Lambda

AWS Lambda is a serverless compute service that runs your code in response to events and scales automatically, with no servers to manage. You package code as a .zip archive or a container image, give it an execution role, and Lambda handles provisioning, scaling, and logging.

With the Lambda integration, you can:

  • Invoke Function: Run a function synchronously and read back its parsed response payload, queue it asynchronously, or dry-run it to verify permissions — with the decoded execution log tail when something fails
  • Manage functions: Create, read, update, and delete functions, including runtime, handler, memory, timeout, ephemeral storage, environment variables, VPC attachment, layers, X-Ray tracing, SnapStart, and CloudWatch log settings
  • Version and alias: Publish immutable versions, then point aliases such as prod at them — including weighted routing to shift a percentage of traffic to a new version for canary releases
  • Wire up event sources: Create and tune event source mappings for SQS, Kinesis, DynamoDB Streams, Amazon MQ, DocumentDB, Amazon MSK, and self-managed Kafka — with batch size, batching window, filter patterns, retry limits, success/failure destinations, broker authentication, and consumer group IDs
  • Control concurrency: Reserve a share of account concurrency for a function, allocate provisioned concurrency to a version or alias to eliminate cold starts, and read account-level limits and usage
  • Expose function URLs: Create dedicated HTTPS endpoints with AWS_IAM or public auth, buffered or streamed responses, and full CORS configuration
  • Configure async behavior: Set retry attempts, maximum event age, and on-success/on-failure destinations for asynchronous invocations
  • Audit access: Read a function's resource-based policy, add and remove permission statements for AWS services or accounts, and list function URL configurations to find publicly reachable endpoints
  • Work with layers and tags: List layers and their versions, fetch a layer version's download location, and list, add, or remove function tags

Credentials and permissions

The block authenticates with an AWS access key ID and secret access key scoped to a region. Grant the IAM principal only the Lambda actions the operations you use require — for example lambda:InvokeFunction for invocation, lambda:GetFunction and lambda:ListFunctions for read-only inventory, or lambda:UpdateFunctionCode and lambda:PublishVersion for deployments.

Deployment packages

Function code is supplied from Amazon S3 (bucket, key, and optional object version) or from a container image URI in Amazon ECR. Uploading a .zip archive inline is not supported — publish the archive to S3 first, in the same region as the function, then point Create Function or Update Function Code at it.

In Sim, the Lambda integration lets your agents run existing serverless code as a step in a workflow, ship and roll back deployments with alias traffic shifting, and continuously audit functions for deprecated runtimes, over-permissive policies, and publicly exposed URLs. It pairs naturally with CloudWatch for metrics and logs, S3 for deployment artifacts, and SQS for event sources.

Usage Instructions

Integrate AWS Lambda into workflows. Invoke functions and read their response payload, create and update functions from Amazon S3 packages or container images, publish versions and aliases, wire up event source mappings, manage concurrency, function URLs, layers, permissions, and tags. Requires an AWS access key and secret access key.

Actions

Lambda Invoke Function

Invoke a Lambda function synchronously or asynchronously and return its response

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
payloadjsonNoJSON event payload passed to the function handler
invocationTypestringNoRequestResponse waits for the result, Event queues the invocation, DryRun only validates permissions
logTypestringNoSet to Tail to return the last 4 KB of the execution log
clientContextstringNoBase64-encoded JSON passed to the function in the client context object (max 3,583 bytes)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
statusCodenumberHTTP status of the invocation (200 for RequestResponse, 202 for Event, 204 for DryRun)
payloadjsonThe response returned by the function, parsed as JSON when possible
functionErrorstringSet to Handled or Unhandled when the function itself returned an error
logResultstringDecoded execution log tail, present only when logType is Tail
executedVersionstringThe function version that was executed

Lambda List Functions

List Lambda functions with the version-specific configuration of each

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionVersionstringNoSet to ALL to include every published version of each function
masterRegionstringNoFor Lambda@Edge functions, the region of the master function. Requires functionVersion ALL
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-10000)

Output

ParameterTypeDescription
functionsarrayLambda functions with their runtime, handler, memory, and state
nextMarkerstringPagination token to pass as marker on the next request

Lambda Get Function

Get a function's configuration, code location, tags, and reserved concurrency

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
configurationjsonThe function's configuration (ARN, runtime, handler, memory, state, layers, VPC, and logging settings)
tagsErrorjsonWhy the tags could not be read, when a partial tag-read failure occurred
codejsonPresigned download URL for the deployment package, or the container image URI
tagsjsonThe function's tags
reservedConcurrentExecutionsnumberConcurrency reserved for this function, if any

Lambda Get Function Configuration

Get a function's version-specific configuration

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
configurationjsonThe function's configuration (ARN, runtime, handler, memory, state, layers, VPC, and logging settings)

Lambda Create Function

Create a Lambda function from a deployment package in Amazon S3 or a container image

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
rolestringYesARN of the function's execution role
runtimestringNoRuntime identifier such as nodejs22.x or python3.13. Required for .zip packages, omit for container images
handlerstringNoEntry point in your code, such as index.handler. Required for .zip packages
packageTypestringNoZip for a .zip file archive (default) or Image for a container image
s3BucketstringNoAmazon S3 bucket holding the deployment package, in the same region as the function
s3KeystringNoAmazon S3 key of the .zip package
s3ObjectVersionstringNoVersion of the Amazon S3 object to use
imageUristringNoAmazon ECR URI of the container image to deploy
sourceKmsKeyArnstringNoARN of the KMS customer managed key that encrypts the function's .zip deployment package
descriptionstringNoDescription of the function
functionTimeoutnumberNoSeconds Lambda allows the function to run before stopping it (1-900). Named functionTimeout because the shared tool executor reserves timeout for its own request deadline
memorySizenumberNoMemory available to the function at runtime in MB (128-32768)
ephemeralStorageSizenumberNoSize of the /tmp directory in MB (512-10240)
publishbooleanNoPublish the first version of the function atomically with creation
environmentjsonNoEnvironment variables as a flat key/value JSON object
tagsjsonNoTags to apply to the function, as a flat key/value JSON object
architecturesarrayNoInstruction set architecture: exactly one of x86_64 or arm64
layersarrayNoARNs of layer versions to add to the function execution environment Pass [] to remove all of them on an update.
vpcSubnetIdsarrayNoVPC subnet IDs the function should attach to Pass [] to remove all of them on an update.
vpcSecurityGroupIdsarrayNoVPC security group IDs the function should use Pass [] to remove all of them on an update.
tracingModestringNoX-Ray tracing mode: Active samples and traces requests, PassThrough only traces sampled requests
deadLetterTargetArnstringNoARN of an SQS queue or SNS topic that receives failed asynchronous invocations
kmsKeyArnstringNoARN of the KMS customer managed key used to encrypt environment variables and snapshots
snapStartApplyOnstringNoSet to PublishedVersions to snapshot the initialized environment when a version is published
logFormatstringNoFormat the function sends CloudWatch logs in
logGroupstringNoCloudWatch log group the function sends logs to

Output

ParameterTypeDescription
configurationjsonThe function's configuration (ARN, runtime, handler, memory, state, layers, VPC, and logging settings)

Lambda Update Function Code

Update a function's deployment package from Amazon S3 or a container image

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
s3BucketstringNoAmazon S3 bucket holding the new deployment package, in the same region as the function
s3KeystringNoAmazon S3 key of the .zip package
s3ObjectVersionstringNoVersion of the Amazon S3 object to use
imageUristringNoAmazon ECR URI of the container image to deploy
sourceKmsKeyArnstringNoARN of the KMS customer managed key that encrypts the function's .zip deployment package
architecturesarrayNoInstruction set architecture: exactly one of x86_64 or arm64
publishbooleanNoPublish a new version after updating the code
dryRunbooleanNoValidate the request without updating the function
revisionIdstringNoUpdate the resource only if its current revision ID matches this value

Output

ParameterTypeDescription
configurationjsonThe function's configuration (ARN, runtime, handler, memory, state, layers, VPC, and logging settings)

Lambda Update Function Configuration

Update a function's settings such as memory, timeout, role, and environment variables

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
rolestringNoARN of the function's execution role
runtimestringNoRuntime identifier such as nodejs22.x or python3.13
handlerstringNoEntry point in your code, such as index.handler
descriptionstringNoDescription of the function
functionTimeoutnumberNoSeconds Lambda allows the function to run before stopping it (1-900). Named functionTimeout because the shared tool executor reserves timeout for its own request deadline
memorySizenumberNoMemory available to the function at runtime in MB (128-32768)
ephemeralStorageSizenumberNoSize of the /tmp directory in MB (512-10240)
environmentjsonNoEnvironment variables as a flat key/value JSON object. Replaces the existing set
layersarrayNoARNs of layer versions to add to the function execution environment Pass [] to remove all of them on an update.
vpcSubnetIdsarrayNoVPC subnet IDs the function should attach to Pass [] to remove all of them on an update.
vpcSecurityGroupIdsarrayNoVPC security group IDs the function should use Pass [] to remove all of them on an update.
tracingModestringNoX-Ray tracing mode: Active samples and traces requests, PassThrough only traces sampled requests
deadLetterTargetArnstringNoARN of an SQS queue or SNS topic that receives failed asynchronous invocations
kmsKeyArnstringNoARN of the KMS customer managed key used to encrypt environment variables and snapshots
snapStartApplyOnstringNoSet to PublishedVersions to snapshot the initialized environment when a version is published
logFormatstringNoFormat the function sends CloudWatch logs in
logGroupstringNoCloudWatch log group the function sends logs to
revisionIdstringNoUpdate the resource only if its current revision ID matches this value

Output

ParameterTypeDescription
configurationjsonThe function's configuration (ARN, runtime, handler, memory, state, layers, VPC, and logging settings)

Lambda Delete Function

Delete a Lambda function, or a single published version of it

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number to delete. Omit to delete the whole function including all versions and aliases

Output

ParameterTypeDescription
messagestringOperation status message

Lambda Publish Version

Publish an immutable version from the current code and configuration of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
codeSha256stringNoPublish only if the SHA256 hash of the deployment package matches this value
descriptionstringNoDescription of the version
revisionIdstringNoUpdate the resource only if its current revision ID matches this value

Output

ParameterTypeDescription
configurationjsonThe function's configuration (ARN, runtime, handler, memory, state, layers, VPC, and logging settings)

Lambda List Function Versions

List the published versions of a Lambda function, plus $LATEST

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-10000)

Output

ParameterTypeDescription
versionsarrayPublished versions of the function, plus the unpublished $LATEST version
nextMarkerstringPagination token to pass as marker on the next request

Lambda Create Alias

Create an alias that points to a published function version

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
aliasNamestringYesName of the alias, such as prod or staging
aliasFunctionVersionstringYesFunction version the alias points to
descriptionstringNoDescription of the alias
additionalVersionWeightsjsonNoWeighted routing as a JSON object mapping a second version to the fraction of traffic it receives, e.g. {"2": 0.1}

Output

ParameterTypeDescription
aliasjsonThe alias with its ARN, target version, and routing configuration

Lambda Get Alias

Get details about a Lambda function alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
aliasNamestringYesName of the alias

Output

ParameterTypeDescription
aliasjsonThe alias with its ARN, target version, and routing configuration

Lambda Update Alias

Update the target version, description, or traffic weights of an alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
aliasNamestringYesName of the alias
aliasFunctionVersionstringNoFunction version the alias should point to
descriptionstringNoDescription of the alias
additionalVersionWeightsjsonNoWeighted routing as a JSON object mapping a second version to the fraction of traffic it receives, e.g. {"2": 0.1}
revisionIdstringNoUpdate the resource only if its current revision ID matches this value

Output

ParameterTypeDescription
aliasjsonThe alias with its ARN, target version, and routing configuration

Lambda Delete Alias

Delete a Lambda function alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
aliasNamestringYesName of the alias

Output

ParameterTypeDescription
messagestringOperation status message

Lambda List Aliases

List the aliases of a Lambda function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
aliasFunctionVersionstringNoReturn only aliases that point to this function version
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-10000)

Output

ParameterTypeDescription
aliasesarrayAliases with their ARNs, target versions, and routing configuration
nextMarkerstringPagination token to pass as marker on the next request

Lambda Add Permission

Grant an AWS service, account, or organization permission to use a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
statementIdstringYesUnique identifier for the policy statement (letters, numbers, hyphens, and underscores)
actionstringYesAction the principal is granted, such as lambda:InvokeFunction
principalstringYesAWS service principal or account ID granted the permission, such as s3.amazonaws.com
sourceArnstringNoARN of the AWS resource allowed to invoke the function
sourceAccountstringNoID of the AWS account that owns the source resource
principalOrgIdstringNoAWS Organizations ID to grant permission to every account in the organization
eventSourceTokenstringNoToken that must be supplied by the invoker (Alexa Smart Home functions only)
functionUrlAuthTypestringNoAuth type of the function URL this permission applies to
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself
revisionIdstringNoUpdate the resource only if its current revision ID matches this value

Output

ParameterTypeDescription
statementstringThe permission statement that was added, as a JSON document string

Lambda Remove Permission

Remove a statement from a function's resource-based policy

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
statementIdstringYesIdentifier of the policy statement to remove
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself
revisionIdstringNoUpdate the resource only if its current revision ID matches this value

Output

ParameterTypeDescription
messagestringOperation status message

Lambda Get Policy

Get the resource-based IAM policy attached to a function, version, or alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
policystringThe resource-based policy, as a JSON document string
revisionIdstringCurrent revision ID of the policy

Lambda Create Event Source Mapping

Map an event source such as SQS, Kinesis, DynamoDB Streams, or Kafka to a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
eventSourceArnstringNoARN of the event source. Omit only for self-managed Kafka
enabledbooleanNoWhether the mapping is active
batchSizenumberNoMaximum records sent to the function in a single batch
maximumBatchingWindowInSecondsnumberNoSeconds to gather records before invoking the function (0-300)
startingPositionstringNoPosition in the stream to start reading from. Required for Kinesis, DynamoDB Streams, and Kafka
startingPositionTimestampstringNoISO 8601 timestamp to start reading from, when startingPosition is AT_TIMESTAMP
parallelizationFactornumberNoNumber of concurrent batches to process from each shard (1-10)
maximumRecordAgeInSecondsnumberNoDiscard records older than this. Use -1 for infinite
maximumRetryAttemptsnumberNoRetries before a record is discarded. Use -1 for infinite
bisectBatchOnFunctionErrorbooleanNoSplit a failing batch in two and retry each half
tumblingWindowInSecondsnumberNoDuration of a processing window for stream aggregation (0-900)
maximumConcurrencynumberNoMaximum concurrent function invocations from an SQS event source (2-1000)
topicsarrayNoKafka topic names to consume
queuesarrayNoAmazon MQ broker destination queue names
functionResponseTypesarrayNoSet to ReportBatchItemFailures to enable partial batch reporting Pass [] to remove all of them on an update.
filterPatternsarrayNoEvent filter patterns, each a JSON string, that decide which records reach the function. Pass [] to remove all filters on an update.
onSuccessDestinationstringNoARN of the destination that receives successfully processed records
onFailureDestinationstringNoARN of the destination that receives discarded records
kmsKeyArnstringNoARN of the KMS customer managed key used to encrypt filter criteria
tagsjsonNoTags to apply to the event source mapping, as a flat key/value JSON object
sourceAccessConfigurationsjsonNoAuthentication for an Amazon MQ or self-managed Kafka source, as a JSON array of objects with "type" (e.g. BASIC_AUTH, SASL_SCRAM_512_AUTH, VPC_SUBNET) and "uri" (the Secrets Manager or VPC resource ARN). Pass [] to remove all of them on an update.
documentDbDatabaseNamestringNoDocumentDB database to consume the change stream from
documentDbCollectionNamestringNoDocumentDB collection to consume. Omit to consume the whole database
documentDbFullDocumentstringNoUpdateLookup sends the full document on update, Default sends only the change delta
amazonManagedKafkaConsumerGroupIdstringNoConsumer group ID to join on an Amazon MSK cluster
selfManagedKafkaConsumerGroupIdstringNoConsumer group ID to join on a self-managed Kafka cluster
selfManagedKafkaBootstrapServersarrayNoBootstrap servers of a self-managed Kafka cluster (host:port). Required instead of eventSourceArn for self-managed Kafka

Output

ParameterTypeDescription
eventSourceMappingjsonThe event source mapping with its UUID, state, batching, and filter settings

Lambda Get Event Source Mapping

Get details about an event source mapping

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
uuidstringYesIdentifier of the event source mapping

Output

ParameterTypeDescription
eventSourceMappingjsonThe event source mapping with its UUID, state, batching, and filter settings

Lambda Update Event Source Mapping

Update the batching, retry, filtering, or enabled state of an event source mapping

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
uuidstringYesIdentifier of the event source mapping
functionNamestringNoFunction the mapping should invoke
enabledbooleanNoWhether the mapping is active
batchSizenumberNoMaximum records sent to the function in a single batch
maximumBatchingWindowInSecondsnumberNoSeconds to gather records before invoking the function (0-300)
parallelizationFactornumberNoNumber of concurrent batches to process from each shard (1-10)
maximumRecordAgeInSecondsnumberNoDiscard records older than this. Use -1 for infinite
maximumRetryAttemptsnumberNoRetries before a record is discarded. Use -1 for infinite
bisectBatchOnFunctionErrorbooleanNoSplit a failing batch in two and retry each half
tumblingWindowInSecondsnumberNoDuration of a processing window for stream aggregation (0-900)
maximumConcurrencynumberNoMaximum concurrent function invocations from an SQS event source (2-1000)
functionResponseTypesarrayNoSet to ReportBatchItemFailures to enable partial batch reporting Pass [] to remove all of them on an update.
filterPatternsarrayNoEvent filter patterns, each a JSON string, that decide which records reach the function. Pass [] to remove all filters on an update.
onSuccessDestinationstringNoARN of the destination that receives successfully processed records
onFailureDestinationstringNoARN of the destination that receives discarded records
kmsKeyArnstringNoARN of the KMS customer managed key used to encrypt filter criteria
sourceAccessConfigurationsjsonNoAuthentication for an Amazon MQ or self-managed Kafka source, as a JSON array of objects with "type" (e.g. BASIC_AUTH, SASL_SCRAM_512_AUTH, VPC_SUBNET) and "uri" (the Secrets Manager or VPC resource ARN). Pass [] to remove all of them on an update.
documentDbDatabaseNamestringNoDocumentDB database to consume the change stream from
documentDbCollectionNamestringNoDocumentDB collection to consume. Omit to consume the whole database
documentDbFullDocumentstringNoUpdateLookup sends the full document on update, Default sends only the change delta
amazonManagedKafkaConsumerGroupIdstringNoConsumer group ID to join on an Amazon MSK cluster
selfManagedKafkaConsumerGroupIdstringNoConsumer group ID to join on a self-managed Kafka cluster

Output

ParameterTypeDescription
eventSourceMappingjsonThe event source mapping with its UUID, state, batching, and filter settings

Lambda Delete Event Source Mapping

Delete an event source mapping

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
uuidstringYesIdentifier of the event source mapping

Output

ParameterTypeDescription
eventSourceMappingjsonThe deleted event source mapping, whose state transitions to Deleting

Lambda List Event Source Mappings

List event source mappings, optionally filtered by function or event source

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringNoReturn only mappings that invoke this function
eventSourceArnstringNoReturn only mappings for this event source ARN
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-10000)

Output

ParameterTypeDescription
eventSourceMappingsarrayEvent source mappings with their UUIDs, state, and batching settings
nextMarkerstringPagination token to pass as marker on the next request

Lambda Get Function Concurrency

Get the reserved concurrency configured for a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)

Output

ParameterTypeDescription
reservedConcurrentExecutionsnumberConcurrency reserved for this function, or null when none is reserved

Lambda Set Function Concurrency

Reserve a share of the account concurrency limit for a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
reservedConcurrentExecutionsnumberYesNumber of simultaneous executions to reserve for this function

Output

ParameterTypeDescription
reservedConcurrentExecutionsnumberConcurrency now reserved for this function

Lambda Delete Function Concurrency

Remove the reserved concurrency configuration from a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)

Output

ParameterTypeDescription
messagestringOperation status message

Lambda Get Provisioned Concurrency

Get the provisioned concurrency configuration of a function version or alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringYesVersion number or alias name the configuration applies to

Output

ParameterTypeDescription
provisionedConcurrencyjsonRequested, available, and allocated provisioned concurrency with its status

Lambda Set Provisioned Concurrency

Allocate provisioned concurrency to a function version or alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringYesVersion number or alias name the configuration applies to
provisionedConcurrentExecutionsnumberYesNumber of pre-initialized execution environments to allocate

Output

ParameterTypeDescription
provisionedConcurrencyjsonRequested, available, and allocated provisioned concurrency with its status

Lambda Delete Provisioned Concurrency

Remove the provisioned concurrency configuration from a function version or alias

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringYesVersion number or alias name the configuration applies to

Output

ParameterTypeDescription
messagestringOperation status message

Lambda List Provisioned Concurrency

List the provisioned concurrency configurations of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-50)

Output

ParameterTypeDescription
provisionedConcurrencyConfigsarrayProvisioned concurrency configurations with their allocation status
nextMarkerstringPagination token to pass as marker on the next request

Lambda Create Function URL

Create a dedicated HTTPS endpoint for a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
authTypestringYesAWS_IAM requires signed requests, NONE allows public unauthenticated access
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself
invokeModestringNoBUFFERED returns the whole response at once, RESPONSE_STREAM streams it
corsAllowCredentialsbooleanNoWhether the function URL sends the Access-Control-Allow-Credentials header
corsAllowOriginsarrayNoOrigins allowed to call the function URL, or * for any
corsAllowMethodsarrayNoHTTP methods allowed when calling the function URL, or * for any
corsAllowHeadersarrayNoHeaders browsers may send in a cross-origin request
corsExposeHeadersarrayNoResponse headers browsers may access from the response
corsMaxAgenumberNoSeconds a browser may cache the CORS preflight result (0-86400)

Output

ParameterTypeDescription
functionUrlConfigjsonThe function URL with its auth type, invoke mode, and CORS settings

Lambda Get Function URL

Get details about a function URL

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
functionUrlConfigjsonThe function URL with its auth type, invoke mode, and CORS settings

Lambda Update Function URL

Update the auth type, invoke mode, or CORS settings of a function URL

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
authTypestringNoAWS_IAM requires signed requests, NONE allows public unauthenticated access
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself
invokeModestringNoBUFFERED returns the whole response at once, RESPONSE_STREAM streams it
corsAllowCredentialsbooleanNoWhether the function URL sends the Access-Control-Allow-Credentials header
corsAllowOriginsarrayNoOrigins allowed to call the function URL, or * for any
corsAllowMethodsarrayNoHTTP methods allowed when calling the function URL, or * for any
corsAllowHeadersarrayNoHeaders browsers may send in a cross-origin request
corsExposeHeadersarrayNoResponse headers browsers may access from the response
corsMaxAgenumberNoSeconds a browser may cache the CORS preflight result (0-86400)

Output

ParameterTypeDescription
functionUrlConfigjsonThe function URL with its auth type, invoke mode, and CORS settings

Lambda Delete Function URL

Delete the URL configuration of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
messagestringOperation status message

Lambda List Function URLs

List the URL configurations of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-50)

Output

ParameterTypeDescription
functionUrlConfigsarrayFunction URLs with their auth types, invoke modes, and CORS settings
nextMarkerstringPagination token to pass as marker on the next request

Lambda Get Async Invoke Config

Get the asynchronous invocation retry and destination settings of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
eventInvokeConfigjsonAsynchronous invocation retry limits and success/failure destinations

Lambda Set Async Invoke Config

Configure retry limits and destinations for asynchronous invocations of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself
maximumRetryAttemptsnumberNoTimes Lambda retries a failed asynchronous invocation (0-2)
maximumEventAgeInSecondsnumberNoMaximum age of an event Lambda will still process (60-21600)
onSuccessDestinationstringNoARN of the destination that receives successful invocation records
onFailureDestinationstringNoARN of the destination that receives failed invocation records

Output

ParameterTypeDescription
eventInvokeConfigjsonAsynchronous invocation retry limits and success/failure destinations

Lambda Delete Async Invoke Config

Remove the asynchronous invocation configuration of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
messagestringOperation status message

Lambda List Async Invoke Configs

List the asynchronous invocation configurations of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-50)

Output

ParameterTypeDescription
eventInvokeConfigsarrayAsynchronous invocation configurations for the function versions and aliases
nextMarkerstringPagination token to pass as marker on the next request

Lambda List Layers

List Lambda layers and the latest version of each

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
compatibleRuntimestringNoReturn only layers compatible with this runtime, such as python3.13
compatibleArchitecturestringNoReturn only layers compatible with this instruction set architecture
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-50)

Output

ParameterTypeDescription
layersarrayLayers with their ARNs and latest matching version
nextMarkerstringPagination token to pass as marker on the next request

Lambda List Layer Versions

List the versions of a Lambda layer

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
layerNamestringYesThe name or ARN of the layer
compatibleRuntimestringNoReturn only versions compatible with this runtime, such as python3.13
compatibleArchitecturestringNoReturn only versions compatible with this instruction set architecture
markerstringNoPagination token returned by a previous request
maxItemsnumberNoMaximum number of items to return (1-50)

Output

ParameterTypeDescription
layerVersionsarrayLayer versions with their ARNs, compatible runtimes, and license info
nextMarkerstringPagination token to pass as marker on the next request

Lambda Get Layer Version

Get details and a download link for a specific layer version

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
layerNamestringYesThe name or ARN of the layer
versionNumbernumberYesVersion number of the layer

Output

ParameterTypeDescription
layerVersionjsonThe layer version with its ARN, compatible runtimes, and a presigned content download URL

Lambda List Tags

List the tags applied to a Lambda function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
resourceArnstringYesThe function's Amazon Resource Name (ARN)

Output

ParameterTypeDescription
tagsjsonThe resource's tags as a key/value object

Lambda Tag Resource

Add tags to a Lambda function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
resourceArnstringYesThe function's Amazon Resource Name (ARN)
tagsjsonYesTags to apply, as a flat key/value JSON object

Output

ParameterTypeDescription
messagestringOperation status message

Lambda Untag Resource

Remove tags from a Lambda function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
resourceArnstringYesThe function's Amazon Resource Name (ARN)
tagKeysarrayYesTag keys to remove

Output

ParameterTypeDescription
messagestringOperation status message

Lambda Get Account Settings

Get the Lambda limits and usage of the current AWS account and region

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key

Output

ParameterTypeDescription
accountLimitjsonAccount-level storage and concurrency limits
accountUsagejsonCurrent code storage used and number of functions deployed

Lambda Get Recursion Config

Get the recursive loop detection setting of a function

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)

Output

ParameterTypeDescription
recursiveLoopstringTerminate stops the function after 16 recursive invocations, Allow permits recursion

Lambda Set Recursion Config

Set whether Lambda stops a function that invokes itself recursively

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
recursiveLoopstringYesTerminate stops the function after 16 recursive invocations, Allow permits recursion

Output

ParameterTypeDescription
recursiveLoopstringThe recursion setting now in effect for the function

Lambda Get Runtime Management Config

Get the runtime update policy of a function version

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
updateRuntimeOnstringAuto, FunctionUpdate, or Manual runtime update policy
runtimeVersionArnstringARN of the pinned runtime version, when the policy is Manual
functionArnstringARN of the function the policy applies to

Lambda Set Runtime Management Config

Set how and when Lambda applies runtime updates to a function version

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
functionNamestringYesFunction name, ARN, or partial ARN (e.g. my-function, or arn:aws:lambda:us-east-1:123456789012:function:my-function)
updateRuntimeOnstringYesAuto applies updates automatically, FunctionUpdate applies them on the next function update, Manual pins a runtime version
runtimeVersionArnstringNoARN of the runtime version to pin to. Required when updateRuntimeOn is Manual
qualifierstringNoVersion number or alias name to act on. Omit to target the function itself

Output

ParameterTypeDescription
updateRuntimeOnstringThe runtime update policy now in effect
runtimeVersionArnstringARN of the pinned runtime version, when the policy is Manual
functionArnstringARN of the function the policy applies to

On this page

Credentials and permissions
Deployment packages
Usage Instructions
Actions
Lambda Invoke Function
Input
Output
Lambda List Functions
Input
Output
Lambda Get Function
Input
Output
Lambda Get Function Configuration
Input
Output
Lambda Create Function
Input
Output
Lambda Update Function Code
Input
Output
Lambda Update Function Configuration
Input
Output
Lambda Delete Function
Input
Output
Lambda Publish Version
Input
Output
Lambda List Function Versions
Input
Output
Lambda Create Alias
Input
Output
Lambda Get Alias
Input
Output
Lambda Update Alias
Input
Output
Lambda Delete Alias
Input
Output
Lambda List Aliases
Input
Output
Lambda Add Permission
Input
Output
Lambda Remove Permission
Input
Output
Lambda Get Policy
Input
Output
Lambda Create Event Source Mapping
Input
Output
Lambda Get Event Source Mapping
Input
Output
Lambda Update Event Source Mapping
Input
Output
Lambda Delete Event Source Mapping
Input
Output
Lambda List Event Source Mappings
Input
Output
Lambda Get Function Concurrency
Input
Output
Lambda Set Function Concurrency
Input
Output
Lambda Delete Function Concurrency
Input
Output
Lambda Get Provisioned Concurrency
Input
Output
Lambda Set Provisioned Concurrency
Input
Output
Lambda Delete Provisioned Concurrency
Input
Output
Lambda List Provisioned Concurrency
Input
Output
Lambda Create Function URL
Input
Output
Lambda Get Function URL
Input
Output
Lambda Update Function URL
Input
Output
Lambda Delete Function URL
Input
Output
Lambda List Function URLs
Input
Output
Lambda Get Async Invoke Config
Input
Output
Lambda Set Async Invoke Config
Input
Output
Lambda Delete Async Invoke Config
Input
Output
Lambda List Async Invoke Configs
Input
Output
Lambda List Layers
Input
Output
Lambda List Layer Versions
Input
Output
Lambda Get Layer Version
Input
Output
Lambda List Tags
Input
Output
Lambda Tag Resource
Input
Output
Lambda Untag Resource
Input
Output
Lambda Get Account Settings
Input
Output
Lambda Get Recursion Config
Input
Output
Lambda Set Recursion Config
Input
Output
Lambda Get Runtime Management Config
Input
Output
Lambda Set Runtime Management Config
Input
Output