Technology and Infrastructure → Serverless approach and features

Serverless approach and functions

1) What is serverless and when is it needed

Serverless is a model where the cloud takes over server management, scaling and patches, and the team writes event handlers and uses FaaS (Functions-as-a-Service) and BaaS (managed services: queues, databases, storage). You win in delivery speed, pay for actual execution and easily scale effervescent loads.

• PSP/KYC webhooks (many short queries, unpredictable peaks).
• Antifraud/scoring (event functions, enrichment, feature store).
• Reporting/CDC → DWH (batch and streaming).
• Marketing/CRM (trigger events, fluffs, coupons, segmentation).
• Lightweight backend APIs and utility tasks (throttling, cron functions).

• Constant low P99 latency (sub-10ms) is required without hesitation.
• Long-lived connections/protocols (high-frequency real-time without a proxy).
• Large, stateful computing with long CPU/GPU and tight coupling.

2) Architectural bricks

2. 1 FaaS

Event handlers: HTTP/API gateway, queues, streams, timers, object storage, database triggers.
Thin start/packaging: layers/image-functions, warming up.

2. 2 BaaS and integrations

Queues/streaming (at-least-once), Pub/Sub for domain events.
Storages: object (raw materials/artifacts), KV/cache, documents/relational.
Orchestration: state machines/step functions, sagas and compensations.
API gateway: authentication (OAuth/OIDC/HMAC), limits, transformations.

2. 3 Network circuit

Public front (edge/API gateway) + private functions in VPC to access database/secrets/PSP.
Egress control: allow-list to PSP/KYC, fixed NAT-IP.

3) Performance: cold start, competitiveness, duration

Cold start: First start of function container after downtime.
Mitigate: minimize dependencies, use "warm up" (periodic invoke), keep functions in the same zone with sources, apply long timeouts carefully.
Competitiveness: set 'max _ concurrency' and source limits (queues/gateway) so as not to "flood" the PSP/DB.
Duration of execution: for long tasks - breakdown into steps + orchestration (step functions), for heavy calculations - batch/containers.

4) Robustness: idempotency, retreats, DLQ

Idempotency: 'Idempotency-Key '/deduplication at the reception (key + TTL storage).
Retrai: exponential backoff + jitter, try limits; Separate business errors (4xx) from temporary errors (5xx/timeout).
DLQ (dead-letter queue): for messages that have not passed after N attempts; replay console and trace required.
Exactly-once: outbox/inbox templates, transactional event log.

5) Status and orchestration

No state in function, state in external stores.
State machines: payment/output steps, KYC-workflow, anti-fraud checks; clear error/compensation model.
Sagas: "reserve → confirm → compensate" when rolling back.

6) Safety and compliance

IAM by the principle of least privileges: roles per-function, scoping on the queue/buckets/tables.
Secrets: secret manager/KMS, rotation, HSM-level for keys.
mTLS/HMAC for webhooks, body signature, time window ± 5 min.
Built-in WAF/bot protection on the API gateway, rate-limits/quotas.
Segmentation: prod/stage, service accounts, private subsets.

PII/PCI: PAN tokenization, log masking, "data minimization."

Audit: immutable logs (WORM), call tracing, regulatory storage.

7) Observability and quality control

Metrics: RPS, P50/P95/P99, code errors, duration, cold starts, retray pipeline, DLQ size.
OTel: trace _ id correlation through gateway → → queue function → DB/PSP; mandatory labels' api _ version ',' region ',' partner '.
Logs: structured, with PII masking.
Alert for symptoms: burn-rate SLO, retray growth, P99 tail.
Synthetics: checks from target countries (TR/BR/EU), imitation of webhooks.

8) FinOps and cost

Pay "for calls and milliseconds." Tracking: launch frequency, duration, memory, traffic.
Profile hot paths: bring heavy dependencies to the layer/image, cache connections.
Restrain fan-out (massive parallel calls) with limits and butching.
Recognize "leaks": endless retrays, messages in DLQ without processing.
Plan peak windows (tournaments/events) - predictive warm-up and quotas.

9) CI/CD and versioning

IaC: Terraform/CloudFormation/SAM/CDK - templates of functions, queues, rights, gateways.
Packaging: lock dependency files, minimal image/layers.
Testing: contract tests (OpenAPI/gRPC), integration with local runtime, idempotency tests.
Deploy: canary/blue-green, feature flags, fast rollback.
API versioning: '/vN/' or media types; Deprecation/Sunset and event schema compatibility.

10) Patterns for iGaming/fintech

Payment/withdrawal webhooks: signature acceptance → validation → idempotence → posting of the payout event. updated '→ orchestration of wallet/report updates.
Antifrod scoring: enricher function (IP/device/geo/history), asynchronous solution, timeouts and fallback strategies.
KYC/AML pipeline: parallel checks (documents, sanctions, PEP), aggregation of results, sagas for repeated requests.
Tournaments/ratings: events of rounds → streaming aggregation → updating leaderboards, TTL cache for reading.
Reporting to regulators: CDC → functions of transformation → showcases in DWH, SLA for data freshness.
Marketing/CRM: behavior triggers → coupons/fluffs, deduplication and user limits.

11) Sample fragments

11. 1 Idempotent webhook reception (pseudocode)

python def handler(event):
assert verify_hmac(event. headers, event. body, secret)
key = f"idemp:{event. headers['Idempotency-Key']}"
if kv. exists(key):
return kv. get (key) # repeat - give the same result result = process (event. body) # public event, state record kv. set(key, result, ttl=86400)
return result

11. 2 Orchestration of withdrawal (state machine, idea)

1. 'validate _ request' → 2) 'lock _ balance' → 3) 'call _ psp' (with retras) →

2. 'await _ webhook' (timeout → compensation) → 5) 'finalize/notify'.

12) Serverless implementation checklist

1. Sources of events and contractual arrangements (schematics/versions) are identified.
2. Competitive limits and "careful" retrays have been set up, there are DLQ and replay.
3. Private networks/VPC, egress-allow-list, fixed IP to PSP are included.
4. IAM on the principle of least privileges, secrets in KMS/Secret Manager.
5. Observability: OTel tracing, P99 dashboards/errors/cold starts.
6. FinOps: budgets, cost alerts, duration/memory control.
7. CI/CD: canary/blue-green, autotests of contracts/idempotences.
8. Documentation: DevPortal/Postman collections, examples of payloads, Deprecation/Sunset.

13) Anti-patterns

"Thick" functions with a bunch of dependencies → slow cold starts.
Lack of idempotency and signature of webhooks → duplicates/fraud.
Fan-out without limits → storm of competition, throttling at the provider.
Logic in timers/crowns without tracing/alerts → "quiet" SLA failures.
Mixing of production secrets in environment variables without encryption.
Event contracts without Schema Registry and compatibility rules.

14) The bottom line

Serverless is a cloud event operating system: you focus on business logic, and scaling and infrastructure are "on demand." Combine FaaS + managed services, add idempotency, orchestration and observability, discipline cost - and get a platform that can withstand peaks, evolve quickly and remain economical.