Serverless patterns

The cheat table: Azure serverless → AWS serverless

Lambda deep-dive (beyond chapter 4)

Chapter 4 covered Lambda's basic shape. Here we look at the four knobs that determine real-world cost and latency: cold starts, concurrency model, CPU architecture, and packaging.

Cold starts and the two concurrency knobs

ARM (Graviton2) vs x86

Lambda runs on either x86_64 or arm64. ARM (Graviton2) costs ~20% less per ms, often performs comparably or better, and is a one-line config change for most runtimes (Python, Node, Java, Ruby). If your code has no native x86 binaries, switch.

resource "aws_lambda_function" "api" {
  function_name = "reports-api"
  role          = aws_iam_role.lambda.arn
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "build.zip"
  memory_size   = 512
  timeout       = 10

  # Default = x86_64
  # Costs: $0.0000166667 / GB-second
}

resource "aws_lambda_function" "api" {
  function_name = "reports-api"
  role          = aws_iam_role.lambda.arn
  handler       = "index.handler"
  runtime       = "python3.12"
  filename      = "build.zip"
  memory_size   = 512
  timeout       = 10

  architectures = ["arm64"]   # ~20% cheaper
  # Costs: $0.0000133334 / GB-second
}

Container-image Lambdas

Until 2020 a Lambda deployment package was a ZIP, max 250 MB unzipped. Now you can also publish a Lambda as an OCI container image, up to 10 GB. The image has to use one of AWS's base images (which include the Lambda Runtime API client). Use this for ML inference, large dependency trees (think pandas + scikit), or when you want the same image to run in Lambda and ECS/EKS.

FROM public.ecr.aws/lambda/python:3.12

COPY requirements.txt ${LAMBDA_TASK_ROOT}/
RUN pip install -r requirements.txt

COPY app.py ${LAMBDA_TASK_ROOT}/

# Handler in <file>.<function> form
CMD [ "app.handler" ]

Lambda@Edge and CloudFront Functions

Two flavors of running code at the CDN edge:

The takeaway: if your edge logic fits in 1 ms of pure JS, CloudFront Functions is 6x cheaper and lives even closer to the user. Reach for Lambda@Edge only when you need real compute or AWS SDK access at the edge.

API Gateway: REST vs HTTP vs WebSocket

"API Gateway" is one product name with three SKUs. They're not feature-equivalent and they're not priced equivalent. Picking is the most consequential decision in any new serverless API.

Authentication options

Integration patterns

An API Gateway "integration" is the thing your route forwards to. The common ones:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::raw-events/*"
    }
  ]
}

aws lambda put-function-event-invoke-config \
  --function-name process-event \
  --destination-config '{
    "OnFailure": {
      "Destination": "arn:aws:sqs:us-east-1:111111111111:event-dlq"
    }
  }'

{
  "Effect": "Allow",
  "Action": "sqs:SendMessage",
  "Resource": "arn:aws:sqs:us-east-1:111111111111:event-dlq"
}

Step Functions: workflow as code

A Step Functions state machine is a JSON document describing a workflow: states, transitions, parallel branches, error handling, retries. Each state typically invokes a Lambda (or any of 200+ AWS services). The Step Functions service holds the running state of every workflow execution.

State machine: a tiny example

[FunctionName("Orchestrator")]
public static async Task Run(
  [OrchestrationTrigger] IDurableOrchestrationContext ctx)
{
  var input = ctx.GetInput<Order>();

  var tasks = new List<Task>();
  foreach (var item in input.Items)
  {
    tasks.Add(ctx.CallActivityAsync(
      "ProcessItem", item));
  }
  await Task.WhenAll(tasks);

  await ctx.CallActivityAsync(
    "SendConfirmation", input);
}

{
  "Comment": "Process each item, then confirm",
  "StartAt": "ProcessItems",
  "States": {
    "ProcessItems": {
      "Type": "Map",
      "ItemsPath": "$.items",
      "Iterator": {
        "StartAt": "ProcessOne",
        "States": {
          "ProcessOne": {
            "Type": "Task",
            "Resource": "arn:aws:lambda:...:function:process",
            "End": true
          }
        }
      },
      "Next": "Confirm"
    },
    "Confirm": {
      "Type": "Task",
      "Resource": "arn:aws:lambda:...:function:confirm",
      "End": true
    }
  }
}

When to skip Step Functions

Step Functions costs money per transition. For a 3-step linear flow that runs 10M times/month, that's 30M transitions = $750/month on Standard. If the flow doesn't need waits, retries-with-backoff, or visual auditing, just chain the Lambdas yourself via async invoke or EventBridge - the orchestration is free. Use Step Functions when the orchestration is the value, not the glue.

DynamoDB Streams + Lambda triggers

A DynamoDB Stream captures every INSERT, MODIFY, and REMOVE on a table as an ordered, partitioned log. Records live 24 hours. The most common consumer is a Lambda via event source mapping: AWS polls the stream, batches records (default batch size 100), and invokes your Lambda once per batch.

The four "view types"

resource "aws_dynamodb_table" "reports" {
  name             = "gfn-reports"
  billing_mode     = "PAY_PER_REQUEST"
  hash_key         = "report_id"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "report_id"
    type = "S"
  }
}

resource "aws_lambda_event_source_mapping" "reports_to_search" {
  event_source_arn  = aws_dynamodb_table.reports.stream_arn
  function_name     = aws_lambda_function.indexer.arn
  starting_position = "LATEST"
  batch_size        = 100
  maximum_batching_window_in_seconds = 5

  # Error handling - send poison records to a DLQ instead of stalling the shard
  destination_config {
    on_failure {
      destination_arn = aws_sqs_queue.indexer_dlq.arn
    }
  }
  maximum_retry_attempts = 3
}

End-to-end pattern: API GW → Lambda → DynamoDB + EventBridge → Lambda

Here's the canonical "modern serverless" shape, end to end. A client calls an HTTP API. A write Lambda persists to DynamoDB and emits an event to EventBridge. EventBridge routes the event to one or more downstream Lambdas (notifications, analytics, audit log). DynamoDB Streams gives you a second async fan-out path if you need ordered table-change processing.

The shape in Terraform (sketched)

# 1. The HTTP API itself
resource "aws_apigatewayv2_api" "reports" {
  name          = "reports-api"
  protocol_type = "HTTP"
}

# 2. Lambda integration
resource "aws_apigatewayv2_integration" "write" {
  api_id             = aws_apigatewayv2_api.reports.id
  integration_type   = "AWS_PROXY"
  integration_uri    = aws_lambda_function.write_report.invoke_arn
  payload_format_version = "2.0"
}

# 3. Route
resource "aws_apigatewayv2_route" "write" {
  api_id    = aws_apigatewayv2_api.reports.id
  route_key = "POST /reports"
  target    = "integrations/${aws_apigatewayv2_integration.write.id}"
}

# 4. EventBridge custom bus
resource "aws_cloudwatch_event_bus" "reports" {
  name = "reports-bus"
}

# 5. Rule: route published-status events to notify-slack Lambda
resource "aws_cloudwatch_event_rule" "published" {
  name           = "report-published"
  event_bus_name = aws_cloudwatch_event_bus.reports.name
  event_pattern  = jsonencode({
    source      = ["reports.api"]
    detail-type = ["ReportPublished"]
  })
}

resource "aws_cloudwatch_event_target" "slack" {
  rule           = aws_cloudwatch_event_rule.published.name
  event_bus_name = aws_cloudwatch_event_bus.reports.name
  arn            = aws_lambda_function.notify_slack.arn
}

Sketched, not complete (the IAM roles, permissions, Lambda functions, and EventBridge-to-Lambda permissions are omitted here). Chapter 12 builds a similar stack as a complete Terraform module.

Anti-patterns to avoid

Try it: inventory your account's serverless surface

aws lambda list-functions \
  --query 'Functions[].[FunctionName, Runtime, Architectures[0], MemorySize, Timeout]' \
  --output table

# Look for: x86_64 functions you could move to arm64,
# oversize MemorySize (most workloads are fine at 512 MB),
# Timeout=900 (the 15-min hard cap - usually means a Step Functions candidate)

# HTTP and WebSocket APIs
aws apigatewayv2 get-apis \
  --query 'Items[].[Name, ProtocolType, ApiEndpoint]' \
  --output table

# REST APIs (different SDK namespace, different price tier)
aws apigateway get-rest-apis \
  --query 'items[].[name, id, createdDate]' \
  --output table

# Any REST APIs you find are 3.5x more expensive than HTTP API equivalents.
# For each one, ask: does it actually use a REST-API-only feature?

aws stepfunctions list-state-machines \
  --query 'stateMachines[].[name, type, creationDate]' \
  --output table

# For each one, check the type:
#   STANDARD = $25/M transitions, 1-year max
#   EXPRESS  = $1/M + per-ms compute, 5-min max
# If you find STANDARD machines that finish in seconds and run millions of times,
# EXPRESS is usually 10-100x cheaper.

Quick check

Gotchas for Azure devs

Project Compass: expose the query API

Picking up from chapter 10 where the worker moved to EKS via IRSA. The reports table already exists (chapter 6). Now we expose a query API: GET /reports/{report_id} backed by a small Lambda that reads from DynamoDB. We deliberately pick HTTP API over REST API (saving 3.5x cost), and use AWS_IAM authorization since the API is internal-only - callers from inside NVIDIA sign requests with their IAM credentials.

import json, os
import boto3

ddb = boto3.resource("dynamodb").Table(os.environ["TABLE"])

def handler(event, _context):
    report_id = event["pathParameters"]["report_id"]
    item = ddb.get_item(Key={"report_id": report_id}).get("Item")
    if not item:
        return {"statusCode": 404, "body": json.dumps({"error": "not found"})}
    return {"statusCode": 200, "body": json.dumps(item, default=str)}

# Package and create
zip handler.zip handler.py

aws lambda create-function \
  --function-name gfn-reports-query \
  --runtime python3.12 \
  --architectures arm64 \
  --role arn:aws:iam::111111111111:role/gfn-reports-role \
  --handler handler.handler \
  --zip-file fileb://handler.zip \
  --environment 'Variables={TABLE=gfn-reports}' \
  --memory-size 256 \
  --timeout 5 \
  --profile compass

# 1. Create the HTTP API ($1/M, not $3.50/M)
API_ID=$(aws apigatewayv2 create-api \
  --name gfn-reports-api \
  --protocol-type HTTP \
  --target arn:aws:lambda:us-east-1:111111111111:function:gfn-reports-query \
  --query ApiId --output text --profile compass)

# 2. Update the auto-created route to require AWS_IAM
ROUTE_ID=$(aws apigatewayv2 get-routes --api-id $API_ID \
  --query 'Items[0].RouteId' --output text --profile compass)

aws apigatewayv2 update-route \
  --api-id $API_ID --route-id $ROUTE_ID \
  --route-key "GET /reports/{report_id}" \
  --authorization-type AWS_IAM \
  --profile compass

# 3. Allow API Gateway to invoke the Lambda
aws lambda add-permission \
  --function-name gfn-reports-query \
  --statement-id apigw-invoke \
  --action lambda:InvokeFunction \
  --principal apigateway.amazonaws.com \
  --source-arn "arn:aws:execute-api:us-east-1:111111111111:$API_ID/*" \
  --profile compass

# 4. Note the endpoint URL
aws apigatewayv2 get-api --api-id $API_ID \
  --query ApiEndpoint --output text --profile compass

# IAM-authed endpoints need SigV4 signing - curl alone won't work.
# Use awscurl (pip install awscurl) or the AWS SDK in any language.

awscurl --service execute-api \
  --region us-east-1 \
  --profile compass \
  "https://${API_ID}.execute-api.us-east-1.amazonaws.com/reports/r-12345"

# Expected: {"report_id": "r-12345", "status": "published", ...}
# Unauthed plain curl would get: {"message":"Missing Authentication Token"}

resource "aws_lambda_function" "query" {
  function_name    = "gfn-reports-query"
  role             = aws_iam_role.compass.arn
  handler          = "handler.handler"
  runtime          = "python3.12"
  architectures    = ["arm64"]
  filename         = "build/handler.zip"
  source_code_hash = filebase64sha256("build/handler.zip")
  memory_size      = 256
  timeout          = 5

  environment {
    variables = { TABLE = "gfn-reports" }
  }
}

resource "aws_apigatewayv2_api" "reports" {
  name          = "gfn-reports-api"
  protocol_type = "HTTP"
}

resource "aws_apigatewayv2_integration" "query" {
  api_id                 = aws_apigatewayv2_api.reports.id
  integration_type       = "AWS_PROXY"
  integration_uri        = aws_lambda_function.query.invoke_arn
  payload_format_version = "2.0"
}

resource "aws_apigatewayv2_route" "get_report" {
  api_id             = aws_apigatewayv2_api.reports.id
  route_key          = "GET /reports/{report_id}"
  target             = "integrations/${aws_apigatewayv2_integration.query.id}"
  authorization_type = "AWS_IAM"   # internal only - callers sign with SigV4
}

resource "aws_apigatewayv2_stage" "default" {
  api_id      = aws_apigatewayv2_api.reports.id
  name        = "$default"
  auto_deploy = true
}

resource "aws_lambda_permission" "apigw" {
  statement_id  = "apigw-invoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.query.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_apigatewayv2_api.reports.execution_arn}/*"
}

output "api_endpoint" {
  value = aws_apigatewayv2_api.reports.api_endpoint
}

Recap & next

What stuck?

• Lambda has three concurrency knobs: on-demand (default), provisioned (pre-warm N copies, costs hourly), reserved (cap, free, protects downstream).
• ARM/Graviton2 is a 20% discount with one line of config. Default architecture for new functions unless you have native x86 deps.
• API Gateway has three SKUs. HTTP API is the modern default at $1/M. REST API is 3.5x at $3.50/M, justified only for specific features. WebSocket is its own price model.
• Step Functions Standard is for long, audited flows. Express is for short, high-volume flows. Pick by duration (5-min vs 1-year) and throughput (state-transition price vs ms price).
• DynamoDB Streams give you ordered, per-partition change events. EventBridge gives you unordered, rule-filtered fan-out. Choose by whether ordering matters.
• The end-to-end pattern is API GW → Lambda (write) → DynamoDB + EventBridge fan-out → downstream Lambdas. Or Step Functions if the downstream is a sequenced workflow.
• Anti-patterns kill bills: sync Lambda-to-Lambda, monolithic functions, recursive S3 triggers, putting Lambda in a VPC without need, picking REST API by default.

The mental model in one sentence

Common pitfalls so far