Hydra: AWS Lambda Support?

[waynerobinson]

With the introduction of Go support in AWS, I wonder how complex it would be to setup Hydra to operate directly in Lambda?

Resilience of an auth service is pretty important, and Lambda gives you a lot of the underlying infrastructure stuff for free.

https://aws.amazon.com/about-aws/whats-new/2018/01/aws-lambda-supports-go/

[aeneasr]

Unfortunately very complex, lambdas are quite different to the way stdlib net/http works :(

[waynerobinson]

Looks like something that might be solvable by a relatively simple method proxy: http://artem.krylysov.com/blog/2018/01/18/porting-go-web-applications-to-aws-lambda/

[aeneasr]

I think it could be possible, on the same time it's locking this project into AWS, and the feature would not benefit other platforms. I'm unfortunately not too thrilled for this (sorry), but would be open to review some third-party project taking a look at this.

[aeneasr]

I'm closing this issue because we will, most likely, not offer an official adapter for AWS Lambdas for now. This doesn't mean that it's discouraged to give it a try for yourself (and potentially accepting it in a PR), but primarily at cleaning up stale issues.

[GRoguelon]

Hi @arekkas,

I know you excluded the AWS Lambda previously in the conversation.

Just to inform there is an easy way to get the AWS Lambda support to an existing API by using this project: https://github.com/awslabs/aws-lambda-go-api-proxy

Hydra already uses something pretty standard: a http.Handler.

For instance:

package main

import (
    "log"
    "os"

    "github.com/aws/aws-lambda-go/events"
    "github.com/aws/aws-lambda-go/lambda"
    "github.com/awslabs/aws-lambda-go-api-proxy/handlerfunc"
    "github.com/ory/hydra/cmd"
    "github.com/ory/hydra/cmd/server"
    "github.com/pkg/profile"
)

var initialized = false
var handlerfuncLambda *handlerfunc.HandlerFuncAdapter

func Handler(req events.APIGatewayProxyRequest) (events.APIGatewayProxyResponse, error) {
    if os.Getenv("PROFILING") == "cpu" {
        defer profile.Start(profile.CPUProfile).Stop()
    } else if os.Getenv("PROFILING") == "memory" {
        defer profile.Start(profile.MemProfile).Stop()
    }

    cmd.Execute()

    if !initialized {
        // stdout and stderr are sent to AWS CloudWatch Logs
        log.Printf("Handler function cold start")

        handlerfuncLambda = handlerfunc.New(server.HttpHandler.ServeHTTP)
        initialized = true
    }

    // If no name is provided in the HTTP request body, throw an error
    return handlerfuncLambda.Proxy(req)
}

func main() {
    lambda.Start(Handler)
}

In the code, we just need a way to keep a reference on https://github.com/ory/hydra/blob/master/cmd/server/handler.go#L117, I did by keeping a refence on corsHandler: HttpHandler = corsHandler (dirty way).

It's just a quick implemantation without any tests. I will try to make it cleaner, let me know if you are interested to keep an eye on it.

Thank you

[aeneasr]

That looks pretty reasonable from a code-perspective. Is it maybe possible to implement this gateway on a network level? For example it accepting requests from AWS Lambda and forwarding it to Hydra like a reverse proxy? It would IMO make more sense here, because we don't have an explicit dependency on a vendor's closed source platform. I have literally never worked with AWS Lambda, so excuse my ignorance here ;)

[allcloud-jonathan]

I guess the idea would be to not have a permanent running Hydra container but have it run completely Serverless on Lambda. There is no benefit in having lambda act as a reverse proxy calling out to a running Hydra container