Q:

bcrypt Lambda auto scaling - are you paying for someone else to hack your system?

bcrypt's thing is that it takes a set amount of time to run, so if someone wants to run a brute-force or dictionary attack against your server, bcrypt limits the number of "guesses" that can be run in a set amount of time.
AWS Lambda functions auto-scale. If a Lambda is busy, AWS will helpfully run up another one.
If you want to use bcrypt in a lambda function, the auto-scaling will negate the benefits of a function that takes time to run.
In addition, AWS will charge you for the extra lambda instances,
So you are effectively paying for someone else to hack into your server.
Is there a way to prevent this? eg limit the number of concurrent lambda instances for a particular function (to 1 maybe?)

A:

You can change a Lambda from using the account wide concurrency limit, to a per-lambda concurrency limit:

I suspect you want a value higher than 1, to allow more than one user to log in at a time, but the exact number will depend on the scale of your service.
See the documentation for more details.

