Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
lazerwolf
Dec 22, 2009

Orange and Black
I have a React app I am looking to host on AWS. I have a few constraints:
I can’t use S3 to host because the bucket must be completely private.
Access to the app is only intranet or company VPN.

Basically all public facing solutions are out.

I was exploring cloud front serving the private S3 files and putting a WAF on top limiting IP ranges.

Is there a better more sustainable solution?

Ideally I’d like to template this with Terraform so I can spin up the same stack for the next series of web apps.

Adbot
ADBOT LOVES YOU

lazerwolf
Dec 22, 2009

Orange and Black
I have an architecture question. I have a Django REST api running on ECS. I feel there is something off with the configuration because the instances start crashing when 1000 concurrent POST requests to the api occur. I do have autoscaling enabled but I’m not sure if the instances scale fast enough or there is something else going on.

We have a separate service using step functions that make the POST requests. These generally happen in bursts. I’m wondering if directly hitting the api is the right pattern or if there is a way to buffer these into some sort of queue that will throttle the POSTs to a more manageable rate.

lazerwolf
Dec 22, 2009

Orange and Black

Docjowles posted:

I think you're on the right track. If the work can be changed to a model where requests are posted to a queue and consumers pull items off to process, that is going to be infinitely more scalable than trying to handle them synchronously. SQS and SNS are your friends here, if you're fine being AWS native.

If that is not possible, we are going to need more specifics about the failures. Error messages, what resource is being exhausted.

Thanks for the response. We have control over our stack. I’m wondering if this is a premature optimization. I feel our API should handle 1000 requests without breaking but who know what the true number might be. Long term this feels like a hood approach for this service.

lazerwolf
Dec 22, 2009

Orange and Black
My apologies, a number (~700 or so) POSTed to the API fine. Then we started seeing failed Step Function executions. The main error was the API started sending 502 responses back. I have a feeing autoscaling was not configured correctly because it looks like the CPU usage of the instances went to 100%. We always have 2 instances running and it should have been able to scale up to at least 5.

lazerwolf
Dec 22, 2009

Orange and Black
What are best practices for replaying failed Step Function executions?

lazerwolf
Dec 22, 2009

Orange and Black

LochNessMonster posted:

Are you looking at a specific scenario or in general?

In general it’s a good idea to look at your possible/actual failures and set IntervalSeconds (wait time before starting a retry), MaxAttempts and BackoffRate.

You can also use a Catch to handle known errors in a specific way.

If you’re using Lambda’s it’s best to handle your exceptions there instead of in the SF.

Yeah let me elaborate a bit.

I have a Step Function pipeline set up that triggers off of s3 Create Object and ultimately interacts with a third party API. I have Retry for each lambda involved set up and I am catching any error with the third party api and am sending the caught messages to an SQS acting like a DLQ.

My question is about retrying caught SF executions. I'm picturing a scenario that maybe some aspect of the third party api changed and I need to update my code to handle it. Then I want to be able to replay some of the failed executions to process through the new code.

lazerwolf
Dec 22, 2009

Orange and Black

LochNessMonster posted:

Agree, the use case almost sounds like a text book example.

s3 event on object creation -> sqs -> trigger processing lambda.

You can manage error handling on the lambda and use a DLQ for permanent failures. Setup a cloudwatch alarm that informs you on failures (or trigger another lambda to do stuff with the events)

What is the benefit from sending the event to SQS first rather than triggering Lambda directly?

I could probably refactor my business logic to fit into one lambda function, I am trying to keep my logic into smaller lambdas orchestrated with SF rather than one larger lambda.

I failed to mention this but I am using Eventbridge rules to trigger the SF.

The data flow is:
s3 Object Creation -> Eventbridge Rule -> SF

Would this be what you both are suggesting?

s3 Object Creation -> Eventbridge Rule -> SQS -> Lambda/SF

lazerwolf fucked around with this message at 18:23 on Jun 13, 2023

lazerwolf
Dec 22, 2009

Orange and Black
Another question, for Lambdas that require external dependencies, what is the best way to handle this.

I found you could install the dependencies locally and zip up the entire folder with app code. Build a layer from the dependencies directory or build a docker image of your app and deploy that.

lazerwolf
Dec 22, 2009

Orange and Black
Do you all worry about cold start times for containers vs zip?

lazerwolf
Dec 22, 2009

Orange and Black
Is it a good practice to use container images for lambda functions? Seems to be the easiest way to handle dependencies. Are there any obvious downsides?

Adbot
ADBOT LOVES YOU

lazerwolf
Dec 22, 2009

Orange and Black

ledge posted:

Is there a reason to not use layers? It's what they are there for.

We don’t really have the same reusable requirements among different use cases. I’d have to build a layer per stack which is fine I guess? I’m not sure which direction is better hence the question.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply