Scaling RStudio/Shiny using Serverless Architecture and AWS Fargate
AWS Architecture BlogScaling RStudio/Shiny using Serverless Architecture and AWS Fargateby Chayan Panda, Michael Hsieh, and Mukosi Mukwevho | on01 APR 2021| inAmazon Athena,Amazon Elastic Container Service,Amazon Elastic File System (EFS),Amazon Route 53,Architecture,AWS Cloud Development Kit,AWS DataSync,AWS Fargate,AWS Transfer Family,AWS WAF,Elastic Load Balancing,Serverless|Permalink|ShareData scientists useRStudioserver as an Integrated Development Environment (IDE) to develop, publish, and share interactive web dashboards built onShinyServer. Although it is possible to use virtual server infrastructure in the cloud to run R workloads, containerization offers significant operational benefits.Migrating R workloads into a serverless model in AWS, customers can benefit from managed infrastructure, scalability, and security. If you run RStudio on our proposed architecture, you can focus on building applications instead of managing the infrastructure. You can scale to the need of users accessing the dashboard visualizations.This blog post discusses a scalable, secure, and serverless architecture pattern on AWS to host RStudio Server and Shiny App. This follows best practices as suggested inAWS Well-Architected Framework. All the components in this architecture use serverless infrastructure: compute, storage, network, data transfer, orchestration, perimeter security, logging, and monitoring. You are only responsible for managing the containerized application.Solution ArchitectureThis AWS architecture can be implemented onAWS Fargateusing RStudio open source. Fargate is a serverless container service that provides compute capacity forAmazon Elastic Container Service (ECS)andAmazon Elastic Kubernetes Service (EKS).AWS Fargate removes the need to provision and manage servers, lets you specify and pay for resources per application, and improves security through application isolation. It ensures that the infrastructure your containers run on is always up to date with the required patches.Figure 1. RStudio/Shiny Open Source Deployment on AWS Serverless InfrastructureNumbered items refer to Figure 1.R users access RStudio Server and Shiny App viaAmazon Route 53. Route 53 is a DNS service for incoming requests.Route 53 resolves incoming requests and forwards those ontoAWS WAF (Web Application Firewall)for security checks.Valid requests reach anAmazon Application Load Balancer (ALB)which forwards these to theAmazon Elastic Containers Service (ECS)cluster.The cluster service controls the containers and is responsible for scaling up and down the number of instances as needed.Incoming requests are processed by RStudio server; users are authenticated and R sessions are spawned for valid requests. Shiny users are routed to the Shiny container.If the R session communicates with public internet, outbound requests can be filtered via a proxy server and then sent to aNAT Gateway.NAT Gateway sends outbound requests to be processed via anInternet Gateway. Route to internet can also be configured byAWS Transit Gateway.The R users require data files to be transported onto the container. To facilitate this, files are transferred toAmazon Simple Storage Service (S3)usingAWS Transfer Familyor S3 upload.The uploaded files from S3 are synced toAmazon Elastic File System (EFS)byAWS DataSync.Amazon EFS provides the persistent file system required by RStudio server. Data scientists can deploy Shiny apps from their RStudio Server container to the Shiny Server container easily by the shared file system.RStudio can be integrated with S3 and R sessions can queryAmazon Athenatables built on S3 data using a JDBC connection. Athena is a serverless interactive query service that analyses data in Amazon S3 using standard SQL.You can useAmazon ECS Execto log in to both RStudio Open Source and Shiny containers.Key BenefitsHigh Availability:RStudio Server and Shiny App run across twoAvailability Zones (AZ). ALB distributes traffic to the containers and performs health checks on the RStudio services. It instructs ECS to bring up a fresh container due to failure. ECS maintains the desired number of running containers and destroys the unhealthy target.Perimeter Security:The ALB is protected by AWS WAF. ALB checks incoming requests for HTTPS certificate, which is issued and validated byAWS Certificate Manager.Amazon GuardDutydetects threat in the deployment account withinAWS OrganizationsandAWS Shieldprovides DDoS protection for the Route 53 resources. You can also subscribe to AWS Shield Advanced for higher level of protection against attacks targeting your deployment.Private Communication:If all communications amongst AWS services must stay within AWS, you can useAWS PrivateLinkto configure VPC endpoints for AWS services. PrivateLink makes sure that interservice traffic is not exposed to the internet for AWS service endpoints.Vulnerability Scan:Container images should be stored and fetched fromAmazon Elastic Container Registry (ECR)or a container repository with vulnerability scan enabled. Vulnerability issues should be addressed before deploying the images.Persistent Storage:RStudio and Shiny need files presented on a disk in the containers. Amazon EFS provides this persistent storage. Amazon EFS is an NFS file system that stores data in multiple Availability Zones in anAWS Regionfor data durability and high availability.Data on EFS is encrypted at rest usingAWS Key Management Service (KMS).Serverless Data Transfer:AWS DataSync is an agentless service that syncs EFS with S3. RStudio users can upload data or transfer data with AWS Transfer Family, a serverless SFTP service. Files uploaded to S3 will be copied to EFS in an event-driven architecture.AWS Lambdacan trigger an S3 file upload event or this copy can be scheduled with DataSync.The event orchestration can also be synchronized byAmazon EventBridge– a scalable serverless event bus for applications to react in real time.Scalability:In this architecture, you can add capacity to RStudio Server by provisioning a container for each data scientist on different URLs. This is because RStudio Server open source scalability is restricted to only one running container in a Fargate service. An alternative is to use theEC2 launch type of ECS. This offers manydifferent categories of virtual serversto scale vertically depending on your use case.Shiny apps are deployed onto separate containers that support automatic scaling to handle the traffic coming to the interactive dashboard. Customers using RStudio Professional can scale horizontally using Amazon EKS,Cluster Autoscaler, and job launcher. RStudio Professional requires privileged containers, which can run on EC2 launch types, but not on Fargate.Logging and Monitoring:Logging and monitoring infrastructure is provided byAWS CloudTrailandAmazon CloudWatch. All logs can be aggregated into a central audit account in anAWS Control TowerLanding Zone environment.Backup:Files created on the RStudio container EFS mount will be automatically backed up by EFS. Files containing source code will be checked in and out of Git repositories such asAWS CodeCommitdirectly from RStudio Server.User Management:RStudio frontend users are local Linux users. RStudio open source does not provide a federated authentication/authorization mechanism. RStudio Professional provides SAML federated access to RStudio Server and RStudio Connect for authentication of Shiny app usingAmazon Cognito.Next StepsFollowing up on this blog, we’ll publishAWS CDKtemplates automated withAWS CodePipeline. We’ll take you through the technical steps for automated deployment of the entire solution detailed in this architecture. ReadField Notes: Accelerating Data Science with RStudio and Shiny Server on AWS Fargatewhich shows infrastructure code you can use to run a secure, scalable and highly available RStudio and Shiny Server installation on AWS.ConclusionWe discuss a serverless architecture, which addresses common challenges of hosting RStudio/Shiny servers. We use best practices as shown in AWS Well-Architected Framework. This architecture provides data science teams a secure, scalable, and highly available environment while reducing infrastructure management overhead.Chayan PandaChayan Panda is a Senior Cloud Infrastructure Architect with Amazon Web Services in the UK. He has 25 years of experience in technology advisory and enterprise architecture domains. He enables AWS enterprise customers to build secure, scalable and reliable digital transformation solutions. In his spare time, he enjoys a short run, music, a book or travel with his family.Michael HsiehMichael Hsieh is a Principal AI/ML Specialist Solutions Architect. He solves business challenges using AI/ML for customers in the healthcare and life sciences industry. As a Seattle transplant, he loves exploring the great Mother Nature the city has to offer, such as the hiking trails, scenery kayaking in the SLU, and the sunset at Shilshole Bay. As a former long-time resident of Philadelphia, he has been rooting for the Philadelphia Eagles and Philadelphia Phillies.Mukosi MukwevhoMukosi Mukwevho is a Consultant Application Development working for the AWS Professional Services team. He works with customers on both cloud migrations and as well as improving cloud-native applications. Outside of work, he is into fitness and health, enjoys long-distances running (30kms+) and weightlifting.
Data scientists use RStudio server as an Integrated Development Environment (IDE) to develop, publish, and share interactive web dashboards built on Shiny Server. Although it is possible to use virtual server infrastructure in the cloud to run R workloads, containerization offers significant operational benefits. Migrating R workloads into a serverless model in AWS, customers can […]
Chayan Panda
Amazon Athena Amazon Elastic Container Service Amazon Elastic File System (EFS) Amazon Route 53 Architecture AWS Cloud Development Kit AWS DataSync AWS Fargate AWS Transfer Family AWS WAF Elastic Load Balancing Serverless