Check-list for going live with API Gateway and Lambda

Disclaimer : this is a long list, you don’t need to tick every box to go-live. Think of them as a ladder, the more critical a system the higher you should try and climb.

Observability

1. Enable detailed monitoring to get per-method metrics (e.g. latency for GET /index). Without this, CloudWatch only reports aggregated metrics for all your endpoints. Which is close to useless… There’s no way to figure out which endpoint is experiencing slow response time or high error rate.
2. Set up per-method alarms on tail latency. Use Latency metric instead of Integration Latency. Set the alarm on p90, p95 or p99 depending on your business requirement/SLA.
3. Set up per-method alarms on high error RATES. Error count is easily skewed by request count — one error at 10,000 RPS is not worth waking up at 3am, but one error out of 10 RPS might be. Use computed metrics to calculate error rates as 4xx count / request count and 5xx count / request count.
4. Set up per-method alarms on low success RATE. Similar to the above, but for success rate (i.e. 200 count / request count) instead.
5. Enable X-Ray active tracing. This allows you to see traces in X-Ray when requests flow through API Gateway and Lambda. If you invest time into instrumenting the Lambda functions, then this will help you in identifying performance issues.
6. Add custom metrics for application-specific metrics. For APIs, you should record custom metrics asynchronously by publishing them to CloudWatch Logs first (by writing to stdout). This avoids adding extra latency to the Lambda invocation, and you won’t have to worry about error handling and retries when CloudWatch has a problem. You can use this SAR app to parse and forward these custom metrics to CloudWatch.
7. Ensure you have tags. Consider adding tags for TEAM, FEATURE, COST CENTRE, etc. This helps you with cost tracking in AWS Billing.

As you can see, you have to configure a lot of alarms! To make your life easier, I created a CloudFormation macro that can auto-generate the aforementioned latency and error alarms. Check it out! It also supports other resources such as Lambda, SQS and Step Functions.

Security

1. Review the default rate limiting configuration. The default setting leaves you vulnerable to DoS attack against the whole region. Choose a sensible rate limit for every method.
2. Configure WAF and enable IP-based rate limiting rule. This offers you some protection against DoS attacks and can be enabled at either API Gateway or CloudFront layer.
3. Configure WAF and enable SQLi rule. This WAF rule protects you against basic SQL injection attacks.
4. Have you protected the endpoints with authentication? Most endpoints in an API should be authenticated. For user-facing API endpoints, consider using Cognito User Pools or Custom Lambda Authorizer. For internal APIs (to be used by other internal systems), considering using AWS_IAM. For a SASS platform that needs to enforce usage quota by client, then use API Key.
5. Enable API Gateway request validation. Take advantage of API Gateway’s request validation capability so you don’t pay for invalid requests.
6. Implement response validation. Similar to the above, but validates the response instead. This prevents data exfiltration in the event an attacker is able to launch an injection attack and manipulate your function into fetching data it shouldn’t return. Unfortunately, API Gateway has no built-in response validation. You would have to implement this in your Lambda function. For Node.js function, the middy middleware engine has a built-in validator middleware which supports response validation.

Performance

1. As a rule of thumb, cache as much as you can. You can implement caching at different layers, have a look at this post for more details. By default, try to cache at the edge with CloudFront where possible.
2. Ensure Lambda has short timeout. API Gateway has a max integration timeout of 29s, so Lambda’s timeout must be smaller than this. For user facing APIs, the Lambda timeout should be less than 3 seconds. If your API needs to perform long-running tasks, then consider adopting the decoupled invocation pattern.

Resilience

1. Set up for multi-region, active-active. To protect against region-wide failures in AWS, you should consider going for a multi-region, active-active setup. Have a look at this post for more details.
2. Implement circuit-breakers with fallbacks. The circuit breaker pattern protects you against problems such as retry storms. And when combined with fallbacks, it protects you from cascade failures where a failing service can take down all its upstream systems.

Testing

1. Test the API end-to-end. Don’t stop at testing the functions locally with mocks & stubs. You should test the API end-to-end by talking to it through its HTTP interface and ensure everything actually works, including permissions settings and request validation.
2. Consider adopting consumer-driven contract testing. This is really useful in a large organization where teams often depend on other teams’ APIs. Consumer-driven contract testing helps prevent one team accidentally releasing contract (which can be behavioural) changes that breaks an upstream system. Pact is the most prominent framework for implementing consumer-driven contract testing tool.
3. Run load test with realistic user journeys. While API Gateway and Lambda are both scalable, you still need to ensure you understand the scaling behaviour of the whole system. These tests would also stress your downstream systems (databases, queues, other APIs, etc.) to highlight where your scaling bottlenecks are.

Documentation

1. Publish the Swagger/API spec. This helps share information about your service, and can be done as part of your CI process. To do this, you need to call getExport against the API id.

Liked this article? Support me on Patreon and get direct help from me via a private Slack channel or 1-2-1 mentoring.

Hi, my name is Yan Cui. I’m an AWS Serverless Hero and the author of Production-Ready Serverless. I specialise in rapidly transitioning teams to serverless and building production-ready services on AWS.

Are you struggling with serverless or need guidance on best practices? Do you want someone to review your architecture and help you avoid costly mistakes down the line? Whatever the case, I’m here to help.

You can contact me via Email, Twitter and LinkedIn.

Hire me.

The post Check-list for going live with API Gateway and Lambda appeared first on theburningmonk.com.