AWS Lambda

AWS Lambda runs code without provisioning servers. You pay only for compute time consumed. Lambda automatically scales from a few requests per day to thousands per second.

Table of Contents

• Core Concepts
• Common Patterns
• CLI Reference
• Best Practices
• Troubleshooting
• References

Core Concepts

Function

Your code packaged with configuration. Includes runtime, handler, memory, timeout, and IAM role.

Invocation Types

Type	Description	Use Case
Synchronous	Caller waits for response	API Gateway, direct invoke
Asynchronous	Fire and forget	S3, SNS, EventBridge
Poll-based	Lambda polls source	SQS, Kinesis, DynamoDB Streams

Execution Environment

Lambda creates execution environments to run your function. Components:

• Cold start: New environment initialization
• Warm start: Reusing existing environment
• Handler: Entry point function
• Context: Runtime information

Layers

Reusable packages of libraries, dependencies, or custom runtimes (up to 5 per function).

Common Patterns

Create a Python Function

AWS CLI:

# Create deployment package
zip function.zip lambda_function.py

# Create function
aws lambda create-function \
  --function-name MyFunction \
  --runtime python3.12 \
  --role arn:aws:iam::123456789012:role/lambda-role \
  --handler lambda_function.handler \
  --zip-file fileb://function.zip \
  --timeout 30 \
  --memory-size 256

# Update function code
aws lambda update-function-code \
  --function-name MyFunction \
  --zip-file fileb://function.zip

boto3:

import boto3
import zipfile
import io

lambda_client = boto3.client('lambda')

# Create zip in memory
zip_buffer = io.BytesIO()
with zipfile.ZipFile(zip_buffer, 'w') as zf:
    zf.writestr('lambda_function.py', '''
def handler(event, context):
    return {"statusCode": 200, "body": "Hello"}
''')
zip_buffer.seek(0)

# Create function
lambda_client.create_function(
    FunctionName='MyFunction',
    Runtime='python3.12',
    Role='arn:aws:iam::123456789012:role/lambda-role',
    Handler='lambda_function.handler',
    Code={'ZipFile': zip_buffer.read()},
    Timeout=30,
    MemorySize=256
)

Add S3 Trigger

# Add permission for S3 to invoke Lambda
aws lambda add-permission \
  --function-name MyFunction \
  --statement-id s3-trigger \
  --action lambda:InvokeFunction \
  --principal s3.amazonaws.com \
  --source-arn arn:aws:s3:::my-bucket \
  --source-account 123456789012

# Configure S3 notification (see S3 skill)

Add SQS Event Source

aws lambda create-event-source-mapping \
  --function-name MyFunction \
  --event-source-arn arn:aws:sqs:us-east-1:123456789012:my-queue \
  --batch-size 10 \
  --maximum-batching-window-in-seconds 5

Environment Variables

aws lambda update-function-configuration \
  --function-name MyFunction \
  --environment "Variables={DB_HOST=mydb.cluster-xyz.us-east-1.rds.amazonaws.com,LOG_LEVEL=INFO}"

Create and Attach Layer

# Create layer
zip -r layer.zip python/

aws lambda publish-layer-version \
  --layer-name my-dependencies \
  --compatible-runtimes python3.12 \
  --zip-file fileb://layer.zip

# Attach to function
aws lambda update-function-configuration \
  --function-name MyFunction \
  --layers arn:aws:lambda:us-east-1:123456789012:layer:my-dependencies:1

Invoke Function

# Synchronous invoke
aws lambda invoke \
  --function-name MyFunction \
  --payload '{"key": "value"}' \
  response.json

# Asynchronous invoke
aws lambda invoke \
  --function-name MyFunction \
  --invocation-type Event \
  --payload '{"key": "value"}' \
  response.json

CLI Reference

Function Management

Command	Description
aws lambda create-function	Create new function
aws lambda update-function-code	Update function code
aws lambda update-function-configuration	Update settings
aws lambda delete-function	Delete function
aws lambda list-functions	List all functions
aws lambda get-function	Get function details

Invocation

Command	Description
aws lambda invoke	Invoke function
aws lambda invoke-async	Async invoke (deprecated)

Event Sources

Command	Description
aws lambda create-event-source-mapping	Add event source
aws lambda list-event-source-mappings	List mappings
aws lambda update-event-source-mapping	Update mapping
aws lambda delete-event-source-mapping	Remove mapping

Permissions

Command	Description
aws lambda add-permission	Add resource-based policy
aws lambda remove-permission	Remove permission
aws lambda get-policy	View resource policy

Best Practices

Performance

• Right-size memory: More memory = more CPU = faster execution
• Minimize cold starts: Keep functions warm, use Provisioned Concurrency
• Optimize package size: Smaller packages deploy faster
• Use layers for shared dependencies
• Initialize outside handler: Reuse connections across invocations

# GOOD: Initialize outside handler
import boto3
dynamodb = boto3.resource('dynamodb')
table = dynamodb.Table('MyTable')

def handler(event, context):
    # Reuses existing connection
    return table.get_item(Key={'id': event['id']})

Security

• Least privilege IAM roles — only grant needed permissions
• Use Secrets Manager for sensitive data
• Enable VPC only if needed (adds latency)
• Encrypt environment variables with KMS

Cost Optimization

• Set appropriate timeout — don't use max 15 minutes unnecessarily
• Use ARM architecture (Graviton2) for 34% better price/performance
• Batch process where possible
• Use Reserved Concurrency to limit costs

Reliability

• Configure DLQ for async invocations
• Handle retries — async events retry twice
• Make handlers idempotent
• Use structured logging

Troubleshooting

Timeout Errors

Symptom: Task timed out after X seconds

Causes:

• Function takes longer than timeout
• Network call to unreachable resource
• VPC configuration issues

Debug:

# Check function configuration
aws lambda get-function-configuration \
  --function-name MyFunction \
  --query "Timeout"

# Increase timeout
aws lambda update-function-configuration \
  --function-name MyFunction \
  --timeout 60

Out of Memory

Symptom: Function crashes with memory error

Fix:

aws lambda update-function-configuration \
  --function-name MyFunction \
  --memory-size 512

Cold Start Latency

Causes:

• Large deployment package
• VPC configuration
• Many dependencies to load

Solutions:

• Use Provisioned Concurrency
• Reduce package size
• Use layers for dependencies
• Consider Graviton2 (ARM)

# Enable Provisioned Concurrency
aws lambda put-provisioned-concurrency-config \
  --function-name MyFunction \
  --qualifier LIVE \
  --provisioned-concurrent-executions 5

Permission Denied

Symptom: AccessDeniedException

Debug:

# Check execution role
aws lambda get-function-configuration \
  --function-name MyFunction \
  --query "Role"

# Check role policies
aws iam list-attached-role-policies \
  --role-name lambda-role

VPC Connectivity Issues

Symptom: Cannot reach internet or AWS services

Causes:

• No NAT Gateway for internet access
• Missing VPC endpoint for AWS services
• Security group blocking outbound

Solutions:

• Add NAT Gateway for internet
• Add VPC endpoints for AWS services
• Check security group rules

References

• Lambda Developer Guide
• Lambda API Reference
• Lambda CLI Reference
• boto3 Lambda