5 ms·
> Lightweight functions such as header manipulations or URL rewrites tend to have a short duration I'm not knowledgeable AT ALL in this area, having never used
by isoprophlex 6y ago
> Lightweight functions such as header manipulations or URL rewrites tend to have a short duration
I'm not knowledgeable AT ALL in this area, having never used or first-hand seen these FAAS things.
But header manipulation? Really... These are executed as aws lambdas?! I don't get why you'd ever need to do this.
(Not being facetious, honest puzzlement!)
- turtlebits 6y agoWhat would you propose? Yet another AWS service for the specific use case?
- hamandcheese 6y agoConfig of some sort maybe? If you can do it in nginx, seems like it should be possible without invoking a lambda.
- njitbew 6y agoI don't understand what nginx has to do with this. nginx's language is just that: a language. If Lambda@Edge would support nginx language, you would still be invoking a lambda. But I'd must rather write some header rewriting code in, say, JavaScript than nginx's language. Then why a (Turing-complete) programming language and not a config language? Simple: because a programming language gives you infinite more power than what any config system could ever provide. E.g. I could compare the origin IP, determine the country, and change the response based on that. And there are plenty of use cases like this which you cannot express in a config language.
- jfrunyon 6y ago> E.g. I could compare the origin IP, determine the country, and change the response based on that. And there are plenty of use cases like this which you cannot express in a config language. Well, you can do that in plenty of "config languages", including nginx[1]. The reason Lambda exists is that it's good for Amazon, because they can push all the costs of the logic back onto the customer. (It could also be good for the customer, in that whatever configuration Amazon might otherwise support could be limited.) [1] http://nginx.org/en/docs/http/ngx_http_geoip_module.html http://nginx.org/en/docs/http/ngx_http_geoip_module.html
- TheCoelacanth 6y agoIf you want a full-fledged reverse proxy, then you can run a full-fledged reverse proxy. Cloudfront is a CDN, it's not intended to be a replacement for nginx.
- luhn 6y agoCloudFront should let you configure header injection for responses. Just a simple list of key-value pairs. I've seen it requested before, it's a feature a lot of people want.
- jeffasinger 6y agoEssentially this is a way to lets you push all of the weird feature requests your customers might have off into one place. From a customer point of view, maybe you need to rewrite the path based on the contents of a cookie, or maybe you want to shed certain types of requests in high load scenarios, or maybe there's a buggy upstream application that sends bad cache-control headers, or ... If the goal is to let the customer specify infinitely complex logic at the edge, a programming language is a good way to do that. Function As A Service is a good billing model for lots of invocations of short, small functions across the customers choice of language.
- thayne 6y agoThe unfortunate side effect is that Lambda@Edge at least adds quite a bit of latency that a simpler but less powerful rules based system for header manipulation probably wouldn't. We experimented with using Lambda@Edge for manipulating a header, but the added latency just wasn't worth it, and we had to come up with a different solution. That was years ago though, so maybe it is better now.
- ts330 6y agobasic manipulation in CF is an absolute pita - so much overhead for simple things like clobbering a header value. but by allowing JS/whatever, it gives you an infinite landscape to work with the values in a language that a wide range of people grok. it's just a matter of getting a decent deployment setup so you can rinse and repeat easily. but i agree, it's a freaking jack hammer where most people need a small tack hammer.
- leesalminen 6y agoI use Lambda@Edge to conditionally serve brotli compressed .js files based on the Accept request header from an S3 bucket.
- alexbilbie 6y agoCloudfront now has native brotli support
- leesalminen 6y agoThat’s good to know, thanks!
- gehen88 6y agoWe use Lambda@Edge to build our own CDN on top of S3 with authentication, so our customers have reliable, fast and secure data access. We use a bunch of edge lambdas which serve thousands of requests each minute, so I suspect we'll see a nice cost reduction with this. Some of the stuff we do: - rewrite urls - auth and permissions check - serve index.html on directory indexes - inject dynamic content in served html files - add CORS headers
- nihakue 6y agoCan I ask how you're injecting dynamic content in served html files? My understanding was that lambda@edge functions could not modify the origin response body. > When you’re working with the HTTP response, Lambda@Edge does not expose the body that is returned by the origin server to the origin-response trigger. You can generate a static content body by setting it to the desired value, or remove the body inside the function by setting the value to be empty. If you don’t update the body field in your function, the original body returned by the origin server is returned back to viewer. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-updating-http-responses.html https://docs.aws.amazon.com/AmazonCloudFront/latest/Develope...
- heyoni 6y agoIt sounds to me like they might be creating the response from scratch rather than modifying an existing one. And since they’re talking about serving data from s3, maybe it’s just a nicely formatted version of aws s3 ls?
- gehen88 6y agoWe use S3.getObject to fetch it and create a custom response.
- pier25 6y agoIsn't it expensive in terms of egress?
- donavanm 6y ago
- aeyes 6y ago> These are executed as aws lambdas These are executed. Lambda is just a brand name. We did this 15 years ago on hardware load balancers, proxy servers, cache servers etc
- diroussel 6y agoIn AWS on the whole if there is any type of extension mechanism it's done via a lambda. Anything that needs an eval(), that is more than a regexp, is done via lambda. This makes lambda's the glue of AWS. The input events are small json values, and the outputs are json values, and you can (mostly) use any language you want.
- deleted 6y ago[deleted]
- kjjjjjjjjjjjjjj 6y agoIf you have stuff in a global CDN, wouldn't you want a global compute system too? This is literally what lambda@edge is for
- cactus2093 6y agoIt's funny our team literally just last week did something like this at ___ BigCorp. We need to verify a JWT signature from a new 3rd party provider and then append a secure auth token that is accepted by the backend service. Couldn't this just be done in the backend service? Why yes it definitely could. But apparently there are rigid security policies in place, and this stuff appears to have been carved in stone and approved by SOC2 auditors and lawyers and regulators or whatever and they have agreed that the backend gateway would use X specific formats for authentication and nobody can make any exceptions. So instead our team is spinning up an ad-hoc lambda function attached to cloudfront which will use none of our usual tooling & frameworks and have zero visibility for our security teams and be full of whatever soon to be out of date 3rd party js dependencies we need, all in the name of security so that we can pretend that the API we're communicating with is using our approved auth token format when they aren't. Just another day at a big company, really.
- rtpg 6y agoI mean a less cynical reading is that this is like nginx handling https->wsgi for your Python application. You can deal with a unification of your auth stack and not have application development be disrupted
- FpUser 6y agoI would not call it cynical. Rather naming things for what they are.
- ryanmarsh 6y agoOh hi. I see you work for one of my clients.
- isoprophlex 6y agoInteresting, and that actually makes (some sort of) sense. Thanks..!
- hardstyle 6y agoWe use Lambda@Edge so we can access Cloudfront’s true client IP value as well as geo data and pass it on to the origin
- jdub 6y agoIt's especially useful for doing things during the Origin Request phase, which happens prior to the request from the CDN to the Origin. In that phase you can change anything about the request itself, or the origin it will connect to. But the function only needs to run when there's a cache miss. I have an application that needs to select an origin based on the request path (too many to use CloudFront cache behaviours), with a cache miss rate of less than 1%. It's a tiny amount of additional latency for cache misses, and a very small proportion of our CDN costs per month.
- adreamingsoul 6y agoVarnish Cache with VCL allows you to create custom edge logic for things like header manipulation or backend selection.
- jdub 6y agoAre you suggesting I build and maintain my own global CDN with 200+ edge locations? Thank you, but no thank you.
- jcpham2 6y agoI think so, as an alternative to all this AWS magic you could totally deploy <insert open source software name> on 200+ newly deployed instances, colo servers, or whatever you like! I caught it too. I get downvoted a lot for not following rules and I don’t really care this was hilarious
- adreamingsoul 6y agocloud magic has shown us that “one day” we will need to scale up to an extreme count of “instances” and that suboptimal solutions can be negated with horizontal scaling.