I've built awsletter [1] as a quick PoC of the cloud-only web app some time ago. Last week (inspired by HN thread [2]) I've jumped into this project once again. In January Lambda was a big "wow" for me, but now I see some things that have to be taken into consideration:

1/ Fine-Grained Access Control is there [3], but it is performed on a pretty late stage of user-system interaction. When user assumed a role with some auth provider, then he/she can freely play with all AWS methods bundled in a well documented SDK [4].

2/ Codebase distribution means security distribution. You are authenticating user with FB/G+/Amz, then you have FGAC on DynamoDB table, then you need caller policy to call Lambda function remotely, then in Lambda function you need to check permissions one more time and the Lambda function have to have policy of what can be executed.

3/ In theory, Lambda functions are highly decoupled and testable (fn(payload, ctx)). But most of the time using Lambda makes sense in conjunction with other AWS services. Mocking Amazon's ecosystem isn't so easy.

4/ This model of computing may lead to oversized architectures, using "one more" AWS service to "close the loop", some strange solutions like watching/analyzing files in S3 buckets and so on...

I've seen a huge vendor lock-in from the beginning, I've been aware of potential security/architecture problems. These concerns are still valid for me. But at the same time, Lamba as a concept is still pretty exciting.

[1] https://github.com/jelz/awsletter

[2] https://news.ycombinator.com/item?id=9557298

[3] http://docs.aws.amazon.com/amazondynamodb/latest/developergu...

[4] http://docs.aws.amazon.com/AWSJavaScriptSDK/guide/browser-se...

user:	jelz
created:	May 17, 2015
karma:	4