AWS Lambda Under the Hood

AWS Lambda Under the Hood

Lambda Architecture

  • Lambda is a serverless computer system that allows users to execute code on demand without managing servers.
  • Lambda supports synchronous and asynchronous invocation models.
  • Lambda's tenets include availability, efficiency, scale, security, and performance.

Invocation and Execution

  • Invoke request routing connects microservices and provides availability, scale, and execution access.
  • Worker manager reuses previously created sandboxes to reduce initialization latency.
  • Assignment service replaced worker manager to provide reliable distributed and durable storage for sandbox states.
  • The introduction of a new node allows for easy rebuilding of the state from the log, significantly increasing system availability and making it fully tolerant to single host failures and availability zone events.
  • The distributed consistent sandbox state is implemented regionally, and a leader-follower architecture is applied for quick failovers.

Compute Fabric

  • Compute fabric owns all the infrastructure required to run code, including worker fleets, capacity manager, placement, and data science team for smart decision-making.
  • Rust was used to rewrite the new service, increasing efficiency and performance of every host, improving processing volume, and reducing overhead latency.

Isolation and Security

  • Data isolation is crucial to prevent interference between different functions running on the same worker.
  • Virtual machine isolation provides sufficient guarantees to run arbitrary code in a multi-tenant computer system.
  • Firecracker is a fast virtualization technology specifically designed for serverless compute needs, allowing multiplexing of thousands of functions from different customers on the same worker with consistent performance.
  • Firecracker provides strong isolation boundaries, is very fast with little system overhead, and enables decorrelation of demand to resources for better control of worker fleet heat.
  • A custom indirection layer enforces strict copy-on-read to eliminate shared memory and prevent security threats in a multi-tenant execution environment.
  • Introduced a callback interface to restore uniqueness of code after resuming multiple VMs from the same snapshot.

Performance Optimization

  • Snapshotting is used to reduce the cost of creating new execution environments by resuming VMs from snapshots instead of initializing them from scratch.
  • Implemented on-demand chunk loading to reduce snapshot distribution time and improve performance.
  • Utilized convergent encryption to deduplicate common chunks across container images and increase cache locality.
  • Addressed the issue of inefficient memory access by recording page access patterns and optimizing snapshot loading.
  • Enabled Lambda snapshot on Java functions for users to experience VM snapshot functionality.

Additional Information

  • Firecracker uses a distributed cache in multiple availability zones to maintain a coherent cache of the configuration database, making lookups faster.
  • The speaker is open to discussing how Lambda functions can be built in a company's own data center during a follow-up talk.
  • The same techniques used in Firecracker could be used to make EBS snapshots faster, but it would require more work due to the complexity of hardware and virtualization layers.
  • Different services communicate with each other using a mixture of synchronous request-response communication and GPC and HTTP2 streams, depending on the requirements of the particular communication.
  • Firecracker uses metal instances because they meet the requirements of the system, while nested virtualization would be much slower.
  • During Lambda function updates, the previous function version is used until the snapshot of the updated function is finished, at which point the system switches to the latest version.
  • The engineering process balances security, efficiency, and latency, with security being the top priority.

Overwhelmed by Endless Content?