A case study on how Quesma built a secure, isolated execution environment on AWS Lambda to safely run untrusted, AI-generated code in production.

AWS Fundamentals offers foundational knowledge and resources for understanding Amazon Web Services (AWS) cloud computing services. From basic concepts like virtual servers and storage to advanced topics like serverless architecture and machine learning on AWS, readers can learn how to leverage the full potential of cloud computing for their applications and businesses.

AWS Fundamentals

Quesma, a Slackbot for Grafana, needed to safely execute untrusted AI-generated R code in production. After initially trying WebAssembly in browsers, which suffered from large bundle sizes (92MB), missing dependencies, and complex data flows, they migrated to AWS Lambda with Docker containers running in an isolated VPC. The solution uses custom Docker images with pre-bundled dependencies, VPC network isolation with S3 gateway endpoints to prevent internet access, and configurable timeouts for resource control. Key learnings include Lambda's memory-CPU coupling quirk (requiring 2048MB RAM allocation despite only using 205MB to get sufficient CPU), the effectiveness of VPC isolation for sandboxing, and the importance of choosing server-side execution for workflows requiring backend communication.

Running Untrusted Code Safely at Scale with AWS Lambda

The Initial Approach: WebAssembly in the Browser

What We Learned About Building Secure Sandboxes on AWS