Using Relational Databases with AWS Lambda - Easy Connection Pooling - AWS Online Tech Talks

hi everyone and welcome to today's webinar we're gonna be talking about database connections and how one of our newest features called Amazon RDS proxy makes it really easy to scale your database connections from lambda to your relational databases just for quick introductions my name is George Mao and I'm a principal service specialist with AWS here's all of my contact information so feel free to reach out to us if you have any questions or if we can help you with any of these services I'm responsible for helping customers about the server this platform and I work with customers a lot on services like lambda API gateway step functions and also dynamodb I'm also a Virginia Tech hokey so if there any Hokies out in there in the field please feel free to let us know in the chat so we're here today and thank you for joining us I'm really excited that you're here we have multiple moderators in the chat so feel free to ask us questions during the talk and then we'll also leave some time for Q&A at the end so to kick it off I want to introduce Amazon RDS which is our relational database service RDS is our manage relational database service and it makes it really easy for you to deploy a relational databases because we handle all of the hard details about database administration all the scaling means and all the high availability that you need to have for databases relational databases are difficult to manage typically because you have to manage all the hardware all the operating systems and sometimes that the monitoring that has to go behind the scenes an RDS does all of that on your behalf leaving you more time to work with your data and interact with your database instead of managing all of these hard details RDS makes it really simple to scale because we have built-in mechanisms for adding scaling mechanisms and we also have built in high durability when we have the option to deploy your databases across multiple availability zones make it really easy you create a backup and snapshot your databases with minimal or no downtime at all RDS also has multiple different security mechanisms and options and you can use to protect your data at rest or in transit so in today's world applications need to connect to databases and these connections every time you open a connection will consume memory and compute resources on your database when you do that that actually leaves less compute power to execute your queries and oftentimes serverless applications running on AWS lambda functions can open tens and thousands of connections all within seconds when that happens your relational database is typically exhaust their memory and compute power leaving you with slower database response times for your end customers so developers like us typically work through two different solutions to help us with this the first solution is to build a self managed proxy and when you build a self managed proxy the goal is to really reduce the number of database connections to your database by using multiple connection pools the other solution is to build in application logic directly to your lambda functions that handle all of the retry logic and all the failures that could happen when you have database exhaustion on connections you also have to build in all of the details to handle all of the security and database credentials when you do that both of these solutions are pretty tough to manage and it's really time consuming and it takes time away from actually building the logic that makes our businesses unique so here's an example when your application can live on any computer platform so that could be a service application running on AWS lambda or it could be applications deploy to Amazon ec2 instances or finally you could have your applications containerized and running on Amazon Elastic container service when your application is small it makes relatively few connections to sequel to your sequel databases and that's okay but when you receive a large influx of traffic maybe even in response to a large event such as a sales promotion or maybe a breaking news event has just happened the application will make more and more sequel calls to your database so when that happens your database needs to dedicate memory and keep power to manage all of these extra connections leaving you with less power to execute your sequel queries developers will typically try to fix this problem by off offloading as many calls to the database as possible so we introduce things like in-memory caching so an example is using Amazon ElastiCache when you do this you typically serve as many requests as possible out of your cache instead of making requests to your database but when we do need to hit the database because of cache exploration we typically try to leverage existing connection pools to our database that way all of our connections can execute quickly and use less memory and compute power on our databases now this is all pretty difficult to manage requires a lot of developer resource and time we now have a new feature called Amazon RDS proxy RDS proxy is currently in preview so you're all welcome to test it out and we encourage you to try it out and let us know what your feedback is but remember don't run this in production just yet so ideas products see is a fully managed highly available database proxy for Amazon RDS it makes your applications more secure and easily scalable because it manages a warm connection pool on your behalf many applications using our modern days serverless architectures using AWS Landa have to open hundreds and thousands of connections maybe all within just seconds and this can this can easily exhaust your resources on your database so by using warm connection pools we increase the efficiency of your database and require less compute power but RDS proxy also improves your database availability and scalability so to do that we manage a connection pool under behalf and but the audience proxy also scales in response to this to the traffic and the low that you're putting on the proxy itself next the RDS proxy also makes it a lot more secure to talk to your databases because instead of hard-coding your database credential directly in your application code you can leverage AWS secrets manager and then the secrets manager service will handle all of the the secure details about your connectivity and finally the RTS proxy is a fully managed proxy and it's compatible with multiple different flavors of databases so let's take a look at that today the proxy RTS proxy is available in all of these different regions Tokyo Ireland Northern Virginia Ohio and Oregon we currently support the my sequel flavor of RDS during the preview and will continue to add more or flavors or databases in the next coming months Postgres is going to be added very very soon so the RDS proxy is an application service that sits between your application and an RDS database the built in connection pool feature abstracts away the complexities that you have to do to do connection management on your land of functions themselves this makes it really simple to write your land functions because you no longer have to write all of this application logic and retry logic built it directly into your code you have your lambda functions can specifically just focus on the services and the functionality of the providing instead of all of the hard details about managing a connection to your database RDS proxy also makes it a lot more scalable because when you create lots of connections from land of functions RDS proxy has a connection multiplexing feature that uses warm connection pools and opens less connections to your RDS instances the RDS proxy will store your database credentials in AWS secrets manager and then this will make your applications a lot more secure because you don't have to hard code any of those username and passwords directly in your lambda functions additionally you can require that your land of functions or your applications connect to the RDS proxy using secure TLS connections even if your back-end database doesn't support that so as a developer you have two options for security your first option is to use native database credentials to connect your RDS proxy and when you do that you connect your artiest proxy at the exact same way you connect to your database today the only change you to make is you're gonna change your application code to talk to the RDS proxy endpoint rather than connecting directly to your back-end database you don't have to include any libraries and there's no proprietary SDKs that you have to use to talk to the audience proxy option 2 is using iam authorization to connect to a database so in this method your code never stores any secret information in your in your applications instead you make a query or make an sdk call to the IAM service and the IM service will provide a one-time token that your application code would use to authenticate to the Amazon RDS proxy and eventually into your database so a key point here is a keep in mind that you as a developer have full control over whether you want to use native database credentials or if you want to take advantage of the Amazon iam token service to provide authentication to your database on top of that you can choose whether or not you want to have secure TLS connections to your database even without direct support from your back-end database so let's jump into a demo and see how this works so on my screen is the Amazon RDS console dashboard so on the left here we can see there's going to be a new menu option called proxies so if we click into proxies you'll see a pane that lists all of the available proxies you currently have provisioned as we can see I have one proxy that is provisioned and it's called my DB proxy so to create a new proxy I just need to click this orange button called create proxy and the first thing I have to provide is a proxy name so I'll just provide a name my DB proxy - new and as we can see here we currently support the my sequel engine during the RDS proxy preview but we'll be adding support for other various flavors of RDS pretty soon so here's an option where you can require that applications connect to the artist proxy using TLS and you can do this even if your back-end database doesn't support that and that rule enhances your overall security posture there's a couple options for how long you want your applications you to connect your audience proxy before we time them out we'll just leave this at a default of 30 minutes and then we'll scroll down a little bit the next option here is for you to configure which database this proxy will talk to so I already have a database deployed and that database is just called database 1 and it's an Aurora on my sequel flavor so I'll click that and now you have the option to configure how many connections you're going to allow the RDS proxy service to make to your database and those connections are specified in terms of a percentage so this percentage is determined based off of the max connections that your database will allow so in this case if I allow 100% the RDS proxy will create and use all available connections on my database if my database allows 100 connections then this will create up to 100 connections I can reduce this to 50% if I only want my database to use 50 of those 100 connections but we'll leave this at 100% for now I'll scroll down a little more this is where we have to provide the secrets manager secrets in order for our do as proxy to create the secure connection to my back-end database I already have a couple secrets created and we'll just use this one my DB secret and then you have to specify an IM role which allows RDS proxy to access this secret so if you already have a role that can access this secret you can choose them but if not you can choose create iam role and this will create that role on your behalf and finally here is where you specify the security option that we just talked about you can choose to connect using your native database credentials or you can choose to have the M is an RDS proxies service only except I am at n occation so we'll do that here and you option which is defaulted for you is going to be choosing which subnets you already as proxy will belong in so this is typically going to be the same subnets that your database service is currently living in by default Auggie logging is enabled so will enable logging and leave this setting as is and then this last box here is just some terms for the private release a preview release so I'll check this box here I'll create my proxy by clicking this orange button on the bottom and this process will generally take three to five minutes so when that's happening you'll see the status sitting in creating so instead of waiting for that I already have a proxy that's created so we'll click into this and look at some of the details my DB proxy so when I click into this I can see a couple things the most important piece here is the proxy endpoint so Amazon RDS proxy will create an endpoint that your application means the target so here is the endpoint that my application will be using my DB proxy and then dot proxy - and then the unique identifier for my service there's a couple options here that we just looked at I use the default 30-minute connection timeout we're currently talking to the my sequel engine and then I also have the service TLS enabled so if we scroll down a little more we can see that this is this proxy service is associated with my database - one and then it's currently allowed to use two different secrets so if I go over to my secrets manager dashboard we can see that I already have the secret created and if I were to retrieve secret value I would see a key value pair for username and password so this is going to be my secret information that artiest proxy will use to create my sequel connections so if we keep if we look at the I am role that my service were used to access those secrets that's RDS proxy role and then - all of these numbers if I go over to the iam console and take a look at this role RTS proxy role and if I open the policy name we can see that this policy provides this role the ability to get secret value for my secret so that's all that's needed at this point I'm pretty much ready to make connections to this to this RTS proxy and it's already created a warm connection pool to my database service so for this example we're going to be using a server list lambda function so I have a lambda function created and this is the lambda function dashboard my function name is just my RDS test and I'm going to be connecting to the RDS proxy that we just created and I'm actually using IMF indication so when I click test here this is executing a sequel call and if we look at my lambda logs I can see that we're starting the query we're obtaining my I am token we're connected and then we're just doing a select all out of my contacts table so this is just echoing a single result with my email first name and last name so we jump into our code a little bit and see how this works the first thing I have to do is hit the RDS signer service passing in the host name for my RDS proxy and then I provide a username of admin and then this returns a token and this is the token that I'll use in replacement of my password for this user and then I make my sequel connection using the connection that Connect API call from nodejs and then I'm making a simple select star from contacts and then I'm at going all the results right back to the console and at the very end I just do a connection dot end so as you can see here there's no hard coded information for database credentials and this makes it really secure and really scalable because if I were to run this function multiple times it would take advantage of the warm connection pool that the RDS service proxy service is already so I'll just run this couple times and as we can see here the execution duration is fairly short looking at about 120 milliseconds for this last execution so the next question is how do you monitor a proxy the audience proxies service is automatically integrated with the cloud watch service so we provide multiple different metrics and multiple cloud watch logs that you can use to review how all this works so flipping back to my presentation let's take a look at how to monitor and RDS proxy instance out-of-the-box we provide multiple different cloud watch metrics and logs so a couple of the most useful metrics are going to be client connections query connections and database connections client connections just gives us information about how many clients are connecting to the proxy and in query request is how many queries are submitted through the RDS proxy and it finally database connections is how many connections my RDS proxy service is making to my back-end database we also have built-in logging so you can go directly to cloud watch logs and look up the logs inside the namespace with AWS RDS proxy followed by the name of your proxy so let's take a look at an example of how the cloud watch metrics look here's a screen shot but on the top is the metric for how many connections my RDS proxy is making to my back-end database and I can see there's a very stable eight connections being made to my back-end database at all times on the second screenshot I've made of multiple connections using AWS lambda to the proxy service and we can see here in green is a number of queries are being made so we made 42 queries and then in blue we can see the number of client connections being made so over 16 different connections we've submitted 42 queries to the proxy service however the database connections are fairly stable at 8 so what this means is as your applications scale and grow bigger and bigger the audience practice service will use multiplexing so that it doesn't need to create more connections and consume more power on your databases so finally I wanted to leave you with a couple of guides for getting started please feel free to check out our blog here we have a full walkthrough of how you can create your proxy service and take advantage of an Atlanta function there's some application code out there that you can use to test the service yourself and then at the bottom is a link aws.amazon.com slash already has proxy this is our full documentation and you can review the user guide as well as the API material for SDKs and Cl lives thank you for your time and we open up for Q&A