AWS Lambda Cold Start Elimination: Production Benchmarking with SnapStart, VPC Endpoints & Provisioned Concurrency in Multi-Account Architectures

# KMS Customer Managed Key for Firecracker Snapshot Encryption
resource "aws_kms_key" "lambda_snapstart_cmk" {
  description             = "KMS Key for AWS Lambda SnapStart Snapshot Encryption"
  deletion_window_in_days = 30
  enable_key_rotation     = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "Enable Root Account Permissions"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
        }
        Action   = "kms:*"
        Resource = "*"
      },
      {
        Sid    = "Allow Lambda SnapStart Service Access"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
        Action = [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })
}

# Production Lambda Function with SnapStart Enabled
resource "aws_lambda_function" "payment_processor" {
  function_name = "fintech-payment-authorizer-prod"
  description   = "Tier-1 High-Throughput Payment Authorization Engine with SnapStart"
  role          = aws_iam_role.lambda_exec_role.arn
  handler       = "com.cloudknowledge.payment.AuthorizerHandler::handleRequest"
  runtime       = "java21"
  architectures = ["arm64"] # Graviton3 Execution Environment
  memory_size   = 2048    # Optimized for 2-vCPU allocation during snapshot burst
  timeout       = 15

  # Enable Firecracker MicroVM Snapshotting
  snap_start {
    apply_on = "PublishedVersions"
  }

  kms_key_arn = aws_kms_key.lambda_snapstart_cmk.arn

  vpc_config {
    subnet_ids         = var.private_subnet_ids
    security_group_ids = [aws_security_group.lambda_vpc_sg.id]
  }

  environment {
    variables = {
      ENVIRONMENT       = "production"
      POWERTOOLS_SERVICE_NAME = "payment-authorizer"
      JAVA_TOOL_OPTIONS = "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
    }
  }

  publish = true # Mandatory: SnapStart snapshots are generated on published versions
}

# Alias for Traffic Routing and Provisioned Concurrency Association
resource "aws_lambda_alias" "prod_live" {
  name             = "live"
  description      = "Active production alias targeting published SnapStart versions"
  function_name    = aws_lambda_function.payment_processor.function_name
  function_version = aws_lambda_function.payment_processor.version
}

# Hybrid Strategy: Dynamic Auto-Scaling Provisioned Concurrency Floor
resource "aws_appautoscaling_target" "lambda_target" {
  max_capacity       = 150
  min_capacity       = 10 # Base warm seat floor during peak daytime operations
  resource_id        = "function:${aws_lambda_function.payment_processor.function_name}:${aws_lambda_alias.prod_live.name}"
  scalable_dimension = "lambda:function:ProvisionedConcurrency"
  service_namespace  = "lambda"
}

resource "aws_appautoscaling_policy" "lambda_policy" {
  name               = "payment-concurrency-utilization-tracking"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.lambda_target.resource_id
  scalable_dimension = aws_appautoscaling_target.lambda_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.lambda_target.service_namespace

  target_tracking_scaling_policy_configuration {
    target_value       = 0.70 # Scale out when concurrency utilization breaches 70%
    scale_in_cooldown  = 300
    scale_out_cooldown = 0   # Instant expansion backed by sub-60ms SnapStart restore
  }
}

package com.cloudknowledge.payment;

import org.crac.Core;
import org.crac.Resource;
import java.security.SecureRandom;
import com.zaxxer.hikari.HikariDataSource;

public class DatabaseConnectionManager implements Resource {

    private static HikariDataSource dataSource;
    private static SecureRandom secureRandom;

    public DatabaseConnectionManager() {
        // Register this resource with the CRaC runtime registry
        Core.getGlobalContext().register(this);
    }

    @Override
    public void beforeCheckpoint(org.crac.Context<? extends Resource> context) throws Exception {
        System.out.println("CRaC [beforeCheckpoint]: Draining active database connection pools...");
        if (dataSource != null && !dataSource.isClosed()) {
            dataSource.close(); // Evict live sockets prior to memory serialization
        }
        secureRandom = null;   // Nullify cached entropy state
    }

    @Override
    public void afterRestore(org.crac.Context<? extends Resource> context) throws Exception {
        System.out.println("CRaC [afterRestore]: Re-seeding SecureRandom and warming pooled connections...");
        secureRandom = new SecureRandom(); // Force kernel /dev/urandom fresh seed
        initializeDataSource();            // Re-establish fresh authenticated socket pool
    }

    private synchronized void initializeDataSource() {
        if (dataSource == null || dataSource.isClosed()) {
            dataSource = new HikariDataSource();
            dataSource.setJdbcUrl(System.getenv("DB_JDBC_URL"));
            dataSource.setMaximumPoolSize(5);
            dataSource.setMinimumIdle(1);
            dataSource.setConnectionTimeout(1000);
        }
    }
}