Off-by-none: Issue #290

July 30, 2024

Only have a few minutes? Check out this week's MOST POPULAR links as chosen by our email subscribers.

Are your serverless functions confused? 🫤

In our previous issue, AWS Heroes assembled in Seattle, AWS put the kibosh on QLDB, and Momento made Topics GA. This week, Bedrock adds Meta Llama 3.1 405B, Step Functions get managed keys, and Google Cloud's serverless functions get confused. Plus, we have a whole bunch of amazing serverless content from the community!

Serverless News & Announcements 📣

Lots happening this week in Cloud and Serverless. AWS announced that Meta Llama 3.1 generative AI models are now available in Amazon Bedrock. They quickly followed that up with the news that Meta Llama 3.1 405B is now generally available in Amazon Bedrock, supposedly the best model for synthetic data generation and model distillation. They also announced that the Mistral Large 2 foundation model is now available as well.

In some non-AI AWS news, AWS Step Functions now supports Customer Managed Keys, letting you encrypt your workflow definitions and execution data using your own encryption keys. And, AWS Cost Categories now supports a "Billing Entity" dimension, giving you the ability to segment costs based on AWS Marketplace charges.

In other cloud news, Researchers Revealed the ConfusedFunction Vulnerability in Google Cloud Platform, which is not good. "An attacker could escalate their privileges to the Default Cloud Build Service Account and access numerous services such as Cloud Build, storage (including the source code of other functions), artifact registry and container registry." 😬

Also, Microsoft unveiled serverless fine-tuning for its Phi-3 small language model and Meta Llama 3.1 is now available on Workers AI (Llama 3.1 8B, that is).

CrowdStrike released their Preliminary Post Incident Review (PIR) detailing the "Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD)." It's not comforting.

The results of Stack Overflow’s Annual Developer Survey were recently released. It's no surprise that technical debt remains our biggest frustration. 76% responded that they are currently using AI tools at work with 45% saying they are bad or very bad at handling complex tasks. Might just be me, but I feel like AI is just going to create more tech debt in the future. 🤷‍♂️

Finally, I wanted to share Allen Helton's latest update on his daughter's cancer treatment. Allen is hugely important to the serverless community, and his family needs our continued support. As a father of two girls myself, these posts are heartbreaking. His family's resilience in spite of this is truly inspirational. ❤️🙏

Serverless Concepts 🏗

There is a lot to learn when you start building real world serverless apps, so here are a few deep dives for you. Cost optimization is all the rage nowadays, so props to Raphael Montaud for his great piece on cleaning up old items in DynamoDB.

• AWS Lambda performance with Java 21: x86 vs arm64 by Vadym Kazulkin
• How to delete old data from DynamoDB without spending thousands by Raphael Montaud
• SQS Retry Mechanism Explained — How it can save you from data loss by Engin öztürk
• Lambdas: Use Lambda Layers instead of Docker image by Joao Rui
• Benchmarking AWS Lambda Cold Starts Across JavaScript Runtimes by Igor Zinkovsky and Andy Jiang

Serverless Tutorials 👷‍♀️

Here are a few interesting tutorials I came across this week. The functionless commenting system and the deep dive on Lambda streaming responses were my favorites.

• Deploying a Node.js Application on AWS App Runner: A Step-by-Step Guide by Chandan Maurya
• Comment system: API Gateway & DynamoDB Integration in Pulumi by Srikanth Sharma
• Deploy the Golang App to AWS Lambda using GitHub Action by Mert ÇAKMAK
• Using AWS Cognito on an S3 Static Page Website for Login and Sign-up by Helio Tarnowski
• Streaming Responses via AWS Lambda by Jones Zachariah Noel N
• How to provision an AWS WAF using AWS CDK by Peter McAree

Serverless Security 🔒

Serverless Security - Cognito Misconfigurations
It's been awhile since we've seen a good serverless security post. I haven't tried implementing these "misconfigurations" outlined by Martyn Kilbryde, but they're a constant reminder that serverless doesn't guarantee your security posture.

Serverless Reads 🤓

Embracing Serverless in a 1951 Founded Enterprise
Lee Gilmore shares his learnings after having modernized legacy architecture in a large enterprise by embedding serverless and modern engineering practices.

Google's 135 Billion Dollar Oopsies Is A Strong Case Against Serverless
I don't fully agree with Andrew Zuo's premise here, particularly because I believe that purpose-built, managed services are extremely powerful from a security, stability, and maintainability standpoint. However, cost optimization at higher scale is still the holy grail.

The history and future of serverless containers
Speaking of generic compute platforms, Simon Moser's post was an interesting look at the IBM Cloud Code Engine philosophy around building a flexible "serverless container" orchestration system. The underlying compute isn't the undifferentiated part, it's figuring out how to pack executable code and efficiently route it that might be the win here.

How I extend my blog with gamified learning
Jimmy Dahlqvist's clever use of AI to add a quiz at the end of his blog posts is a great example of a practical GenAI use case.

Reflecting on Serverless: Current State, Community Thoughts, and Future Prospects
Ran Isenberg shares his thoughts on the current serverless mood. There are lots of good points in here, and I agree that the future of serverless remains bright. However, skill gaps, learning curves, cost, and other factors remain unsolved challenges.

Podcasts, Videos, and more 🎧

AWS Bites #128 - Writing a book about Rust & Lambda
Eoin and Luciano discuss the new book Luciano is writing on using Rust to write AWS Lambda functions.

Real-World Serverless podcast
David Behroozi chats with Yan Cui and shares the origin story of Amazon Cognito as well as giving a demo of Speedrun, his project that turns your GitHub markdown into executable blocks of code.

Data validation and parsing with Powertools | Serverless Office Hours
Alexander Schueren joins Giuseppe Battista to show off the new Powertools for AWS Lambda (TypeScript) parser utility.

Serverless Compute at the Heart of Your EDA • Julian Wood • GOTO 2024
Julian Wood shows you how to use both serverless functions and serverless containers effectively to handle your EDA compute needs.

What is the Cloud Events Specification & Why You Should Care!
James Eastham explains the CloudEvents Specification and how CloudEvents can help you manage change.

Hello world! I mean, Believe in Serverless community!
In the first episode of the Believe In Serverless podcast, James Eastham and Allen Helton review all that happened in the serverless community during the week ending July 21st, 2024.

New from AWS 🆕

Here are a few more announcements from AWS that you might find useful:

• Amazon MQ now supports ActiveMQ version 5.18
• Meta Llama 3.1 generative AI models now available in Amazon SageMaker JumpStart
• Build your event-driven application using AWS CloudFormation Git sync status changes
• CloudWatch RUM PutRumEvents API now supports data event logging in AWS CloudTrail
• Amazon Q Business launches support for cross-region AWS IAM Identity Center
• AWS DataSync expands support for agentless cross-region data transfers to include opt-in regions
• AWS AppConfig announces feature flag targets, variants, and splits

Serverless Tools 🛠

Shade Serverless
AWS LocalStack GUI designed for developer productivity. Build and test without deploying to AWS, with instant setup using your existing infrastructure as code.

WatchTower
Monitor and analyze DynamoDB metrics and interpret this data with Amazon's Bedrock AI.

Thoughts from Social 🐦

AWS seems to be quietly "deemphasizing" or outright deprecating services with low engagement. I hate when services I'm using go away, but keeping these things alive without continued investment just wastes cycles that could be better used somewhere else.

AWS CodeCommit is deprecated now.
Beginning on 06 June 2024, AWS CodeCommit ceased onboarding new customers.
What AWS service will be the next one?https://t.co/AI68WJHien

— Vadym Kazulkin (@VKazulkin) July 29, 2024

This is ominous and (potentially) disappointing. The S3 Select console now has a link to a blog post that describes alternative approaches. It still works in a new account, though. Is S3 Select going away or not?

(Never thought I'd have to ask that question) pic.twitter.com/Ig2GZ37dsJ

— Aidan W Steele (@__steele) July 30, 2024

Upcoming Serverless Events 🗓

August 31, 2024 - ServerlessDays Bengaluru 2024

September 20, 2024 - ServerlessDays Lima

October 10, 2024 - ServerlessDays Cardiff

February 20, 2025 - ServerlessDays Manchester 2025

Please send me your serverless events!

Star of the Week ⭐️

This week's star is Thomas Aribart (@AribartT). Thomas is an Agile Web Developer at Theodo, an IT consulting and implementation firm based in Paris, France. Thomas is also the creator of several awesome TypeScript libraries and has spent the last year working on V1 of The DynamoDB Toolbox, a lightweight and type-safe query builder for DynamoDB. Thomas' work on this project has been incredible, and this version is a gift to serverless/DynamoDB developers everywhere. Thanks for all your amazing open source work, Thomas! 🙌

Final Thoughts 🤔

I thought things were supposed to slow down in the summer? Guess not. It is amazing seeing the growing adoption of serverless, new tools, and more attention on its shortcomings. Lambda turns 10 years old this year, and while there have been a number of incredible innovations, there is still a ways to go. The fact that we're starting to see real push back over pricing at scale, complexity, skill gaps, etc., indicates to me that it's reached a level of maturity and adoption that will force another round of critical innovation. Serverless isn't going anywhere, but it is evolving.

See you next week,
Jeremy

I hope you enjoyed this newsletter. We’re always looking for ideas and feedback to make it better and more inclusive, so please feel free to reach out to me via X, LinkedIn, or email.