developmentseed / developmentseed/titiler-cmr

Use distributed cache for caching EDL user token and S3 temporary credentials

Open
#154 6 comments 2 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
25
Forks
9
Avg merge
1d 6m
Merged PRs (30d)
1

Description

We currently cache an EDL user token and S3 temporary credentials (from various DAACs, dynamically) in each Lambda instance. This means that since each Lambda maintains its own local cache, such information is not shared and duplicate requests must be made for each Lambda. Further, the caches do not survive cold starts. This has both a negative performance impact as well as a negative load impact on the DAAC s3 credentials endpoints.

The following recommended solution/benefits is in large part copied from https://docs.google.com/document/d/1CHh1O8AMLENBHqj3F9ml5prQYFGbmlTPPynOxRvy2K8/edit?tab=t.0:

Using a distributed cache for temporary S3 credentials should provide the following benefits:

* Improve cold-start performance: since the cache would survive cold-starts, cold-started Lambda instances would no longer end up repopulating individual, isolated caches.
* Improve general performance: since Lambdas would share cached credentials, the burden of fetching credentials would be shared as well, thus only a single instance would need to fetch (or refresh) the temporary credentials for a given endpoint, while all other instances would simply fetch them from the cache.
* Minimize load on credential endpoints
* Create a reusable component (perhaps as a Lambda extension): this could be packaged for reuse across other projects, and as a secure, scalable replacement for the edl-credential-rotation Lambda used elsewhere.

Note, however, that even if packaged as a Lambda extension, any dependencies required for this functionality count toward the Lambda .zip archive limit, so we would need to carefully measure the unzipped size of any additional dependencies since employing the size reduction measures described above may still leave us precariously close to the size limit, without enough room for cache dependencies. @hrodmn's recent work to reduce the image size was extremely significant, reducing the assets to about 190MB, so we have much more wiggle room than we had previously.

**We may wish to consider using ValKey rather than Redis with ElastiCache Serverless, as it is less expensive, more memory-efficient, and more performant. Further, we don’t need any of the advanced modules provided only by Redis.**

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests; begin by tracing where Lambda-local EDL tokens and temporary S3 credentials are cached and refreshed. Compare a shared ValKey or Redis ElastiCache Serverless design, including dependency size, then verify that cold starts and concurrent Lambdas reuse credentials without excess DAAC requests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python, redis
Domain
backend, cloud, distributed-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.