fine. Another scam from amazon?

I don't understand why people drive cars. Here in XYZ we ride horses everywhere and it works just fine.

I think Lambda is more like Uber and Docker more like Rent-A-Car.

With Uber you don't have to drive, they just fetch and deliver you and a few things you have on you.

With Rent-A-Car, you can transport much more stuff, but you also have to drive yourself.