search

awslabs / ssosync

Populate AWS SSO directly with your G Suite users and groups using either a CLI or AWS Lambda
Apache License 2.0
512 stars 175 forks source link

Set Concurrency Limit to 1 in CloudFormation Stack #206

Closed CarlosCuevas closed 2 months ago

CarlosCuevas commented 2 months ago

Is your feature request related to a problem? Please describe. It's possible to have several instances of the lambda function simultaneously. This could lead to race conditions. I can't imagine any scenario where someone would want multiple executions of the lambda function simultaneously.

Describe the solution you'd like Set ~Reserve~ Concurrency Limit to 1 for the Lambda function within the CloudFormation Stack/AWS Serverless App Repo.

sdemjanenko commented 2 months ago

Wouldn't that incur costs when the lambda isn't actually executing? Is the problem an issue of locking (where one lambda execution is still running while another execution tries to start)? That could be solved by a locking structure in dynamo DB or potentially with step functions.

ChrisPates commented 2 months ago

This would be best practice approach https://aws.amazon.com/about-aws/whats-new/2017/11/set-concurrency-limits-on-individual-aws-lambda-functions/ https://aws.amazon.com/about-aws/whats-new/2017/11/set-concurrency-limits-on-individual-aws-lambda-functions/

I t would be modest effort to implement, however it is unlikely to be necessary, in all be very specific combination of circumstances.

Chris

CarlosCuevas commented 2 months ago

Wouldn't that incur costs when the lambda isn't actually executing? Is the problem an issue of locking (where one lambda execution is still running while another execution tries to start)?

~Yes, sorry. I may have misunderstood what I read.~ The goal is to block execution while another is in progress.

I t would be modest effort to implement, however it is unlikely to be necessary, in all be very specific combination of circumstances.

We have the lambda function running every x minutes. Every so often an execution will exceed the x number of minutes and there will be > 1 running simultaneously.

Alternatively, we were considering having executions be triggered by changes in Google Workspace (as opposed to being timer based), but that runs the risk of triggering multiple if one is already in progress. Not being able to configure or limit It felt like a footgun.

CarlosCuevas commented 2 months ago

Wouldn't that incur costs when the lambda isn't actually executing?

per https://docs.aws.amazon.com/lambda/latest/dg/provisioned-concurrency.html

Reserved concurrency – This represents the maximum number of concurrent instances allocated to your function. When a function has reserved concurrency, no other function can use that concurrency. Reserved concurrency is useful for ensuring that your most critical functions always have enough concurrency to handle incoming requests. Configuring reserved concurrency for a function incurs no additional charges.

ChrisPates commented 2 months ago

The naming of these properties can be some what confusing.