Serverless Stack

Hey,  stack naming  takes the working folder as stack name, can we avoid it?

<@U01K9UQ6124> you can configure stack names like this <https://docs.serverless-stack.com/constructs/Stack#configuring-stack-name>

<@U01JVDKASAC> Thank you, that is what I want.

I have a real application using this stack and the bundle is like 1.5m.  Still kind of big but most of it is coming from aws-sdk v3. Once they include that in the runtime env we can externalize those

I got the impression that AWS wasn't ever going to include v3 in the runtime environment; like they just don't want to include any SDK anymore.

Just the documentation saying that it isn't included. v3 has been GA for a long time, two(?) new Node.js runtimes released since then, and it isn't included. It's not like there's a conflict - v2 and v3 can coexist.

So I can only conclude that they don't ever intend to include it.

I wish we had more transparency with them + engagement. I think about Vercel and how public they are about everything they're doing

Used to take them (aws) forever to update the included v2 sdks. I just think its difficult to manage that for them still

It's crazy how big the sdks are for a simple http client

I'm still using v2 for almost everything. Held off for two reasons: bugs with open file descriptors and large bundles. Even compared to bundling latest v2 instead of using included one, v3 is bigger despite the promise of better tree shaking.

(In v2, you do have to be sure to always include the clients though, never import direct from "aws-sdk". I explain <https://adam.fanello.net/reduce-existing-javascript-lambda-package-by-49-yes-please-fe08c9aa60d|here>.)

Maybe I'll do a stream where I analyze the bundles and figure out what the hell they're doing

V2 being smaller even when bundled is interesting

BTW: The v3 config file handling bugs are supposedly fixed.

Yeah, I'm pretty sure that bug was introduced relatively recently recently and then subsequently fixed (as opposed to always being there)

I was concerned about the mono lambda issue but we have some people that have been building this way for a while without any issues

your whole application bundled into an every growing lambda

it's a complicated situation and not necessarily bad enough to care about

I haven’t hit any major issues with this yet myself.

but the next best thing would be to just throw it into fargate I suppose?

I've been thinking about crazier options is cross compiling it into AppSync but it's not automatically more performant.  You might get smaller lambdas per query/resolver/etc but that means more cold starts and it might net out to be worse

ahh. any way to not have to write VTL tho :sweat_smile:

you wouldn't have to write VTL since they would just be appsync lambda resolvers

VTL is so performant thought so I think that might be a future since people are creating ts -&gt; vtl compilers

Moved into our main example repo: <https://github.com/serverless-stack/serverless-stack/tree/master/examples/ideal-stack|https://github.com/serverless-stack/serverless-stack/tree/master/examples/ideal-stack>

nothing major just some cleanup and removal of cognito

we got some clarity on what we're going to do for auth (and it won't require cognito :smile: ) but it'll be coming after our first release

Now I’m curious what you guys are going with to replace Cognito :see_no_evil:

guarantee you'll like it better than cognito :wink:

waiting with bated breath on this one. gotta implement auth soon for our react native app that uses SST and I’d really really like to avoid Cognito after some serious pain interacting with it using the CDK last year. no pressure :sweat_smile:. also, what the hell does “bated” mean? English is so weird.

haha yeah I want it myself! I've gotten close to finalizing the design of it (in my head) and am beginning work soon

Something that can potentially be added just to the ideal-stack or even to the Auth Construct is to remove all the defaults for Cognito to ask for special chars/symbols. As per the new NIST guidelines where it mentions that Password Length &gt; Complexity
<https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/>

yep I did this myself when I used cognito good thing to point out

I like a pointing system for passwords: lowercase letter: 1 point, uppercase letter: 2 points, digit: 2 points, anything else: 3 points. Password must score a minimum points. This allows for both complexity and length to meet needs.
Unfortunately -100 points because the only way to do this is to write your own authentication, because none of the big boys do it. :disappointed:

at this point I only do email auth or some form of SSO

I tried that with a side project to just do an email auth only and the feedback was that it's annoying and hard to just login. Most of the users had password managers though, which would have made it super easy to login vs opening their email and clicking on a link

So SSO/Login through social providers is probably the best one there.

I know it's a little clunky but you always have to implement it anyway for forgot password