Overcoming Technical and Policy Challenges in Serverless Adoption

Serverless technology has evolved as a sophisticated approach to building and deploying applications. Removing infrastructure management and offering pay-as-you-go models allows developers to focus on delivering business value.

Despite these advantages, enterprises and developers often face technical and policy-driven resistance when adopting serverless. These challenges range from navigating compliance requirements to addressing the complexities of distributed architectures.

During ServerlessDays, industry experts, including Jeevan Dongre, Eric Johnson, Shilpa Nagavara, and Gunar Grosch, shared their experiences and insights on these challenges. This blog shares their experiences and provides actionable strategies to address the roadblocks to serverless adoption.

TLDR

1. Compliance as a double-edged sword: While compliance requirements can delay serverless adoption due to internal policy, some industries find serverless accelerates compliance and security processes compared to legacy systems
2. Testing complexities in event-driven architecture: Testing becomes challenging across multiple workloads. This lack of seamless end-to-end testing can slow adoption as organizations struggle to ensure system reliability.
3. Traceability challenges: Multiple workloads make it difficult to trace and debug issues when requests fail. Implementing OpenTelemetry standards and advanced trace visualization tools can track requests across distributed systems.
4. Cost understanding: The serverless pay-as-you-go model requires clear insights into application usage and costs, making cost predictability a bottleneck for organizations accustomed to fixed-cost models.

Policy-Driven Challenges in Serverless Adoption

Policy-driven challenges often stem from regulatory requirements and the need to align serverless adoption with existing business processes. This creates friction, delaying serverless implementation.

Compliance and Internal Approval Delays

Compliance concerns and internal approval processes often slow serverless adoption. Organizations, such as finance, healthcare, and government, operate in industries with strict compliance requirements. This means it's not enough for serverless solutions to be technically viable; they must pass the internal policy reviews and align with industry standards.

Eric Johnson shares his experience with a fintech company’s reluctant to adopt API Gateway due to internal policies despite its technical soundness. Developers had to custom-build alternatives, leading to inefficiencies, reduced scalability, and maintenance challenges. Only after long consideration did the company approve its use.

Sometimes, compliance challenges are signs that your tech is outdated. With serverless, you can turn that into an opportunity.

Actionable Strategies:

• Establish a structured internal process and technical demo of compliance capabilities, such as SOC or HIPAA certifications
• Educate internal stakeholders on how compliance is integrated in serverless technologies and managed services
• Highlight the comprehensive compliance credentials of serverless providers (e.g., AWS’s frameworks) to instil confidence

Cost Uncertainty and Decision-Making Hurdles

Cost predictability is a significant concern when transitioning to serverless. Usage-based billing introduces uncertainty, particularly for organizations without a detailed understanding of their system behaviour. This complexity can make serverless adoption appear riskier than it is.

As Gunar Grosch says, “Not having enough understanding of the system you’re building or running makes it harder to predict costs - and tougher for decision-makers to commit.”

The pay-as-you-go model, while flexible, can be concerning for stakeholders used to traditional fixed-cost infrastructures. Unlike physical servers, in serverless architectures, variables like requests, data transfers, and resource consumption can make costs seem unpredictable.

Actionable Strategies:

• Audit your applications to understand usage patterns and potential costs in a cloud environment
• Clearly communicate technical details into cost implications for stakeholders

Technical Challenges in Serverless Adoption

Technical challenges often arise from the unique architectural paradigms of serverless systems. These include issues related to testing, traceability, and integration with legacy systems.

End-to-End Testing in Event-Driven Architectures

Event-driven systems rely on asynchronous communication, making replicating and testing real-world scenarios harder. While individual workloads can be tested in isolation with unit tests and ephemeral environments, the complexity arises for multiple workloads. Testing end-to-end flow in such scenarios becomes critical to ensure system reliability and agility.

Shilpa Nagavara discussed the complexity of testing in event-driven architectures, where requests hop across multiple workloads. Failures often stem from violating service contracts, underscoring the need for robust testing methodologies.

Actionable Strategies:

• Adopt an API-first design and enforce backward compatibility for service contracts
• Use ephemeral environments for testing and automate as much as possible

Traceability in Distributed Systems

Distributed systems lack the centralized logging of monoliths. This complicates visibility into request flows, which makes finding failures without effective tracing a time-intensive task. Engineers need to see the full path of a request to identify where the issues occur, why they happen, and how to resolve them.

Shilpa shares that the difficulty of tracing requests across distributed systems using rudimentary correlation IDs hampers debugging and makes diagnosing failures more challenging.

Actionable Strategies:

• Implement Trace IDs for every request hop using OpenTelemetry (OTEL) standards
• Collaborate with cloud providers (e.g., AWS) to develop robust tools for visualizing request paths and diagnosing failures

Contradictory Perspectives: The Compliance Debate

Compliance is often seen as a hurdle in modernization. But innovation and compliance aren’t at odds if you use the right architecture.

While Eric shares his experience of organizations navigating compliance in modernization, Jeevan Dongre offers a counterpoint of how serverless can simplify compliance.

An InsurTech company in the US modernized its systems using serverless precisely because it streamlined security and compliance compared to legacy systems. Features like built-in encryption, access controls, and audit logging made it an attractive option.

Actionable Strategies:

• Assess your compliance and security requirements to determine how serverless features can address them
• Use serverless tools like AWS IAM for access control and AWS CloudTrail for detailed audit logs
• Work closely with cloud providers to adhere to specific regulatory frameworks

Conclusion

Serverless technology offers scalability, cost-efficiency, and agility, however, political and technical challenges can delay adoption. What you need is a collaborative effort between technical teams, business stakeholders, and compliance departments.