{"id":25,"date":"2019-12-06T16:00:00","date_gmt":"2019-12-06T15:00:00","guid":{"rendered":"https:\/\/www.codemotion.com\/magazine\/config-management-and-cost-optimisation-for-serverless-computing\/"},"modified":"2021-12-23T14:25:36","modified_gmt":"2021-12-23T13:25:36","slug":"config-management-and-cost-optimisation-for-serverless-computing","status":"publish","type":"post","link":"https:\/\/www.codemotion.com\/magazine\/devops\/cloud\/config-management-and-cost-optimisation-for-serverless-computing\/","title":{"rendered":"Config management and cost optimisation for serverless computing"},"content":{"rendered":"

Serverless computing<\/span><\/strong> is growing in popularity. In a serverless setup, you no longer run your own virtual servers<\/span>. Instead, you compose your application<\/span> using services such as databases and compute<\/span>. The result is a more streamlined and reactive application<\/span>.<\/p>\n

Serverless will be one of the many interesting themes covered by Codemotion Madrid 2019<\/a><\/strong> talks. Among them, Vicen\u00e7 Garc\u00eda Alt\u00e9s will deliver a speech about operational serverless, with many practical examples on how to use such technology (check talk’s info here<\/a>).<\/p>\n

Although the basic idea behind serverless computing<\/span> seems quite straightforward, it is easy to get things wrong. So, during Codemotion Amsterdam 2019<\/strong> Alex Casalboni shared some of his experiences with security, configuration management<\/span> and cost optimisation.<\/p>\n

Serverless security<\/h2>\n

Security is always crucial in any application<\/span>. Access control is especially important. Using the Lambda Permission Model<\/a>, AWS<\/span> offers fine-grained security controls for both execution and invocation.<\/p>\n

Execution policies<\/b> are used to define what resources a given function is allowed to access. For example, \u201cLambda<\/span> function A can read from DynamoDB<\/span> users table<\/i>\u201d.<\/p>\n

Function policies<\/b> are used for controlling invocations. They can allow for access across accounts. For example, \u201cActions on bucket X can invoke Lambda<\/span> function Z<\/i>\u201d.<\/p>\n

However, you have to be really careful not to grant unlimited access rights! As Alex put it, things like Action: \u201cs3.*\u201d, Action: \u201cdynamodb:*\u201d and Action: \u201csns:*\u201d make puppies cry! Instead, you should use very fine-grained IAM<\/a> (Identity and Access Management<\/span>) policies using the AWS Serverless Application Model<\/a> (SAM).<\/p>\n