Building Scalable and Secure Serverless Applications with CyberArk and Amazon EFS

Building Scalable and Secure Serverless Applications with CyberArk and Amazon EFS

Introduction:
In today's digital landscape, organizations are increasingly adopting serverless architectures to build scalable and cost-effective applications. This article explores how CyberArk, a leading cybersecurity company, leverages Amazon Web Services (AWS) to build a tenant management service for its Software-as-a-Service (SaaS) offering. Additionally, we'll delve into the benefits of using Amazon Elastic File System (EFS) for AWS Lambda in serverless applications.

Tenant Management with CyberArk and AWS:
CyberArk's tenant creation process involves several steps that ensure secure and efficient management of customer accounts. The process begins with a delivery team member authenticating to CyberArk's identity provider (IdP) and receiving a JSON Web Token (JWT) with relevant permissions. The team member then utilizes the Amazon API Gateway REST API to create the tenant, specifying configuration details such as admin contact information, AWS region, and business services to be created.

To handle the tenant creation request, the API Gateway triggers a Lambda function known as the "create" handler. This function validates the request's authentication and authorization using the team member's JWT claims. Upon successful validation, the "create" handler generates a unique tenant ID, stores the tenant configuration details in an Amazon DynamoDB table, and sets the tenant status as "create in progress." The handler returns an HTTP 201 code to indicate a successful tenant creation.

The DynamoDB table's update triggers a separate AWS Lambda function called the "dispatcher." This function parses the DynamoDB Streams record, retrieves the event action (in this case, "create tenant"), and invokes the tenant management Orchestration logical unit with the event details. The Orchestration logical unit utilizes AWS Step Functions, a visual workflow service, to coordinate the necessary tasks for tenant creation, ensuring a seamless and consistent experience.

Benefits of Amazon EFS for AWS Lambda:
Serverless applications rely on ephemeral compute functions for event-driven integration and data transformation. While AWS Lambda provides a temporary file system, it is not designed for durable storage. This is where Amazon EFS comes into play. Amazon EFS is a fully managed, elastic, and shared file system that seamlessly integrates with Lambda, enabling data sharing across function invocations.

By leveraging EFS for Lambda, developers can read large reference data files, write function output to a persistent and shared store, and easily share data across invocations. This eliminates the need for complex workarounds or external storage solutions. EFS scales on-demand and automatically handles file growth and deletion, making it suitable for applications that require large or dynamic datasets.

Furthermore, EFS offers two performance modes: general purpose and MaxIO. For most Lambda workloads, the general-purpose mode provides the necessary performance with lower operational latency. The EFS file system is shared across Lambda functions, allowing multiple instances to access and modify data concurrently. With support for up to 25,000 concurrent connections, EFS scales seamlessly with Lambda functions.

Implementing EFS for Lambda in Serverless Applications:
To utilize Amazon EFS in a serverless application, the Lambda function instances must have access to the same security group and reside in the same Virtual Private Cloud (VPC) as the EFS file system. After establishing the necessary connectivity, the EFS mount target is mounted to a directory within the Lambda function's runtime environment. This allows seamless access to data stored in the EFS file system.

One of the significant advantages of EFS for Lambda is its dynamic binding. Any changes or upgrades made to packages or files in the EFS file system are immediately available to the Lambda function during the execution environment preparation. This enables developers to streamline their build processes and consume new versions of builds in real-time, enhancing agility and productivity.

Conclusion:
In conclusion, CyberArk's tenant management service and the utilization of Amazon EFS for AWS Lambda highlight the power and versatility of serverless architectures. By leveraging AWS services such as API Gateway, Lambda, DynamoDB, and EFS, organizations can build scalable and secure applications that meet the demands of modern enterprises. To maximize the benefits of these technologies, consider the following actionable advice:

1. Implement robust identity and access management (IAM) policies to ensure secure authentication and authorization during the tenant creation process.
2. Leverage AWS Step Functions to orchestrate complex workflows and automate processes in your serverless applications.
3. Explore the capabilities of Amazon EFS for Lambda to enable seamless data sharing, persistent storage, and efficient access to large reference data files.

By adopting these recommendations, businesses can unlock the full potential of serverless architectures and accelerate their digital transformation journey.