AWS Lambda

What it is

AWS Lambda is a serverless compute service: you run code without provisioning or managing servers. Lambda handles server maintenance, capacity, scaling, and patching. You write a handler function, connect it to a trigger, such as API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway, S3, SQS, EventBridge, or one of more than 200 AWS services, and Lambda runs it for each event, scaling automatically and charging only while your code runs.

Choose Lambda for Event-driven architectureA design in which services react to events that other services emit, such as an order placed or a file uploaded, instead of calling each other directly. Amazon EventBridge, Amazon SNS, Amazon SQS, and AWS Lambda are common building blocks.Glossary entry, short-running work: APIs, file processing when objects land in S3, stream and queue processing, scheduled jobs, and glue between services. For long-running servers, specific operating system control, or GPU (Graphics processing unit)A processor with thousands of small cores that run many calculations in parallel. GPUs speed up machine learning, graphics, and video work; EC2 instance families such as P and G include them.Glossary entry, use containers or EC2 instead.

Naming update: AWS now calls the classic Lambda function a Lambda Event Function, to distinguish it from two new compute types: Lambda Web Functions (HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry servers that handle many concurrent requests) and Lambda MicroVMs (isolated environments that live up to 8 hours). APIs, templates, and ARN (Amazon Resource Name)The unique identifier of an AWS resource, in the form arn:partition:service:region:account-id:resource. IAM policies use ARNs to name the resources they allow or deny.Glossary entry still use "function". Exam questions describe Event Functions.

Key limits

Setting	Limit
Timeout	Up to 900 seconds (15 minutes); the default is 3 seconds, so raise it for longer work. Lambda Managed Instances allow up to 90 minutes for asynchronous and most event source mapping invocations
Memory	128 MB to 10,240 MB; CPU is allocated in proportion to memory: about 1 vCPU at 1,769 MB, up to 6 vCPUs at 10,240 MB. There is no separate CPU setting
Ephemeral storage (`/tmp`)	512 MB to 10,240 MB
Deployment package	50 MB zipped (direct upload), 250 MB unzipped; container images up to 10 GB
Layers	Up to 5 per function
Environment variables	4 KB in total
Payload	6 MB request and response for synchronous calls (200 MB when streaming the response); 1 MB for asynchronous calls
Concurrency	1,000 concurrent executions per AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry by default (can be raised)

How functions are invoked

Synchronous: the caller waits for the result, for example API Gateway, an ALB, or an SDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entry call.
Asynchronous: the caller hands the event to Lambda, which queues it and returns immediately, for example S3 events, SNS, or EventBridge.
- On errors, Lambda retries twice by default. Set retry attempts to 0, 1, or 2, for example 0 when a retry would repeat a side effect.
- If the function is ThrottlingLimiting how many requests a client can make in a period. A throttled request is rejected, often with HTTP status 429 or a throttling error, and should be retried later with backoff.Glossary entry, Lambda keeps the event for up to 6 hours by default; lower the maximum event age to discard stale events sooner.
- Send invocation records to destinations on success or failure: SQS, SNS, Lambda, or EventBridge (and S3, for failures only). The record includes the event and the function's error response. A DLQ (Dead-letter queue)A queue that receives messages that could not be processed after a set number of attempts, so they stop blocking other messages and can be inspected later. Amazon SQS, Amazon SNS, AWS Lambda, and Amazon EventBridge can send failed messages to one.Glossary entry (SQS or SNS) receives only the event, with the error code and message as attributes.
- Once Lambda accepts an event from SNS or EventBridge, delivery has succeeded. Function errors are then handled by the function's retries, destination, or DLQ; an SNS subscription DLQ or an EventBridge target DLQ catches only events that couldn't be delivered to Lambda.
Event source mappings: Lambda polls a stream or queue and invokes the function with batches of records. Sources include SQS, Kinesis Data Streams, DynamoDB Streams, Amazon MSK and self-managed Kafka, Amazon MQ, and DocumentDB. Processing is at least once, so make functions IdempotencyAn operation is idempotent when repeating it has the same effect as doing it once, such as setting a value rather than adding to it. It makes retries safe; many AWS APIs accept a client token for this.Glossary entry.
- Event filtering: add filter criteria to the mapping so that Lambda invokes the function only for matching records, and you don't pay for the rest. Non-matching SQS messages are deleted from the queue.
- Stream errors (Kinesis, DynamoDB Streams): records in a shard are processed in order, and by default a failing batch is retried until its records expire, blocking the shard. Turn on bisect batch on function error to isolate the bad record, set maximum retry attempts or maximum record age, and add an on-failure destination (SQS or SNS) to record discarded batches.
- For an SQS source, configure the dead-letter queue on the source queue, not on the function.

How a Lambda function is invoked. API Gateway calls the function synchronously and waits for the result. An S3 event is sent asynchronously to Lambda's event queue, which invokes the function and retries twice on errors; failed events go to an on-failure destination. With an event source mapping, Lambda polls an SQS queue and invokes the function with batches of messages.

Concurrency and scaling

Concurrency is the number of requests running at the same time. Each function can scale by up to 1,000 execution environments every 10 seconds.
Reserved concurrency sets aside capacity for a function and also caps it, protecting other functions and downstream systems.
Provisioned concurrency keeps environments pre-initialized, removing Cold startThe extra delay when AWS Lambda must create a new execution environment, load the code, and run its initialization before handling a request. Later requests reuse the environment and are faster; provisioned concurrency avoids cold starts.Glossary entry for LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry-sensitive functions, at extra cost.
SnapStart (Java 11+, Python 3.12+, .NET 8+) speeds up startup by restoring a snapshot of an initialized environment. It works only on published versions (and aliases that point to them), and it can't be combined with provisioned concurrency, Amazon EFS, or more than 512 MB of ephemeral storage.

Security, resilience, performance, and cost

Security

An execution role gives the function permissions to call other AWS services. A Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry controls who can invoke it, such as S3 or another account.
Function URLs provide a dedicated HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry endpoint, with auth type AWS_IAM or NONE. Callers need both lambda:InvokeFunctionUrl and lambda:InvokeFunction permissions.
Lambda always encrypts environment variables at rest with KMS, by default with an AWS managed key. Choose a Customer managed keyA KMS key that you create, own, and manage: you control its key policy, rotation, and deletion. AWS managed keys, in contrast, are created and managed for you by an AWS service.Glossary entry to control the key (rotate or disable it); then only users with kms:Decrypt on that key can view the values. Keep secrets that rotate in Secrets Manager.

VPC access

Attach a function to a VPC to reach private resources, such as RDS in SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry. Lambda uses shared Hyperplane ENI (Elastic network interface)A virtual network card in a VPC subnet, with private IP addresses, security groups, and a MAC address. EC2 instances, Lambda functions connected to a VPC, and interface endpoints all connect through network interfaces.Glossary entry.
A VPC-attached function needs a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry, or VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry, to reach the internet or public AWS endpoints.
Use RDS Proxy for databases, so many concurrent functions don't exhaust connections. The proxy reads database credentials from Secrets Manager and can require IAM authentication, so functions connect with a token from their execution role (rds-db:connect) instead of a stored password.
Mount Amazon EFS (through an access point, from a VPC-attached function) for files that must persist and be shared between invocations, functions, and EC2 instances. /tmp belongs to one execution environment and is lost when it ends.

A Lambda function attached to a VPC. In a private subnet, the function connects to RDS Proxy, which pools connections to an RDS database. For outbound internet access, the function's traffic goes through a NAT gateway in a public subnet to the internet.

Resilience

Lambda runs functions in multiple AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry automatically. For VPC-attached functions, choose subnets in several Availability Zones. Use destinations or DLQs and idempotent code for failures.
Avoid recursive loops, such as a function that writes its output back to the S3 bucket that triggers it: scope the trigger to a prefix and write elsewhere. Recursive loop detection stops a function after about 16 invocations in one chain through SQS, SNS, S3, or EventBridge custom event buses.

Deployment

Versions are immutable snapshots of code and settings.
Aliases point to versions and can split traffic between two of them for canary releases.
Layers share libraries between functions; container images package larger dependencies.

Cost

Pay per request and per GB-second of duration (memory × time). The free tier includes 1 million requests and 400,000 GB-seconds per month.
arm64 (Graviton2) functions can achieve significantly better price-performance.
Compute Savings Plans apply to Lambda.
Lambda Managed Instances run functions on EC2 instances you choose, with EC2 pricing options such as Savings Plans and RI (Reserved Instance)A billing discount for committing to an instance type in a Region or Availability Zone for one or three years. It is not an instance: running instances that match are billed at the lower rate. AWS now recommends Savings Plans instead.Glossary entry.

Monitoring

CloudWatch metrics (invocations, errors, duration, throttles, concurrency) and CloudWatch Logs.
X-Ray tracing and Lambda Insights.

New: durable functions

Lambda durable functions build multi-step workflows that can run for up to one year, using checkpoints and waits that don't incur compute charges. For exam questions about orchestrating many steps, Step Functions remains the classic answer.

Lambda or another option?

If the requirement is	Choose
Short event-driven code, no servers	AWS Lambda
Work longer than 15 minutes, or long-running services	ECS or EKS on Fargate, or EC2
Orchestrate many steps with retries and branching	AWS Step Functions
A REST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entry API in front of functions	API Gateway with Lambda
Decouple producers and consumers	SQS with a Lambda event source mapping
Code at CloudFront Edge locationAn AWS site in a city, separate from the Regions, where Amazon CloudFront caches content close to users. Route 53, AWS WAF, AWS Shield, and AWS Global Accelerator also use the edge network, which has hundreds of locations.Glossary entry	Lambda@Edge or CloudFront Functions

Reverse mindmap: when the question points here

Is it AWS Lambda?

Yes, when the question says
- Run code without servers, pay per use leads to Lambda
- Process files when uploaded to S3 leads to S3 event to Lambda
- Files shared with other functions and EC2 leads to Mount Amazon EFS
- Process an SQS queue or Kinesis stream leads to Event source mapping
- Scheduled job leads to EventBridge Scheduler to Lambda
Tune it
- Cold starts hurt latency leads to Provisioned concurrency or SnapStart
- Protect a database from too many invocations leads to Reserved concurrency, RDS Proxy
- Needs more CPU leads to Increase memory
- Times out after 3 seconds leads to Raise the timeout
- Invoked for messages it ignores leads to Event filtering
- One bad record blocks a stream shard leads to Bisect batch, retry limit, on-failure destination
- Retries repeat side effects leads to Retry attempts 0
- Environment variables under a key you control leads to Customer managed KMS key
- S3 output re-triggers the function leads to Separate prefix or bucket
- Reach RDS in a private subnet leads to VPC-attached function
- VPC function needs the internet leads to NAT gateway
- Capture failed async events with error details leads to On-failure destination
- Canary release leads to Alias with weighted versions
- Lower cost per invocation leads to arm64
No, when the question says
- Runs longer than 15 minutes leads to Fargate, EC2, or Step Functions
- Needs GPUs or OS control leads to EC2

Key takeaways

Lambda runs event-driven code without servers, scaling automatically and charging per request and GB-second.
Limits: 15-minute timeout (3-second default), 128 MB–10 GB memory (CPU scales with it), 10 GB /tmp, 6 MB synchronous and 1 MB asynchronous payloads, 1,000 default concurrency.
Invocations are synchronous, asynchronous (0–2 retries, destinations with error details, DLQ), or through event source mappings that poll queues and streams, with filtering and stream error handling.
Reserved concurrency guarantees and caps; provisioned concurrency and SnapStart reduce cold starts.
VPC functions need NAT (Network address translation)Rewriting the IP addresses in packets as they pass through a device, most often so that many private addresses can share one public address to reach the internet.Glossary entry or VPC endpoints for outside access; use RDS Proxy for databases.
AWS now calls these Lambda Event Functions, alongside new Web Functions, MicroVMs, Managed Instances, and durable functions.