Costly mistakes in serverless computing
summary
Built a serverless app on AWS using Route53 S3 CloudFront API Gateway Lambda DynamoDB and it works but exposes concrete failures: accidental input-injection of stale events floods API Gateway and causes a self‑induced DoS, brute‑force SMS codes let attackers try many guesses, over‑provisioned memory/DB capacity spikes bills, and overly permissive IAM lets functions pivot. Fixes implemented include input validation and cache-clears limited to five minutes, gateway rate‑limits and lockouts, on‑demand DB and right‑sizing, and one IAM role per function. Costs once spiked by thousands of dollars and fall after targeted cost engineering.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:19Who We Are
- 1:54What Serverless Looks like
- 9:12Rate Limiting
- 11:26Web Application Firewalls
- 12:04Over Provisioning
- 15:26Over Privileged Policies
- 20:23Risks
- 21:14Cost Engineering
- 23:24Price Analysis
related talks
42mServerless Tales from the Trenches
25mWhere Did All My Servers Go?
54mServerless Architectures: no servers allowed!
39mBuilding Resilient Serverless Applications
25mHow to Fail at Serverless (without even trying)
36mObserving all the Serverless Things
40mThe serverless startup
29mBuild highly scalable serverless applications on AWS