AWS Lambda

Lambda provides managed runtimes for the long-term-support releases of each language and keeps them patched. Each major language version has its own identifier, and you move a function to a newer one by changing that identifier. The table lists the identifiers used for new work and the dates to plan around, taken from the Lambda runtimes page on 2026-10-01.

Points that matter in practice:

For a Java zip, package a "fat" or "shaded" JAR (or a zip with lib/), and set the handler to package.Class::method. For an image, start FROM public.ecr.aws/lambda/java:25 and copy the classes and dependencies into the task root.

The running example is the notifier function: it receives an SQS event and prints one line per message. The handler is deliberately small; the SES call that makes it useful is added in Lambda: Event-Driven and Serverless Apps.

The execution role is the identity the function’s code runs as. It needs a trust policy that lets the Lambda service assume it and a permissions policy with the least access the code requires. Create one role per function so permissions stay narrow.

Trust policy:

Permissions policy for notifier: write its own logs, read messages from the bookshelf-notifications queue it is triggered by, send email from the verified identity, and read one secret.

The managed policy AWSLambdaBasicExecutionRole grants only the three log actions above and is what the console attaches by default. AWSLambdaVPCAccessExecutionRole adds the network-interface actions needed for VPC access. See Defining Lambda function permissions with an execution role and the cross-service view in Identity and Access.

The function’s resource-based policy says which principals and services may invoke it (the execution role says what the code may do). It is limited to 20 KB. An AWS service that triggers the function, such as S3 for thumbnailer, needs a statement that names the service and, to avoid the confused-deputy problem, the source resource and account.

See aws lambda add-permission, get-policy and Viewing resource-based IAM policies in Lambda. In the console choose Configuration, Permissions, Resource-based policy statements, Add permissions. When you add a trigger in the console, Lambda adds this statement for you.

How a function is called decides who handles retries and errors.

See Invoking Lambda functions and put-function-event-invoke-config. Because retries can run a function more than once, handlers should be idempotent. Event source mappings, partial batch responses, dead-letter queues and destinations are covered in Lambda: Event-Driven and Serverless Apps.

A function URL gives a function a dedicated HTTPS endpoint of the form https://<url-id>.lambda-url.<region>.on.aws without an API Gateway or a load balancer. It is dual-stack, reachable only over the public internet (not through PrivateLink), and can be attached to the $LATEST version or to an alias, not to other versions.

For new function URLs since October 2025 both lambda:InvokeFunctionUrl and lambda:InvokeFunction are required; when you create a NONE URL in the console or with SAM, Lambda adds both statements. With the CLI or CloudFormation you add them yourself, and the lambda:InvokedViaFunctionUrl condition keeps the second statement from allowing other invocation methods.

See Configuring Lambda function options. In the console these are under Configuration, General configuration and Environment variables. TieredStopAtLevel=1 trades peak throughput for faster start-up; keep it only if it helps your function.

A layer is a zip archive of libraries, a custom runtime or other dependencies that is extracted under /opt. Functions can attach up to five layers, and layers count toward the 250 MB unzipped package limit. For Java, put JARs under java/lib/ inside the layer zip. Layers work with zip functions only; for container images put the content in the image.

See publish-layer-version and Managing Lambda dependencies with layers. In the console use Layers in the left navigation, Create layer, then on the function Layers, Add a layer. Layer versions are immutable and --layers replaces the whole list. For Java, layers rarely help start-up because the classes still load during INIT; they are mostly a way to share large dependencies or extensions such as the Parameters and Secrets extension.

Publishing a version freezes the current code and configuration under an incrementing number; $LATEST is the mutable working copy. An alias such as live points to a version, and event sources, function URLs and callers use the alias ARN so you can change what runs without changing the caller. A weighted alias sends a percentage of traffic to a second version for canary releases.

Concurrency is the number of in-flight invocations. A function scales out by creating environments, up to 1,000 new environments every 10 seconds per function, bounded by the account’s concurrency quota (1,000 per Region by default, raisable; new accounts start lower and AWS raises the quotas automatically with usage). Each environment can serve up to 10 synchronous requests per second, so the synchronous request-rate ceiling is ten times the concurrency.

Scaling a poller-based function (SQS, Kinesis) depends on the event source mapping settings, not on this table.

See put-function-concurrency, put-provisioned-concurrency-config and Configuring reserved concurrency / provisioned concurrency. In the console open Configuration, Concurrency and recursion detection, Edit for reserved concurrency, and choose the alias, then Configuration, Provisioned concurrency configurations for provisioned concurrency. Provisioned concurrency can follow a schedule or a target-tracking policy through Application Auto Scaling (aws application-autoscaling register-scalable-target with namespace lambda).

SnapStart runs INIT once when you publish a version, takes an encrypted snapshot of the initialized microVM’s memory and disk, and resumes new environments from that snapshot. It supports Java 11 and later, Python 3.12 and later and .NET 8 and later, on zip and container-image functions; Node.js, Ruby and OS-only runtimes are not supported. It works only on published versions and aliases pointing to them (not $LATEST) and cannot be combined with provisioned concurrency, Amazon EFS, S3 Files or more than 512 MB of ephemeral storage.

For Java managed runtimes there is no extra charge for SnapStart itself; you pay normal request and duration charges, including duration for init code that runs when snapshots are refreshed. For Python and .NET, caching and restore charges apply. See Pricing model.

See update-function-configuration and Activating Lambda SnapStart. In the console open Configuration, General configuration, Edit, and set SnapStart to PublishedVersions, then publish a version.

Code that was initialized before the snapshot must be safe to resume many times: do not cache unique values, random seeds, short-lived credentials or open network connections created in INIT. The Java runtime provides CRaC hooks (org.crac) to run code before the snapshot is taken and after it is restored, for example to reopen connections or reseed generators. The AWS SDK for Java 2.x reconnects automatically in most cases. Use "priming" (running a representative request in a beforeCheckpoint hook) to load classes ahead of time. See SnapStart runtime hooks.

By default a function runs in a Lambda-managed network with internet access and cannot reach private resources such as the bookshelf-catalog Aurora database. To reach a VPC, attach the function to private subnets and security groups; Lambda creates shared elastic network interfaces and attaches them for you.

See Giving Lambda functions access to resources in an Amazon VPC. In the console open Configuration, VPC, Edit, and pick the VPC, at least two subnets in different Availability Zones and the security groups. The subnet and security-group IDs are placeholders. The execution role needs AWSLambdaVPCAccessExecutionRole.

Key consequences:

Lambda sends logs to CloudWatch Logs in the group /aws/lambda/<function> and publishes metrics such as Invocations, Errors, Duration, Throttles, ConcurrentExecutions and IteratorAge to CloudWatch.

See aws logs tail and get-metric-statistics. The date -v form is for macOS; on Linux use date -u -d '1 hour ago'. In the console, the Monitor tab shows the metrics and View CloudWatch logs opens the log group. Each REPORT log line shows Duration, Billed Duration, Memory Size, Max Memory Used and, on cold starts, Init Duration. Set the log format to JSON and the application log level in Configuration, Monitoring and operations tools, and set the log group retention, because log groups default to never expiring. Structured logging, Powertools for AWS Lambda and OpenTelemetry are covered in Lambda: Event-Driven and Serverless Apps and Monitoring and Observability.

Quotas change; see the Lambda quotas page and the Service Quotas console (aws service-quotas list-service-quotas --service-code lambda).

Lambda pricing is usage-based, and published prices change by Region, so none are quoted here; use the Lambda pricing page (reviewed 2026-10-01) and the Pricing Calculator. The cost drivers are:

When a function misbehaves, work in this order: the REPORT line and error in CloudWatch Logs; the Errors and Throttles metrics; the execution role and resource policy; the network path for a VPC function; then the event source.

Delete in dependency order. Version-qualified resources go before the function that owns them.

See aws lambda delete-function and the related references for delete-alias, delete-layer-version and iam delete-role. In the console select the function and choose Actions, Delete function; delete layer versions under Layers, the log group in CloudWatch Logs and the role in IAM. Deleting a function that has a function URL deletes the URL asynchronously, and a NONE-type resource policy is not removed automatically, so check any new function created with the same name. If you deployed with SAM or CloudFormation, delete the stack (sam delete or aws cloudformation delete-stack) instead, and empty any S3 bucket that held packages first.