AWS Lambda Advanced Patterns ve Maliyet Optimizasyonu: Kapsamlı Production Rehberi

// Layer 1: Ağır, nadiren değişen dependency'ler
// Layer'da /opt/nodejs/package.json
{
  "dependencies": {
    "@aws-sdk/client-dynamodb": "^3.400.0",
    "datadog-lambda-js": "^8.67.0",
    "pino": "^8.15.0"
  }
}

// Function kodu layer dependency'lerini kullanır
import { DynamoDBClient } from '@aws-sdk/client-dynamodb'; // Layer'dan
import { datadogLambda } from 'datadog-lambda-js';         // Layer'dan
import pino from 'pino';                                   // Layer'dan

// Function'a özel kod (layer'da değil)
import { validateUserInput } from './validation';          // Function'a özel
import { processPayment } from './payment';                // Function'a özel

# Layer yönetimi için CDK stack
export class SharedLayerStack extends Stack {
  constructor(scope: Construct, id: string, props: StackProps) {
    super(scope, id, props);

    // Layer'lar için semantic versioning
    const monitoringLayer = new LayerVersion(this, 'MonitoringLayer', {
      code: Code.fromAsset('layers/monitoring'),
      compatibleRuntimes: [Runtime.NODEJS_18_X],
      description: `Monitoring Layer v2.1.0 - ${new Date().toISOString()}`,
      layerVersionName: 'monitoring-layer-v2-1-0'
    });

    // Cross-stack kullanım için ARN export et
    new CfnOutput(this, 'MonitoringLayerArn', {
      value: monitoringLayer.layerVersionArn,
      exportName: 'MonitoringLayerV2-1-0'
    });
  }
}

# Cold start etkisi (1000+ invocation'da ölçülen)
Layer yok:                   Ortalama: 847ms
1 layer (35MB monitoring):   Ortalama: 923ms   (+%9)
2 layer (toplam 60MB):       Ortalama: 1247ms  (+%47)
3+ layer (80MB+ toplam):     Ortalama: 2100ms+ (+%148)

# Anahtar içgörü: Layer sayısı toplam boyuttan daha önemli

// VPC'siz Lambda (DynamoDB'ye internet üzerinden erişim)
// Cold start: ~800ms
// Warm execution: ~45ms
// Maliyet: $0.0001 per 100ms

// VPC Lambda (private subnet'teki RDS'e erişim)  
// Cold start: ~12-15 saniye (ENI oluşturma)
// Warm execution: ~45ms (aynı)
// Maliyet: $0.0001 per 100ms + VPC endpoint maliyetleri

# Lambda için optimize edilmiş CDK VPC kurulumu
VpcConfig:
  SecurityGroupIds:
    - !Ref LambdaSecurityGroup
  SubnetIds:
    - !Ref PrivateSubnet1
    - !Ref PrivateSubnet2
    # Anahtar: Farklı AZ'lerde birden fazla subnet kullan

# Minimal gerekli erişimli security group
LambdaSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: Lambda function security group
    VpcId: !Ref Vpc
    SecurityGroupEgress:
      # Sadece kesinlikle gerekli olanlar
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        CidrIp: 10.0.0.0/16  # Sadece database subnet'i
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0    # AWS API çağrıları için HTTPS

// Function warmth ile ENI optimizasyonu
const keepWarmSchedule = new Rule(this, 'KeepVpcLambdaWarm', {
  schedule: Schedule.rate(Duration.minutes(5)),
  targets: [new LambdaFunction(vpcLambdaFunction, {
    event: RuleTargetInput.fromObject({ 
      source: 'keep-warm',
      warmup: true 
    })
  })]
});

// VPC function'ları için handler optimizasyonu
export const handler = async (event: any) => {
  // Warmup event'lerini handle et
  if (event.source === 'keep-warm') {
    return { statusCode: 200, body: 'Staying warm' };
  }
  
  // Asıl mantığın
  return processBusinessLogic(event);
};

// Cross-account erişim için assume role pattern'i
import { STSClient, AssumeRoleCommand } from '@aws-sdk/client-sts';

export class CrossAccountExecutor {
  private stsClient: STSClient;
  
  constructor() {
    this.stsClient = new STSClient({});
  }

  async executeInAccount(
    accountId: string, 
    roleName: string, 
    action: () => Promise<any>
  ) {
    const roleArn = `arn:aws:iam::${accountId}:role/${roleName}`;
    
    try {
      const assumeRoleCommand = new AssumeRoleCommand({
        RoleArn: roleArn,
        RoleSessionName: `lambda-cross-account-${Date.now()}`,
        DurationSeconds: 3600
      });
      
      const response = await this.stsClient.send(assumeRoleCommand);
      
      // Geçici credential'lar oluştur
      const tempCredentials = {
        accessKeyId: response.Credentials!.AccessKeyId!,
        secretAccessKey: response.Credentials!.SecretAccessKey!,
        sessionToken: response.Credentials!.SessionToken!
      };
      
      // Action'ı geçici credential'larla execute et
      return await action();
      
    } catch (error) {
      console.error(`Cross-account execution başarısız:`, error);
      throw error;
    }
  }
}

# Cross-account Lambda execution için IAM role
CrossAccountExecutionRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: CrossAccountLambdaRole
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            AWS: 
              - arn:aws:iam::ACCOUNT-A:role/LambdaExecutionRole
              - arn:aws:iam::ACCOUNT-B:role/LambdaExecutionRole
          Action: sts:AssumeRole
          Condition:
            StringEquals:
              'sts:ExternalId': 'unique-external-id-2024'
    ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
    Policies:
      - PolicyName: CrossAccountAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Action:
                - dynamodb:GetItem
                - dynamodb:PutItem
                - s3:GetObject
                - s3:PutObject
              Resource:
                - arn:aws:dynamodb:*:*:table/shared-*
                - arn:aws:s3:::shared-bucket/*

# GitHub Actions workflow
name: Lambda Security Scan
on:
  push:
    paths: 
      - 'lambda/**'
      - 'package*.json'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Node.js Security Audit
        run: |
          npm audit --audit-level moderate
          npm audit fix --dry-run
          
      - name: Dependency Vulnerability Scan
        uses: securecodewarrior/github-action-add-sarif@v1
        with:
          sarif-file: 'security-scan-results.sarif'
          
      - name: Check for Secrets
        uses: trufflesecurity/trufflehog@v3.34.0
        with:
          path: ./
          base: main
          head: HEAD

// Güvenli environment variable handling
export class SecureConfig {
  private static instance: SecureConfig;
  private config: Map<string, string> = new Map();
  
  private constructor() {
    this.loadConfig();
  }
  
  public static getInstance(): SecureConfig {
    if (!SecureConfig.instance) {
      SecureConfig.instance = new SecureConfig();
    }
    return SecureConfig.instance;
  }
  
  private loadConfig() {
    // Runtime'da Parameter Store'dan yükle
    const requiredParams = [
      'DB_CONNECTION_STRING',
      'API_KEY',
      'JWT_SECRET'
    ];
    
    // Tüm gerekli parameter'ların var olduğunu doğrula
    const missingParams = requiredParams.filter(
      param => !process.env[param]
    );
    
    if (missingParams.length > 0) {
      throw new Error(`Eksik gerekli parameter'lar: ${missingParams.join(', ')}`);
    }
    
    requiredParams.forEach(param => {
      this.config.set(param, process.env[param]!);
    });
  }
  
  public get(key: string): string {
    const value = this.config.get(key);
    if (!value) {
      throw new Error(`Configuration key '${key}' bulunamadı`);
    }
    return value;
  }
}

// AWS Cost Explorer API kullanarak maliyet analiz script'i
import { CostExplorerClient, GetDimensionValuesCommand, GetRightsizingRecommendationCommand } from '@aws-sdk/client-cost-explorer';

export class LambdaCostAnalyzer {
  private costExplorer: CostExplorerClient;
  
  constructor() {
    this.costExplorer = new CostExplorerClient({});
  }
  
  async analyzeLambdaCosts(startDate: string, endDate: string) {
    const costAnalysis = await this.costExplorer.send(new GetDimensionValuesCommand({
      TimePeriod: {
        Start: startDate,
        End: endDate
      },
      Dimension: 'SERVICE',
      SearchString: 'Lambda',
      Context: 'COST_AND_USAGE'
    }));
    
    // Detaylı function seviyesi analizi
    const functionCosts = await this.getFunctionLevelCosts(startDate, endDate);
    
    return {
      totalCost: functionCosts.totalCost,
      costByFunction: functionCosts.functions,
      recommendations: this.generateOptimizationRecommendations(functionCosts)
    };
  }
  
  private generateOptimizationRecommendations(costs: any) {
    const recommendations = [];
    
    costs.functions.forEach(func => {
      // Yüksek memory, düşük kullanım
      if (func.memoryMB > 1024 && func.avgMemoryUsed < func.memoryMB * 0.5) {
        recommendations.push({
          function: func.name,
          type: 'REDUCE_MEMORY',
          currentMemory: func.memoryMB,
          recommendedMemory: Math.ceil(func.avgMemoryUsed * 1.2),
          estimatedSavings: func.cost * 0.4
        });
      }
      
      // Yüksek duration, daha fazla memory'den faydalanabilir
      if (func.avgDuration > 5000 && func.memoryMB &lt;1024) {
        recommendations.push({
          function: func.name,
          type: 'INCREASE_MEMORY',
          reason: 'CPU-bound workload',
          estimatedSpeedup: '%30-50'
        });
      }
    });
    
    return recommendations;
  }
}

# Analizimiz ortaya çıkardı:
Function: payment-processor
Memory: 3008MB (konfigüre edilmiş)
Gerçek kullanım: Ortalama 847MB
İsraf: Ayrılan memory'nin %72'si
Aylık maliyet: $2,100
Potansiyel tasarruf: $1,512/ay

# PC aktif marketing Lambda'sı
Gerçek concurrent kullanıcılar: 2-3
Provisioned concurrency: 50
Maliyet: $540/ay
İhtiyaç: $36/ay
İsraf: $504/ay (%93 israf!)

# Tek monolitik Lambda
Function boyutu: 245MB
Cold start: 8-12 saniye
Invocation'lar: 2M/ay
Maliyet: $3,200/ay

# Microservice split'ten sonra (4 function)
Ortalama boyut: Her biri 45MB
Cold start: 800ms-1.2s  
Toplam maliyet: $1,890/ay
Tasarruf: $1,310/ay

// CloudWatch metriklere dayalı otomatik memory optimizasyonu
export class MemoryOptimizer {
  async optimizeFunction(functionName: string) {
    const metrics = await this.getCloudWatchMetrics(functionName, 30); // 30 gün
    
    const analysis = {
      avgMemoryUsed: metrics.avgMemoryUsed,
      maxMemoryUsed: metrics.maxMemoryUsed,
      currentMemoryAllocated: metrics.currentMemory,
      avgDuration: metrics.avgDuration,
      invocations: metrics.invocations
    };
    
    // Optimal memory hesapla
    const recommendedMemory = this.calculateOptimalMemory(analysis);
    
    if (recommendedMemory !== analysis.currentMemoryAllocated) {
      return {
        recommendation: 'UPDATE_MEMORY',
        current: analysis.currentMemoryAllocated,
        recommended: recommendedMemory,
        expectedSavings: this.calculateSavings(analysis, recommendedMemory),
        confidence: this.calculateConfidence(metrics)
      };
    }
    
    return { recommendation: 'NO_CHANGE', reason: 'Zaten optimize edilmiş' };
  }
  
  private calculateOptimalMemory(analysis: any): number {
    // Max memory kullanımına %20 buffer ekle
    const memoryWithBuffer = Math.ceil(analysis.maxMemoryUsed * 1.2);
    
    // En yakın geçerli Lambda memory boyutuna yuvarla
    const validSizes = [128, 256, 512, 1024, 1536, 3008];
    return validSizes.find(size => size >= memoryWithBuffer) || 3008;
  }
}

// Real-time maliyet monitoring için Lambda Extension
import { CloudWatch } from '@aws-sdk/client-cloudwatch';

class CostMonitoringExtension {
  private cloudWatch: CloudWatch;
  private functionName: string;
  private startTime: number;
  
  constructor() {
    this.cloudWatch = new CloudWatch({});
    this.functionName = process.env.AWS_LAMBDA_FUNCTION_NAME!;
    this.startTime = Date.now();
  }
  
  async init() {
    // Extension'ı register et
    const response = await fetch(
      `http://${process.env.AWS_LAMBDA_RUNTIME_API}/2020-01-01/lambda/extensions`,
      {
        method: 'POST',
        body: JSON.stringify({
          'lambda-extension-name': 'cost-monitor',
          'lambda-extension-events': ['INVOKE', 'SHUTDOWN']
        }),
        headers: {
          'Lambda-Extension-Name': 'cost-monitor'
        }
      }
    );
    
    const data = await response.json();
    return data.functionResponseMode;
  }
  
  async processEvents() {
    while (true) {
      const eventResponse = await fetch(
        `http://${process.env.AWS_LAMBDA_RUNTIME_API}/2020-01-01/lambda/extensions/event/next`,
        { method: 'GET' }
      );
      
      const event = await eventResponse.json();
      
      switch (event.eventType) {
        case 'INVOKE':
          this.startTime = Date.now();
          break;
          
        case 'SHUTDOWN':
          await this.reportCosts();
          break;
      }
    }
  }
  
  private async reportCosts() {
    const duration = Date.now() - this.startTime;
    const memoryMB = parseInt(process.env.AWS_LAMBDA_FUNCTION_MEMORY_SIZE!);
    
    // Maliyeti hesapla (basitleştirilmiş)
    const cost = this.calculateInvocationCost(duration, memoryMB);
    
    await this.cloudWatch.send(new PutMetricDataCommand({
      Namespace: 'Lambda/Cost',
      MetricData: [{
        MetricName: 'InvocationCost',
        Value: cost,
        Unit: 'None',
        Dimensions: [
          { Name: 'FunctionName', Value: this.functionName },
          { Name: 'MemorySize', Value: memoryMB.toString() }
        ]
      }]
    }));
  }
  
  private calculateInvocationCost(durationMs: number, memoryMB: number): number {
    // AWS Lambda fiyatlandırması: $0.0000166667 per GB-saniye
    const gbSeconds = (memoryMB / 1024) * (durationMs / 1000);
    return gbSeconds * 0.0000166667;
  }
}

// Extension giriş noktası
const extension = new CostMonitoringExtension();
extension.init().then(() => extension.processEvents());

// Otomatik hata raporlama ile structured logging extension
class StructuredLoggingExtension {
  private logs: any[] = [];
  private functionName: string;
  
  constructor() {
    this.functionName = process.env.AWS_LAMBDA_FUNCTION_NAME!;
    this.setupLogCapture();
  }
  
  private setupLogCapture() {
    // Tüm console.* çağrılarını yakala
    const originalConsole = { ...console };
    
    console.log = (...args) => {
      this.logs.push({
        level: 'INFO',
        timestamp: new Date().toISOString(),
        message: args.join(' '),
        functionName: this.functionName
      });
      originalConsole.log(...args);
    };
    
    console.error = (...args) => {
      this.logs.push({
        level: 'ERROR',
        timestamp: new Date().toISOString(),
        message: args.join(' '),
        functionName: this.functionName,
        alert: true // Anında uyarı için flag
      });
      originalConsole.error(...args);
    };
  }
  
  async flushLogs() {
    if (this.logs.length === 0) return;
    
    // Logging service'e gönder
    await this.sendToLogService(this.logs);
    
    // Hatalar için uyarı gönder
    const errors = this.logs.filter(log => log.alert);
    if (errors.length > 0) {
      await this.sendAlerts(errors);
    }
    
    this.logs = [];
  }
}

# ECS Service Analizi
Service: payment-api
CPU: 2 vCPU (ortalama %15 kullanım)
Memory: 4GB (ortalama 1.2GB kullanım)
Maliyet: $180/ay
Uptime gerekliliği: %99.9
Peak request'ler: 500 req/dk
Ortalama request'ler: 45 req/dk

// 1. Önce ayrık function'ları extract et
// Monolitik ECS service'den focused Lambda function'lara

// Öncesi: Her şeyi handle eden tek ECS task
class PaymentAPI {
  async processPayment(req: Request) { /* ... */ }
  async validateCard(req: Request) { /* ... */ }
  async sendNotification(req: Request) { /* ... */ }
  async updateInventory(req: Request) { /* ... */ }
}

// Sonrası: Uzmanlaşmış Lambda function'lar
// payment-processor-lambda
export const handler = async (event: PaymentEvent) => {
  return processPayment(event.paymentData);
};

// card-validator-lambda  
export const handler = async (event: CardEvent) => {
  return validateCard(event.cardData);
};

// notification-sender-lambda
export const handler = async (event: NotificationEvent) => {
  return sendNotification(event.notificationData);
};

ECS Service: $180/ay
Application Load Balancer: $22/ay  
NAT Gateway: $45/ay
Toplam: $247/ay

4 Lambda function: $89/ay
API Gateway: $12/ay
ALB gerekmez: $0
NAT Gateway gerekmez: $0
Toplam: $101/ay

Tasarruf: $146/ay (%59 azalma)

// Sorun: ECS service in-memory caching'e sahipti
// Çözüm: DynamoDB ile external state

// Öncesi (ECS memory'sinde)
const cache = new Map<string, UserData>();

// Sonrası (DynamoDB ile Lambda)
import { DynamoDBClient } from '@aws-sdk/client-dynamodb';

export class UserCache {
  private dynamodb = new DynamoDBClient({});
  
  async get(userId: string): Promise<UserData | null> {
    // Caching için TTL ile DynamoDB kullan
    const result = await this.dynamodb.send(new GetItemCommand({
      TableName: 'UserCache',
      Key: { userId: { S: userId } }
    }));
    
    return result.Item ? JSON.parse(result.Item.data.S!) : null;
  }
}

// Sorun: ECS persistent DB connection'lara sahipti
// Çözüm: RDS Proxy ile invocation başına connection

// Öncesi (persistent connection'larla ECS)
const pool = new Pool({
  host: 'db.internal',
  max: 20,
  idleTimeoutMillis: 30000
});

// Sonrası (RDS Proxy ile Lambda)
import { Client } from 'pg';

export const handler = async (event: any) => {
  const client = new Client({
    host: 'rds-proxy.cluster-xyz.us-east-1.rds.amazonaws.com',
    port: 5432,
    database: 'mydb',
    user: process.env.DB_USER,
    password: process.env.DB_PASSWORD,
    ssl: { rejectUnauthorized: false }
  });
  
  await client.connect();
  try {
    const result = await client.query('SELECT * FROM users WHERE id = $1', [event.userId]);
    return result.rows[0];
  } finally {
    await client.end();
  }
};

// Distributed transaction'lar için Saga pattern implementasyonu
export class PaymentSaga {
  private stepFunctions: SFNClient;
  
  constructor() {
    this.stepFunctions = new SFNClient({});
  }
  
  async executePayment(paymentData: PaymentData) {
    const sagaDefinition = {
      Comment: 'Payment processing saga',
      StartAt: 'ValidatePayment',
      States: {
        ValidatePayment: {
          Type: 'Task',
          Resource: 'arn:aws:lambda:us-east-1:123456789:function:validate-payment',
          Next: 'ProcessPayment',
          Catch: [
            {
              ErrorEquals: ['ValidationError'],
              Next: 'PaymentFailed'
            }
          ]
        },
        ProcessPayment: {
          Type: 'Task', 
          Resource: 'arn:aws:lambda:us-east-1:123456789:function:process-payment',
          Next: 'UpdateInventory',
          Catch: [
            {
              ErrorEquals: ['PaymentError'],
              Next: 'CompensateValidation'
            }
          ]
        },
        UpdateInventory: {
          Type: 'Task',
          Resource: 'arn:aws:lambda:us-east-1:123456789:function:update-inventory', 
          Next: 'SendConfirmation',
          Catch: [
            {
              ErrorEquals: ['InventoryError'],
              Next: 'CompensatePayment'
            }
          ]
        },
        SendConfirmation: {
          Type: 'Task',
          Resource: 'arn:aws:lambda:us-east-1:123456789:function:send-confirmation',
          End: true
        },
        // Compensation state'leri
        CompensatePayment: {
          Type: 'Task',
          Resource: 'arn:aws:lambda:us-east-1:123456789:function:refund-payment',
          Next: 'CompensateValidation'
        },
        CompensateValidation: {
          Type: 'Task', 
          Resource: 'arn:aws:lambda:us-east-1:123456789:function:cleanup-validation',
          Next: 'PaymentFailed'
        },
        PaymentFailed: {
          Type: 'Fail',
          Cause: 'Payment processing başarısız'
        }
      }
    };
    
    const execution = await this.stepFunctions.send(new StartExecutionCommand({
      stateMachineArn: process.env.PAYMENT_SAGA_STATE_MACHINE!,
      input: JSON.stringify(paymentData)
    }));
    
    return execution.executionArn;
  }
}

// External service çağrıları için circuit breaker
export class CircuitBreaker {
  private failures: number = 0;
  private lastFailureTime: number = 0;
  private state: 'CLOSED' | 'OPEN' | 'HALF_OPEN' = 'CLOSED';
  
  constructor(
    private failureThreshold: number = 5,
    private recoveryTimeMs: number = 60000
  ) {}
  
  async execute<T>(operation: () => Promise<T>): Promise<T> {
    if (this.state === 'OPEN') {
      if (Date.now() - this.lastFailureTime > this.recoveryTimeMs) {
        this.state = 'HALF_OPEN';
      } else {
        throw new Error('Circuit breaker OPEN');
      }
    }
    
    try {
      const result = await operation();
      this.onSuccess();
      return result;
    } catch (error) {
      this.onFailure();
      throw error;
    }
  }
  
  private onSuccess() {
    this.failures = 0;
    this.state = 'CLOSED';
  }
  
  private onFailure() {
    this.failures++;
    this.lastFailureTime = Date.now();
    
    if (this.failures >= this.failureThreshold) {
      this.state = 'OPEN';
    }
  }
}

// Lambda function'da kullanım
const circuitBreaker = new CircuitBreaker(5, 30000);

export const handler = async (event: any) => {
  try {
    return await circuitBreaker.execute(async () => {
      return await callExternalService(event.data);
    });
  } catch (error) {
    return {
      statusCode: 503,
      body: JSON.stringify({ error: 'Service geçici olarak kullanılamıyor' })
    };
  }
};