AWS LambdaAuthorCloudBrum editorial teamLast reviewed22 Oct 2026Reading time~12 minLevelBeginner to advanced

• Starts on eventsA function can wake up for an HTTP call, a queue message, a file upload, a schedule, a database change or another AWS event.
• Zip or container imageShip a small zip archive or a container image of up to 10 GB, and share libraries between functions with layers.
• Scales by itselfLambda adds execution environments as events arrive, within your account and per-function concurrency limits, and removes them when traffic stops.
• Memory sets the powerPick 128 MB to 10,240 MB. CPU and network share grow with memory, so a bigger setting can finish sooner.
• Up to 15 minutes a runEach invocation can run for up to 900 seconds, which suits short jobs rather than long-lived processes.
• Arm or x86Run on Graviton (arm64) for a lower price per millisecond, or on x86_64 when a library only exists for Intel and AMD.
• Built-in HTTPS endpointA function URL gives a function its own HTTPS address, and response streaming can send large output as it is produced.
• Versions and aliasesPublish immutable versions, point an alias such as prod at one, and shift traffic gradually between two versions.

Function

Your code plus its settings: runtime, handler, memory, timeout, permissions and environment variables.

Handler

The entry point Lambda calls with each event, written as the file and function name, for example lambda_function.handler.

Event and trigger

The event is the JSON data passed in. The trigger is the service or schedule that produces it, such as API Gateway, S3, SQS or EventBridge.

Execution environment

A small isolated sandbox that holds your code and its runtime. Lambda reuses it for later invocations until it is retired.

Cold start

The extra time when Lambda has to create a new execution environment, load your code and run its start-up code before the handler.

Concurrency

The number of invocations running at the same moment. Each Region has an account limit, and you can reserve or limit it per function.

Execution role

The IAM role the function assumes at run time. It decides which AWS services your code may call.

Resource-based policy

A policy on the function that says who may invoke it, for example a named API Gateway or bucket in a named account.

Event source mapping

A Lambda-managed poller that reads from a queue or stream (SQS, Kinesis, DynamoDB Streams and others) and calls your function with batches.

Version and alias

A version is an unchangeable snapshot of code and settings. An alias is a movable name, such as prod, that points at a version.

Layer

A zip of libraries or data that several functions can load, kept separate from the function code.

Provisioned concurrency

Execution environments Lambda keeps initialised and ready, for latency-sensitive functions. You pay for them while they are held.

Idempotency

Handling the same event twice without a harmful second effect. Lambda delivery is at least once, so duplicates will happen.

Create a function in the AWS console

1. Open Lambda and choose Create functionIn the AWS console search for Lambda, pick your Region, then choose Create function and Author from scratch.
2. Name it and choose a runtimeUse a clear name such as orders-processor. Pick the language runtime and, unless a library needs Intel or AMD, the arm64 architecture.
3. Let Lambda create the execution roleThe default role only writes logs to CloudWatch. Add exactly the permissions your code needs later, and nothing wider.
4. Add your codeEdit in the console for a first test, or upload a zip or container image. Make sure the handler setting matches your file and function name.
5. Set memory, timeout and storageStart with 256 MB and a timeout a little above the normal run time. Raise memory if a run is slow, then check the result in the logs.
6. Add configuration and secretsPut plain settings in environment variables. Keep passwords and keys in AWS Secrets Manager or Parameter Store, and read them at start-up.
7. Connect a triggerAdd API Gateway, a function URL, an SQS queue, an S3 event or a schedule. For queues, set the batch size and turn on partial batch responses.
8. Test and read the logsRun a test event in the console, then open the log group in CloudWatch. The REPORT line shows duration and the memory actually used.
9. Make it safe to run in productionAdd a dead-letter queue or failure destination, set reserved concurrency to protect downstream systems, publish a version and point an alias at it.

• Measure, then size. Try several memory settings and keep the one with the best cost for the speed you need. The open-source AWS Lambda Power Tuning tool automates this.
• Do start-up work once. Create SDK clients, open connections and load configuration outside the handler so warm runs skip them.
• Keep the package small. Fewer and lighter dependencies mean a faster start. Tree-shake or bundle where the language allows it.
• Choose arm64 where your code and libraries support it; many workloads run faster per dollar there.
• Cut cold starts where users feel them. SnapStart (for Java, Python and .NET) or provisioned concurrency can keep latency steady. They do not combine, so pick one.
• Skip the VPC unless you need private resources. Use VPC endpoints or a proxy such as RDS Proxy to avoid exhausting database connections.
• Tune batches for queues and streams. A larger batch and a short batching window lower the number of invocations, within what your downstream can take.
• Do not wait inside a function. Hand slow work to a queue or a workflow so you are not paying for idle time.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for AWS Lambda.

• Right-size memory. Over-sized memory wastes money, and under-sized memory makes runs longer. Measure both sides.
• Use arm64. Duration is billed at a lower rate on Graviton, around a fifth cheaper in the published example prices.
• Filter events at the source. Event filtering on SQS, Kinesis, DynamoDB Streams and EventBridge means the function runs only for events you care about.
• Batch where you can. One invocation for ten messages is cheaper than ten invocations.
• Shorten the run. Set client timeouts, avoid polling and move long waits out of the function.
• Use provisioned concurrency sparingly. It is billed while held, so keep it for steady, latency-critical traffic and schedule it down off-peak.
• Commit if usage is steady. Compute Savings Plans can apply to Lambda usage.
• Watch the neighbours. API Gateway, NAT gateways, CloudWatch Logs ingestion, data transfer and KMS calls can cost more than the function itself.
• Set log retention on every log group so logs do not grow forever.
• Add budgets and anomaly alerts, and tag functions by team and product.

• Give each function its own least-privilege role, scoped to named resources, not *.
• Lock down invocation with a tight resource-based policy that names the calling service, account and source ARN.
• Never leave a function URL or API open. Use IAM authentication, an authoriser or Amazon Cognito, and add AWS WAF for public APIs.
• Validate all input and use parameterised queries. Treat every event field as untrusted.
• Keep secrets in Secrets Manager or Parameter Store; use KMS keys you control when rules demand it.
• Attach to a VPC only when needed, with narrow security groups and private endpoints for AWS services.
• Use code signing to allow only trusted packages where your policy requires it.
• Scan dependencies and images (Amazon Inspector) and review any third-party layer before use.
• Keep runtimes current and retire functions you no longer use.
• Record CloudTrail events, send structured logs to CloudWatch, and alarm on errors and throttles.

For audits, use AWS CloudTrail for who-changed-what, AWS Config for configuration history and AWS Artifact to download compliance reports. AWS Lambda sits inside the scope of many assurance programmes, but compliance is shared: AWS secures the platform and you secure your code, permissions, data and settings.

• Right-size and shorten runs. Less memory and less time mean less energy used for the same result.
• Choose arm64 where it fits; it generally does the same work with less power.
• Avoid polling and needless invocations by using events, filters and batching.
• Pick lower-carbon Regions when latency, cost and data rules allow.
• Let idle functions cost nothing. With no traffic nothing runs, which beats a half-empty server for spiky work.
• Delete what you do not use, including old versions, layers, images and log groups.
• Measure it. The AWS Customer Carbon Footprint Tool reports estimated emissions for your account; check what it covers for your usage.

Purchase options

What you actually pay for

• Requests (per million invocations)
• Duration in GB-seconds, at a lower rate on arm64 (depending on runtime and packaging, the start-up phase can be billed too)
• Provisioned concurrency, if used
• Ephemeral storage above the included amount
• Data transfer out and the services around the function: API Gateway, CloudWatch Logs, NAT, KMS, X-Ray

A small function that saves orders from an SQS queue, ignores duplicates, and reports only the failed messages so just those are retried. The CLI and Terraform tabs deploy it; the Python and C# tabs hold the handler. Replace the placeholder names and the account ID with your own.

# Package the code and create a small function on Arm (Graviton)
zip function.zip lambda_function.py

aws lambda create-function \
  --function-name orders-processor \
  --runtime python3.13 \
  --architectures arm64 \
  --handler lambda_function.handler \
  --role arn:aws:iam::123456789012:role/orders-processor-role \
  --zip-file fileb://function.zip \
  --memory-size 256 \
  --timeout 30 \
  --environment "Variables={TABLE_NAME=orders}" \
  --tracing-config Mode=Active \
  --tags Env=dev,Owner=platform-team

# Read from an SQS queue and report failures one message at a time
aws lambda create-event-source-mapping \
  --function-name orders-processor \
  --event-source-arn arn:aws:sqs:ap-south-1:123456789012:orders \
  --batch-size 10 \
  --maximum-batching-window-in-seconds 5 \
  --function-response-types ReportBatchItemFailures \
  --scaling-config MaximumConcurrency=10

# Never let this function use more than 20 concurrent executions
aws lambda put-function-concurrency \
  --function-name orders-processor \
  --reserved-concurrent-executions 20

# Try it with a test event (AWS CLI v2 needs the binary-format flag for JSON payloads)
aws lambda invoke --function-name orders-processor \
  --cli-binary-format raw-in-base64-out \
  --payload file://test-event.json response.json

# Assumes an SQS queue (aws_sqs_queue.orders) and a DynamoDB table (aws_dynamodb_table.orders) are defined elsewhere
data "archive_file" "function" {
  type        = "zip"
  source_file = "${path.module}/lambda_function.py"
  output_path = "${path.module}/function.zip"
}

resource "aws_iam_role" "orders" {
  name = "orders-processor-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Action    = "sts:AssumeRole"
      Principal = { Service = "lambda.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy" "orders" {
  name = "orders-processor-access"
  role = aws_iam_role.orders.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      { Effect = "Allow", Action = ["sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueAttributes"], Resource = aws_sqs_queue.orders.arn },
      { Effect = "Allow", Action = ["dynamodb:PutItem"], Resource = aws_dynamodb_table.orders.arn },
      { Effect = "Allow", Action = ["logs:CreateLogStream", "logs:PutLogEvents"], Resource = "${aws_cloudwatch_log_group.orders.arn}:*" },
      { Effect = "Allow", Action = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"], Resource = "*" }
    ]
  })
}

resource "aws_cloudwatch_log_group" "orders" {
  name              = "/aws/lambda/orders-processor"
  retention_in_days = 30
}

resource "aws_lambda_function" "orders" {
  function_name    = "orders-processor"
  role             = aws_iam_role.orders.arn
  runtime          = "python3.13"
  architectures    = ["arm64"]
  handler          = "lambda_function.handler"
  filename         = data.archive_file.function.output_path
  source_code_hash = data.archive_file.function.output_base64sha256
  memory_size      = 256
  timeout          = 30

  environment {
    variables = { TABLE_NAME = aws_dynamodb_table.orders.name }
  }

  tracing_config {
    mode = "Active"
  }

  logging_config {
    log_format = "JSON"
    log_group  = aws_cloudwatch_log_group.orders.name
  }

  tags = {
    Env   = "dev"
    Owner = "platform-team"
  }
}

resource "aws_lambda_event_source_mapping" "orders" {
  event_source_arn                   = aws_sqs_queue.orders.arn
  function_name                      = aws_lambda_function.orders.arn
  batch_size                         = 10
  maximum_batching_window_in_seconds = 5
  function_response_types            = ["ReportBatchItemFailures"]

  scaling_config {
    maximum_concurrency = 10
  }
}

# lambda_function.py (no packages to add: boto3 is included in the Python runtime)
import json
import logging
import os
from decimal import Decimal

import boto3
from botocore.exceptions import ClientError

logger = logging.getLogger()
logger.setLevel(logging.INFO)

# Created once per execution environment and reused by later invocations
table = boto3.resource("dynamodb").Table(os.environ["TABLE_NAME"])


def save_order(order):
    """Write the order once. A repeated message is ignored, so retries are safe."""
    try:
        table.put_item(Item=order, ConditionExpression="attribute_not_exists(order_id)")
    except ClientError as err:
        if err.response["Error"]["Code"] != "ConditionalCheckFailedException":
            raise


def handler(event, context):
    failed = []
    for record in event["Records"]:
        try:
            save_order(json.loads(record["body"], parse_float=Decimal))
        except Exception:
            logger.exception("could not process message %s", record["messageId"])
            failed.append({"itemIdentifier": record["messageId"]})
    return {"batchItemFailures": failed}

// dotnet new classlib, then add these packages:
//   Amazon.Lambda.Core, Amazon.Lambda.SQSEvents, Amazon.Lambda.Serialization.SystemTextJson, AWSSDK.DynamoDBv2
// Handler setting: OrdersProcessor::OrdersProcessor.Function::Handler
using System.Text.Json;
using Amazon.DynamoDBv2;
using Amazon.DynamoDBv2.Model;
using Amazon.Lambda.Core;
using Amazon.Lambda.SQSEvents;

[assembly: LambdaSerializer(typeof(Amazon.Lambda.Serialization.SystemTextJson.DefaultLambdaJsonSerializer))]

namespace OrdersProcessor;

public class Function
{
    // Created once per execution environment and reused by later invocations
    private static readonly AmazonDynamoDBClient Dynamo = new();
    private static readonly string Table = Environment.GetEnvironmentVariable("TABLE_NAME")!;

    public async Task<SQSBatchResponse> Handler(SQSEvent sqsEvent, ILambdaContext context)
    {
        var failures = new List<SQSBatchResponse.BatchItemFailure>();
        foreach (var message in sqsEvent.Records)
        {
            try
            {
                using var doc = JsonDocument.Parse(message.Body);
                var orderId = doc.RootElement.GetProperty("order_id").GetString()!;
                await Dynamo.PutItemAsync(new PutItemRequest
                {
                    TableName = Table,
                    Item = new Dictionary<string, AttributeValue> { ["order_id"] = new(orderId), ["body"] = new(message.Body) },
                    ConditionExpression = "attribute_not_exists(order_id)"
                });
            }
            catch (ConditionalCheckFailedException)
            {
                // Already saved: a repeated message is safe to skip
            }
            catch (Exception ex)
            {
                context.Logger.LogError($"could not process {message.MessageId}: {ex.Message}");
                failures.Add(new SQSBatchResponse.BatchItemFailure { ItemIdentifier = message.MessageId });
            }
        }
        return new SQSBatchResponse(failures);
    }
}

Videos picked for this service. Each one is labelled with its source, opens on YouTube if you prefer, and loads only when you press play.

Not sure a function is the right size? Compare with Amazon EC2 for servers you control, AWS Fargate for containers without servers, and AWS Step Functions for workflows that call several functions.