Serverless Best Practices and Monitoring

Building serverless applications requires a different mindset from traditional application development. This lesson covers essential best practices for Azure serverless — from function design and cold start mitigation to security, cost optimisation, and comprehensive monitoring with Application Insights.

---

Function Design Best Practices

Keep Functions Small and Focused

Each function should do one thing well:

• Single responsibility — one trigger, one purpose
• Short execution time — aim for seconds, not minutes
• Small deployment packages — fewer dependencies mean faster cold starts
• Clear naming — the function name should describe what it does

Good:  validateOrder, processPayment, sendConfirmation
Bad:   handleEverything, processData, myFunction

Design for Idempotency

Serverless functions may execute multiple times for the same event (at-least-once delivery). Every function must produce the same result regardless of how many times it runs:

// Idempotent — uses upsert, safe to run multiple times
app.storageQueue('processOrder', {
    handler: async (message, context) => {
        await cosmosContainer.items.upsert({
            id: message.orderId,    // Same ID = same document
            status: 'processed',
            processedAt: new Date().toISOString()
        });
    }
});

Externalise State

Functions are stateless. Never rely on in-memory state between invocations:

State Type	Storage Option
Session data	Redis Cache
Application data	Cosmos DB, SQL Database
File uploads	Blob Storage
Configuration	App Configuration, Key Vault
Workflow state	Durable Functions
Cache	Redis Cache, APIM caching

---

Cold Start Mitigation

Cold starts are the most common complaint in serverless architectures. Here are strategies to reduce their impact:

1. Choose the Right Plan

Plan	Cold Start	Cost
Consumption	1–10 seconds	Lowest
Premium (pre-warmed)	Minimal	Moderate
Dedicated (always on)	None	Highest

2. Minimise Dependencies

# Bad — installs everything including dev dependencies
npm install

# Good — production dependencies only
npm install --production

# Better — use esbuild or webpack to bundle and tree-shake
npx esbuild src/index.js --bundle --platform=node --outfile=dist/index.js

3. Lazy-Load Heavy Modules

// Bad — loaded on every cold start even if not used
const sharp = require('sharp');
const pdfLib = require('pdf-lib');

// Good — loaded only when needed
app.http('resizeImage', {
    handler: async (request, context) => {
        const sharp = require('sharp');  // Loaded only for this function
        // ...
    }
});

4. Use Connection Pooling

Initialise clients outside the handler so they persist across warm invocations:

// Good — client created once, reused across invocations
const { CosmosClient } = require('@azure/cosmos');
const client = new CosmosClient(process.env.COSMOS_CONNECTION);
const container = client.database('mydb').container('items');

app.http('getItem', {
    handler: async (request, context) => {
        // Reuses the existing connection
        const { resource } = await container.item(request.params.id).read();
        return { jsonBody: resource };
    }
});

5. Keep-Alive Pings (Consumption Plan)

Schedule a timer function to keep the host warm:

app.timer('keepAlive', {
    schedule: '0 */4 * * * *',    // Every 4 minutes
    handler: async (timer, context) => {
        context.log('Keep-alive ping');
    }
});

Note: This is a workaround. For production workloads, the Premium plan is a better solution.

---

Security Best Practices

Authentication and Authorisation

// Use function-level auth keys for service-to-service calls
app.http('internalApi', {
    authLevel: 'function',    // Requires function key
    handler: async (request, context) => { /* ... */ }
});

// Use APIM with JWT validation for public APIs
// Configure in APIM policy, not in function code

Secrets Management

Never hardcode secrets. Use Azure Key Vault with managed identity:

# Grant the function app access to Key Vault
az keyvault set-policy \
    --name my-keyvault \
    --object-id {function-app-managed-identity-id} \
    --secret-permissions get list

# Reference Key Vault in application settings
az functionapp config appsettings set \
    --name my-function-app \
    --resource-group rg-serverless \
    --settings "DB_PASSWORD=@Microsoft.KeyVault(SecretUri=https://my-keyvault.vault.azure.net/secrets/db-password/)"

Network Security

• Use Private Endpoints to restrict function app access to VNet traffic only
• Enable VNet Integration (Premium/Dedicated) for outbound traffic through a VNet
• Disable public network access when functions should only be reachable internally
• Use Managed Identity for authentication to Azure services (no credentials to manage)

Input Validation

Always validate and sanitise input:

app.http('createUser', {
    methods: ['POST'],
    handler: async (request, context) => {
        const body = await request.json();