Repository navigation
feat(converter): ship as a .zip with a free-tier kill switch - #73
Merged
Merged
Conversation
- Converter is now a python3.13 arm64 .zip built by converter/Makefile (Pillow's manylinux_2_28_aarch64 wheel), so the ECR repo and its storage cost go away. CI imports the built package on arm64 to prove JP2/TIFF decoding is present. infra/bootstrap.yaml keeps only the artefact bucket. - New ConverterGuardFunction (guard/) switches the converter off by setting its reserved concurrency to 0 when the 5-minute spike alarm fires, or when month-to-date Lambda usage nears the always-free allowance, and back on hourly once usage and the alarm are clear. Every switch is emailed. - Function timeout 60 -> 120 s plus a 90 s whole-download deadline: NDHA streams some masters at under 1 MB/s, and FL73848659 (45.8 MB) timed out silently. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Hourly run only re-enables once the spike alarm has been quiet for GuardSpikeCooldownHours (6): throttled calls aren't invocations, so the alarm clears within minutes and couldn't tell a flood had stopped. - download_image reads with read1 so a trickling source can't hold one read past the deadline. - converter/Makefile fails the build if the wheel lacks OpenJPEG/libtiff. - Guard timeout 60 s, documented limits, style fixes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…bscription - Hourly run switches the converter off while the spike alarm is in ALARM, covering a failed SNS-triggered run (the alarm won't notify again). - SNS FilterPolicy so only the spike alarm entering ALARM invokes the guard. - Reference the alarm name instead of repeating it. - Converter timeout 180 s: a download can end ~125 s (90 s deadline plus one 35 s blocking read), leaving time to decode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- GuardMaxGbSeconds 250,000: about two hours of worst-case converter burn below the 400,000 free, since a flood of slow calls can stay under the spike threshold and only the hourly check catches it. - At most 3 redirects, so connection setup can't outlast the timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 of moving NZ Images to Cloudflare Free plus a free-tier AWS converter.
What changes
The converter is a python3.13 arm64 .zip built by
converter/Makefile(Pillow'smanylinux_2_28_aarch64wheel, 22 MB). There's no container image any more, so the ECR repo and its storage cost (~$0.06/month, no free tier left on this account) go away. CI's deploy job imports the built package on arm64 Python 3.13 and fails if JP2 or TIFF decoding is missing.infra/bootstrap.yamlkeeps only the artefact bucket.New
ConverterGuardFunction(guard/) is a kill switch. It sets the converter's reserved concurrency to 0 in two cases:An hourly run switches it back on once usage and the alarm are clear. Every switch is emailed to the cost-alarm topic.
Converter timeout goes from 60 s to 120 s, plus a 90 s whole-download deadline. NDHA streams some masters at under 1 MB/s, and FL73848659 (45.8 MB, 7356×5010) hit the 60 s timeout with nothing logged.
Deploy notes
PackageTypeImage -> Zip replaces the converter function, so its Function URL changes. The Swift API picks the new URL up through!GetAttin the same deploy.nzimageapi-bootstrap(the repo isRetain, so it is left behind), then delete thenzimageapi/jp2converterrepo.Tested
pytest: converter 34 passed, guard 14 passed.sam validate --lintpasses.sam buildof both functions works and the converter build includeslibopenjp2andlibtiff.PutFunctionConcurrency(0)andDeleteFunctionConcurrencyboth work on this account, whose concurrency quota is 10 (checked live, then restored).🤖 Generated with Claude Code