Proof of Concept: Implementation of Refresh Access Token in Rust

[BMorinDrifter]

This PR is for discussion and would not expect or endorse it being merged into main as-is.

Implementation of the Refresh Token function written in Rust. I saw in the ballpark of a 10x reduction in the amount of compute needed (pending confirmation with a larger sample size). I do not currently have a stress harness nor the resources to run one.

Ballpark figures I was seeing:
Python 3.11 2048mb x86_64
cold ~400ms
warm ~80ms

Rust 256mb arm64
cold ~400ms
warm ~40ms

I also dialed the Python 3.11 version down to 256mb to confirm it was not io bound
cold ~2500ms
warm ~675ms

This would reduce the overall cost to run the solution, perhaps even as far as API Gateway + WAF becoming the dominant drivers for cost. It would also take pressure off any account level Lambda service quotas during a launch event.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[juhoaws]

This looks really promising, very impressive data points! I can run this with a load test setup I have. It's very likely it scales horizontally with similar performance.

As you said, this is a bigger change, and will require a few key considerations. The main one would be whether we would keep both Python and Rust options. And then the overall familiarity of Rust within developers as it's common to extend the solution for custom use cases.

[BMorinDrifter]

There is a lot of value having high frequency functions that aren't changed much in Rust. Particularly stuff that would be in the line of fire during a product launch. Refresh Token is the easiest target. Anon login, Steam Auth, etc. would be the next couple I'd pick off.

Also when thinking about this, I'm curious how complicated you think the Rust function is. I consider myself an intermediate Rust programmer and have done a lot of exploration of it in Lambda, so it's a straight forward read for me. Figuring out how to do things can be slower than Python and sometimes you stumble into a "Rust Problem" or "Borrow Checker Fight". However, given a working lambda function as a starting point I don't think it would be difficult for a generalist engineer to modify.

edit: One last Rust vs Python observation from using both in a live game service. Python does more runtime binding and will even let you have code that wouldn't have even compiled in infrequent code paths. The mitigation for this is more test coverage. I have also run into Python dependency chain issues that aren't straight forward to resolve (keithrozario/Klayers#305, #10)

also: @calavera for visibility

[juhoaws]

Valid points and I definitely don't think Rust syntax is difficult for an average developer. It's just a bit new, and new can always be intimidating and challenging for many reasons. And agree that there's a set of baseline API:s that are not likely to change often. And the performance improvements are very impressive, so we definitely need to look into this more in-depth!