Show HN: Lambda Chat – A dynamic web app using AWS Lambda(cloudnative.io) |
Show HN: Lambda Chat – A dynamic web app using AWS Lambda(cloudnative.io) |
This makes me wonder if, rather than using S3 as a backing store, you could have Lambda insert messages into Kinesis and have the browser read from the Kinesis stream.
Of course, the goal here is to build something with Lambda - otherwise I think you could do the whole thing with Kinesis and client-side compute.
1/ Fine-Grained Access Control is there [3], but it is performed on a pretty late stage of user-system interaction. When user assumed a role with some auth provider, then he/she can freely play with all AWS methods bundled in a well documented SDK [4].
2/ Codebase distribution means security distribution. You are authenticating user with FB/G+/Amz, then you have FGAC on DynamoDB table, then you need caller policy to call Lambda function remotely, then in Lambda function you need to check permissions one more time and the Lambda function have to have policy of what can be executed.
3/ In theory, Lambda functions are highly decoupled and testable (fn(payload, ctx)). But most of the time using Lambda makes sense in conjunction with other AWS services. Mocking Amazon's ecosystem isn't so easy.
4/ This model of computing may lead to oversized architectures, using "one more" AWS service to "close the loop", some strange solutions like watching/analyzing files in S3 buckets and so on...
I've seen a huge vendor lock-in from the beginning, I've been aware of potential security/architecture problems. These concerns are still valid for me. But at the same time, Lamba as a concept is still pretty exciting.
[1] https://github.com/jelz/awsletter
[2] https://news.ycombinator.com/item?id=9557298
[3] http://docs.aws.amazon.com/amazondynamodb/latest/developergu...
[4] http://docs.aws.amazon.com/AWSJavaScriptSDK/guide/browser-se...
As an example, take the use of S3 as a "cache" for the most recent messages in each channel. Suppose you're hosting a decent-sized collection of chat rooms, handling a total of 100 messages/second. The PUT requests alone would run you over $1000/month, even though the same amount of traffic could be easily served by a single small EC2 instance for a few percent of the cost.
E.g. 1TB worth of retrievals from S3 can buy me a dedicated server with 16TB of disk space and 30TB of inclusive traffic. Doesn't take a very big cache hit ratio before caching all external reads becomes profitable.
If cost is a consideration, it's pretty rare for AWS to be the way to go for anything but batch processing where you need instances or short periods of time in the first place.
- generating a thumbnail for an image uploaded to an S3 bucket
- processing in response to queue events
- generating stats and metrics on a schedule or in a response to events
Because there is some quality XSS happening.