4 ms·

For apps that just do basic things like read and write to a database (e.g. DynamoDB) would it be possible to go a stage beyond serverless and have the code that

For apps that just do basic things like read and write to a database (e.g. DynamoDB) would it be possible to go a stage beyond serverless and have the code that runs in the user's browser talk to the database directly? Obviously you'd have to be careful about permissions, and integrate with Cognito, but there are REST APIs for talking to AWS services so I'm sure there are use cases where even the lambdas are not necessary. I don't know what such an architecture would be called, other than "serverlessless".

cldellow 8y ago
Depending on your threat model, absolutely. Cognito supports issuing temporary IAM credentials, so you can have granular permissions, billing and auditing. I debated doing this for a side project but decided it was a little too risky for my use case. For a corporate/intranet thing, though, it'd absolutely be reasonable.
dustingetz 8y ago
you can’t trust the browser client at all, but setting that aside it isn’t very reliable, much better to queue up commands and then do real work on server (what happens when some third party service is down?)
zinckiwi 8y ago
Until the introduction of Cloud Function support, I believe that was essentially the execution model for Firebase.
eranation 8y ago
Other than what others mentioned (Cognito with temporary credentials) I think AppSync might be close to what you are looking for https://aws.amazon.com/appsync/ https://aws.amazon.com/appsync/ It has a GraphQL API and supports DynamoDB as a data source
tirumaraiselvan 8y ago
Apart from permissions, which can perhaps be solved by temp credentials etc, how do you prevent 1) DDoS: someone fiddling the queries to result in db outage, 2) scale: browsers can't leverage connection pooling so not sure if DB can handle so many client connections.
- fulafel 8y ago
  How do serverless apps usually prevent DDoS? If it's using API Gateway features, couldn't you just proxy DynamoDB calls through API Gateway? I think connection pooling is not relevant to DynamoDB.
  - tirumaraiselvan 8y ago
    1) DDoS not just at the API Gateway level, but also at the database level. Suppose you fiddle the query to return you a million rows or some horrible aggregated join. You can slow down the entire DB. You need to hide the query from the client. 2) Yeah, connection pooling is apparently not relevant for DynamoDb because it is HTTP based, I wonder how they implement transactions then. How can I manipulate code while having an open transaction?
    - fulafel 8y ago
      I think dynamodb lacks joins. Generally, good point. Though I suspect many traditional web app backends are vulnerable to this kind of "crafted high overhead api call" dos too. I guess you could throttle the calls based on duration using some kind of token bucket scheme...
debaserab2 8y ago
It's not ever direct though. There's an HTTP intermediary - either you're controlling it, or Amazon is.
rkangel 8y ago
This is exactly the model that Firebase is aiming to support. Cloud Firestore is accessed directly through the various client libraries (Android, iOS, JS). Firestore has a permissions system to control who can access what, based on Firebase Auth user ids, and then when you need little bits of server side stuff you can put it in cloud functions.

cldellow 8y ago

Depending on your threat model, absolutely. Cognito supports issuing temporary IAM credentials, so you can have granular permissions, billing and auditing. I debated doing this for a side project but decided it was a little too risky for my use case. For a corporate/intranet thing, though, it'd absolutely be reasonable.

dustingetz 8y ago

you can’t trust the browser client at all, but setting that aside it isn’t very reliable, much better to queue up commands and then do real work on server (what happens when some third party service is down?)

zinckiwi 8y ago

Until the introduction of Cloud Function support, I believe that was essentially the execution model for Firebase.

eranation 8y ago

Other than what others mentioned (Cognito with temporary credentials) I think AppSync might be close to what you are looking for https://aws.amazon.com/appsync/ https://aws.amazon.com/appsync/ It has a GraphQL API and supports DynamoDB as a data source

tirumaraiselvan 8y ago

Apart from permissions, which can perhaps be solved by temp credentials etc, how do you prevent 1) DDoS: someone fiddling the queries to result in db outage, 2) scale: browsers can't leverage connection pooling so not sure if DB can handle so many client connections.

fulafel 8y ago
How do serverless apps usually prevent DDoS? If it's using API Gateway features, couldn't you just proxy DynamoDB calls through API Gateway? I think connection pooling is not relevant to DynamoDB.
- tirumaraiselvan 8y ago
  1) DDoS not just at the API Gateway level, but also at the database level. Suppose you fiddle the query to return you a million rows or some horrible aggregated join. You can slow down the entire DB. You need to hide the query from the client. 2) Yeah, connection pooling is apparently not relevant for DynamoDb because it is HTTP based, I wonder how they implement transactions then. How can I manipulate code while having an open transaction?
  - fulafel 8y ago
    I think dynamodb lacks joins. Generally, good point. Though I suspect many traditional web app backends are vulnerable to this kind of "crafted high overhead api call" dos too. I guess you could throttle the calls based on duration using some kind of token bucket scheme...

debaserab2 8y ago

It's not ever direct though. There's an HTTP intermediary - either you're controlling it, or Amazon is.

rkangel 8y ago

This is exactly the model that Firebase is aiming to support. Cloud Firestore is accessed directly through the various client libraries (Android, iOS, JS). Firestore has a permissions system to control who can access what, based on Firebase Auth user ids, and then when you need little bits of server side stuff you can put it in cloud functions.