Lambda Managed Instances を検証 — プロビジョニング時間・マルチコンカレンシー・スケーリングの実態

# Lambda 実行ロール
cat > lambda-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "lambda.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}
EOF
 
aws iam create-role \
  --role-name LMI-Verification-ExecutionRole \
  --assume-role-policy-document file://lambda-trust-policy.json
 
aws iam attach-role-policy \
  --role-name LMI-Verification-ExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
 
# Capacity Provider オペレーターロール
aws iam create-role \
  --role-name LMI-Verification-OperatorRole \
  --assume-role-policy-document file://lambda-trust-policy.json
 
aws iam attach-role-policy \
  --role-name LMI-Verification-OperatorRole \
  --policy-arn arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator

REGION=us-east-1
 
# VPC
VPC_ID=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
  --query 'Vpc.VpcId' --output text --region $REGION)
 
# プライベートサブネット（3 AZ）
PRIV_SUB1=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 --availability-zone us-east-1a \
  --query 'Subnet.SubnetId' --output text --region $REGION)
PRIV_SUB2=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.2.0/24 --availability-zone us-east-1b \
  --query 'Subnet.SubnetId' --output text --region $REGION)
PRIV_SUB3=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.3.0/24 --availability-zone us-east-1c \
  --query 'Subnet.SubnetId' --output text --region $REGION)
 
# パブリックサブネット + IGW + NAT Gateway
PUB_SUB=$(aws ec2 create-subnet --vpc-id $VPC_ID \
  --cidr-block 10.0.100.0/24 --availability-zone us-east-1a \
  --query 'Subnet.SubnetId' --output text --region $REGION)
 
IGW_ID=$(aws ec2 create-internet-gateway \
  --query 'InternetGateway.InternetGatewayId' --output text --region $REGION)
aws ec2 attach-internet-gateway \
  --internet-gateway-id $IGW_ID --vpc-id $VPC_ID --region $REGION
 
PUB_RT=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --query 'RouteTable.RouteTableId' --output text --region $REGION)
aws ec2 create-route --route-table-id $PUB_RT \
  --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID --region $REGION
aws ec2 associate-route-table \
  --route-table-id $PUB_RT --subnet-id $PUB_SUB --region $REGION
 
EIP_ALLOC=$(aws ec2 allocate-address --domain vpc \
  --query 'AllocationId' --output text --region $REGION)
NAT_GW=$(aws ec2 create-nat-gateway --subnet-id $PUB_SUB \
  --allocation-id $EIP_ALLOC \
  --query 'NatGateway.NatGatewayId' --output text --region $REGION)
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_GW --region $REGION
 
PRIV_RT=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --query 'RouteTable.RouteTableId' --output text --region $REGION)
aws ec2 create-route --route-table-id $PRIV_RT \
  --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_GW --region $REGION
for SUB in $PRIV_SUB1 $PRIV_SUB2 $PRIV_SUB3; do
  aws ec2 associate-route-table \
    --route-table-id $PRIV_RT --subnet-id $SUB --region $REGION
done
 
# セキュリティグループ
SG_ID=$(aws ec2 create-security-group --group-name lmi-verification-sg \
  --description "Security group for LMI verification" \
  --vpc-id $VPC_ID --query 'GroupId' --output text --region $REGION)

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
 
aws lambda create-capacity-provider \
  --capacity-provider-name lmi-verification-cp \
  --vpc-config "SubnetIds=$PRIV_SUB1,$PRIV_SUB2,$PRIV_SUB3,SecurityGroupIds=$SG_ID" \
  --permissions-config "CapacityProviderOperatorRoleArn=arn:aws:iam::${ACCOUNT_ID}:role/LMI-Verification-OperatorRole" \
  --instance-requirements "Architectures=x86_64" \
  --capacity-provider-scaling-config "MaxVCpuCount=30" \
  --region $REGION

import json
import os
import time
import threading
import math
 
def lambda_handler(event, context):
    mode = event.get("mode", "info")
    result = {
        "request_id": context.aws_request_id,
        "function_version": context.function_version,
        "pid": os.getpid(),
        "thread_id": threading.current_thread().ident,
        "timestamp": time.time(),
    }
 
    if mode == "io_bound":
        sleep_sec = event.get("sleep_sec", 2)
        time.sleep(sleep_sec)
        result["mode"] = "io_bound"
        result["sleep_sec"] = sleep_sec
    elif mode == "cpu_bound":
        iterations = event.get("iterations", 5_000_000)
        start = time.time()
        total = 0.0
        for i in range(iterations):
            total += math.sqrt(i) * math.sin(i)
        result["mode"] = "cpu_bound"
        result["compute_time_sec"] = round(time.time() - start, 3)
    else:
        result["mode"] = "info"
 
    return {"statusCode": 200, "body": json.dumps(result)}

# 関数コードを ZIP 化
mkdir -p /tmp/lmi-func && cp lambda_function.py /tmp/lmi-func/
cd /tmp/lmi-func && zip -j /tmp/lmi-function.zip lambda_function.py
 
CP_ARN="arn:aws:lambda:${REGION}:${ACCOUNT_ID}:capacity-provider:lmi-verification-cp"
 
aws lambda create-function \
  --function-name lmi-verification-func \
  --runtime python3.13 \
  --role "arn:aws:iam::${ACCOUNT_ID}:role/LMI-Verification-ExecutionRole" \
  --handler lambda_function.lambda_handler \
  --zip-file fileb:///tmp/lmi-function.zip \
  --memory-size 4096 \
  --timeout 60 \
  --capacity-provider-config "{
    \"LambdaManagedInstancesCapacityProviderConfig\": {
      \"CapacityProviderArn\": \"$CP_ARN\",
      \"ExecutionEnvironmentMemoryGiBPerVCpu\": 4.0,
      \"PerExecutionEnvironmentMaxConcurrency\": 10
    }
  }" \
  --region $REGION
 
# 関数が Active になるのを待つ
aws lambda wait function-active-v2 --function-name lmi-verification-func --region $REGION
 
# バージョンを publish（EC2 プロビジョニングが開始される）
aws lambda publish-version --function-name lmi-verification-func --region $REGION

# N 並列で invoke を実行し、PID 分布を集計するスクリプト
N=10
for i in $(seq 1 $N); do
  aws lambda invoke \
    --function-name lmi-verification-func --qualifier 1 \
    --payload '{"mode":"io_bound","sleep_sec":3}' \
    --cli-binary-format raw-in-base64-out \
    --cli-read-timeout 30 \
    /tmp/lmi-result-${i}.json \
    --region us-east-1 > /dev/null 2>&1 &
done
wait
 
# PID 分布を確認
for i in $(seq 1 $N); do
  python3 -c "
import json
d=json.load(open('/tmp/lmi-result-${i}.json'))
b=json.loads(d['body'])
print(b['pid'])" 2>/dev/null
done | sort | uniq -c | sort -rn

REGION=us-east-1
 
# Lambda 関数とバージョンの削除
aws lambda delete-function --function-name lmi-verification-func --region $REGION
 
# Capacity Provider の削除（EC2 インスタンスも自動終了）
aws lambda delete-capacity-provider \
  --capacity-provider-name lmi-verification-cp --region $REGION
 
# NAT Gateway の削除（時間がかかる）
aws ec2 delete-nat-gateway --nat-gateway-id $NAT_GW --region $REGION
aws ec2 wait nat-gateway-deleted --nat-gateway-ids $NAT_GW --region $REGION
aws ec2 release-address --allocation-id $EIP_ALLOC --region $REGION
 
# ルートテーブル・サブネット・IGW・VPC の削除
# （関連付けを解除してから削除）
aws ec2 delete-route-table --route-table-id $PRIV_RT --region $REGION
aws ec2 delete-route-table --route-table-id $PUB_RT --region $REGION
for SUB in $PRIV_SUB1 $PRIV_SUB2 $PRIV_SUB3 $PUB_SUB; do
  aws ec2 delete-subnet --subnet-id $SUB --region $REGION
done
aws ec2 detach-internet-gateway \
  --internet-gateway-id $IGW_ID --vpc-id $VPC_ID --region $REGION
aws ec2 delete-internet-gateway --internet-gateway-id $IGW_ID --region $REGION
aws ec2 delete-security-group --group-id $SG_ID --region $REGION
aws ec2 delete-vpc --vpc-id $VPC_ID --region $REGION
 
# IAM ロールの削除
aws iam detach-role-policy --role-name LMI-Verification-ExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam delete-role --role-name LMI-Verification-ExecutionRole
aws iam detach-role-policy --role-name LMI-Verification-OperatorRole \
  --policy-arn arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator
aws iam delete-role --role-name LMI-Verification-OperatorRole