How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust
On any compute platform, when a security alert fires, the question is always the same. Which workload talked to that The post How AWS Lambda logs every flow across thousands of microVMs per host with eBPF and Rust appeared first on The New Stack .
Every Lambda worker is a bare-metal EC2 instance with microVMs isolated by Firecracker. Workloads are networked to S3, other AWS services, the public internet, and a customer's VPC. A network flow log logs every packet flow, helping with investigation, incident response, audit, and reconstructing what happened to a workload. The log must be complete, correctly attributed, and cause almost no overhead to the network flow and platform.
The old architecture ran into two problems: rule explosion due to iptables and lack of IPv6 support. To solve these issues, the new system uses eBPF programs attached to traffic-control hooks on each network. These programs emit one compact event per packet into a ring buffer, intercepting packets without modifying them. A Rust user-space tagger reads from the ring buffer and creates Ion records, maintaining byte-for-byte identical records.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
