4 ms·

AWS ALB Can Now Invoke Lambda Functions

56 points by markonen 8y ago

markonen 8y ago
The big deal here is that ALB doesn’t cost $3.50 per million requests like the API Gateway does.
- avitzurel 8y ago
  I think what this is solving is that in case you already have an ALB, you can have a route rule that will direct traffic to lambda. That's pretty powerful.
nodesocket 8y ago
Does this also means you can use a custom domain now to invoke a lambda function? Maybe this was possible before using API gateway, I may be confusing with Google Cloud Functions.
- zedpm 8y ago
  You were always able to use a custom domain with Lambda, via API Gateway, just like you can now via ALB.
- colmmacc 8y ago
  Yes! you can do this with ALB, or also with Lambda@Edge. You can also use ACM with both to create and renew a certificate for your custom domain.
davewritescode 8y ago
Anyone know if ALB supports custom authentication lambdas? That's one of the big features that's keeping us on API Gateway.
- xmly 8y ago
  Why not move the Auth to the code instead? Add one middleware just.
  - renke1 8y ago
    Good point, if you do authentication in your code manually (like verifying a JWT issued by Cognito) you could also directly invoke the Lambda from your client and completely forgo ALB saving even more money (at the cost of slightly increased complexity, that is).
- luhn 8y ago
  AFAICT they don't. I haven't looked at the details of Lambda Layers yet, but I wonder if they might help with this? Build an authentication layer that you can bundle with all your ALB Lambdas.
- ranman 8y ago
  Not custom auth but it supports any OIDC provider or cognito which can do lambda functions as part of reg and auth. https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/ https://aws.amazon.com/blogs/aws/built-in-authentication-in-...
  - renke1 8y ago
    The way I read this, it's not exactly a substitute for the Cognito authorizer, which makes easy to use stateless session for SPAs, or is it?
xmly 8y ago
Great! I do not like API Gateway complex setting anyway haha
citilife 8y ago
That'll simplify the practice of serverless quite a bit[1]. Having worked with the API Gateway, this should let us just skip a step or so. [1] https://medium.com/capital-one-tech/a-serverless-and-go-journey-credit-offers-api-74ef1f9fde7f https://medium.com/capital-one-tech/a-serverless-and-go-jour...
cheeseburgerj 8y ago
Can also do Private VPC invocation of Lambda through this without the stuffing around with private API gateway and VPC Endpoints good stuff

56 points by markonen 8y ago

markonen 8y ago

The big deal here is that ALB doesn’t cost $3.50 per million requests like the API Gateway does.

avitzurel 8y ago
I think what this is solving is that in case you already have an ALB, you can have a route rule that will direct traffic to lambda. That's pretty powerful.

nodesocket 8y ago

Does this also means you can use a custom domain now to invoke a lambda function? Maybe this was possible before using API gateway, I may be confusing with Google Cloud Functions.

zedpm 8y ago
You were always able to use a custom domain with Lambda, via API Gateway, just like you can now via ALB.
colmmacc 8y ago
Yes! you can do this with ALB, or also with Lambda@Edge. You can also use ACM with both to create and renew a certificate for your custom domain.

davewritescode 8y ago

Anyone know if ALB supports custom authentication lambdas? That's one of the big features that's keeping us on API Gateway.

xmly 8y ago
Why not move the Auth to the code instead? Add one middleware just.
- renke1 8y ago
  Good point, if you do authentication in your code manually (like verifying a JWT issued by Cognito) you could also directly invoke the Lambda from your client and completely forgo ALB saving even more money (at the cost of slightly increased complexity, that is).
luhn 8y ago
AFAICT they don't. I haven't looked at the details of Lambda Layers yet, but I wonder if they might help with this? Build an authentication layer that you can bundle with all your ALB Lambdas.
ranman 8y ago
Not custom auth but it supports any OIDC provider or cognito which can do lambda functions as part of reg and auth. https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/ https://aws.amazon.com/blogs/aws/built-in-authentication-in-...
- renke1 8y ago
  The way I read this, it's not exactly a substitute for the Cognito authorizer, which makes easy to use stateless session for SPAs, or is it?

xmly 8y ago

Great! I do not like API Gateway complex setting anyway haha

citilife 8y ago

That'll simplify the practice of serverless quite a bit[1]. Having worked with the API Gateway, this should let us just skip a step or so. [1] https://medium.com/capital-one-tech/a-serverless-and-go-journey-credit-offers-api-74ef1f9fde7f https://medium.com/capital-one-tech/a-serverless-and-go-jour...

cheeseburgerj 8y ago

Can also do Private VPC invocation of Lambda through this without the stuffing around with private API gateway and VPC Endpoints good stuff