RE verifying JWTs with AWS KMS. It's possible to ...
# servera
Andrew O'Hara
07/04/2023, 3:12 PMRE verifying JWTs with AWS KMS. It's possible to call the KMS API for every single verification, but it seems possible to download the KMS public key and then proceed to use that. Undoubtedly, this is the ideal route for long-lived applications, but it's less clear for serverless applications on AWS Lambda, where cold-start is important to optimize for. It seems to me that downloading and using the public key would always be slower the first time rather than just verifying with the API. However, I haven't yet tested this.
Does anyone have any experience with this tradeoff?
d
dave
07/04/2023, 3:22 PMI'd have thought that downloading the key would give 2 major advantages: 1. You only incur the problem for the first request. 2. Calling KMS for every call could get pretty expense pretty fast 🙃
dave
07/04/2023, 3:23 PMWe tend to download and verify for this very reason. Are your cold start requirements really that tight?
a
Andrew O'Hara
07/04/2023, 3:36 PMI don't foresee this application getting much use, but cost is still an interesting point to consider. I don't have hard requirements for cold-start, but I find it's much more important for low-usage apps; where you're almost guaranteed to have several cold-starts before your page loads.
It seems to at least be worth looking into.
Andrew O'Hara
07/04/2023, 3:37 PMBTW, I know you've done the same thing before (with nimbus JWT), so I'd be interested in your feedback once I'm done with the adapter.
c
Chris Lee
07/04/2023, 3:57 PMWe always cache keys (from KMS or Secrets Manager) for both performance and cost reasons.
d
dave
07/04/2023, 4:54 PMyep - they are public after all, so there is no harm in sticking them into Redis or similar 🙂
19 Views