Hacker News Reader

Comment by manishsharan | Hacker News Reader

Is there a use case for AWS API Gateway if one is not using Lambda ? Can it protect a web application against DDOS ?

I am not convinced API gateway+ Lambda can substitute for a Web Application , atleast for J2EE apps. The Lambda "boot" time is way too high unless we resort to tricks to keep the lambda instance active. I find the extra $30 or similar is well spent on a a AWS Elastic Beanstalk with auto scaling. The packaging and deployment is cleaner and simpler.

View on HN

Yes, you can use API Gateway without lambda. "API Gateway" is an industry term and not specific to Amazon. The point is exactly your line of reasoning, a funnel/gateway to your APIs. You can handle Auth, Throttling, etc at that point. AWS does provide other products for use against DDOS, WAF, Shield. ELB, Cloudfront, VPCs/SG. Their idea is to be able to scale, deflect if possible and absorb the attack. They also mention that with AWS API Gateway you can get Layer & & 3 DDOS protection and throttling for your backend. I've no practical experience nor have read any reports on how it holds up.

Might AWS Lambda behind AWS API Gateway (with caching, burst and rate limiting, custom authorizers) behind AWS CloudFront behind AWS WAF and/or CloudFlare work for you?

What is your issue with keeping Lambda instance alive? They mostly stay in standby mode some minutes to keep listening for requests and then it will shutdown whether staying idle - what means next request will boot a Lambda function (container?; It usually takes ~1 second), after that time to receive response is approx. ~100ms.

After seriously kicking the tires on aws serverless, I still prefer running vm's as you do. Beanstalk is awesome, I like Heroku too. Other than the db, not too hard a move to beanstalk if it gets popular.

The cold starts are really bad for the 95th percentile latency, and you can't use a relational db with decent performance and throughput until aurora serverless rolls out.

It provides a fixed contract to the outside world that is independent of your code-level infrastructure so both parties(provider and consumer) are required to conform to it as an integration. In that sense I find it a compelling thing.

Reply on news.ycombinator.com