Lambda via SDK Best Practices

Q: What is the single most important Lambda deploy rule?

Do not point production at $LATEST. Publish an immutable version and route a prod alias to it, so callers get a fixed snapshot and rollback is one UpdateAlias away.

Q: How should I size memory?

Deliberately, by measuring. MemorySize also sets CPU, so raising it often lowers duration - and sometimes total cost. Do not leave the default; test a few sizes against real load.

Q: How do I tell a failed call from a failed handler?

The HTTP status covers the invoke; FunctionError covers your code. A 200 response with FunctionError set means the handler threw. Always check both on synchronous invokes.

Q: What is the most important trigger setting?

Partial-batch failure reporting (ReportBatchItemFailures). Without it, one failed record retries the whole batch and reprocesses records that already succeeded.

Q: How do I keep a public Function URL secure?

Prefer AWS_IAM. If you must use NONE, add the matching public permission, authenticate inside the handler, and remove the public statement the moment you tighten auth.

Q: Why keep secrets out of environment variables?

Environment variables are returned in plaintext by GetFunctionConfiguration to anyone with read access. Reference Secrets Manager or SSM Parameter Store and fetch at runtime instead.

These are the defaults every Lambda integration should set explicitly, not leave to chance.

Walk the list once now, then use it as a review checklist before shipping code that deploys, invokes, triggers, or tunes a function via the SDK.

How to Use This List

Each item is a rule stated positively, with a one-line rationale.
Groups run roughly in order of impact: deploys and updates first, then invocation, sizing, triggers, security, and observability.
Check the boxes against your own code as a quick audit.
Revisit whenever you add a new function, trigger, or a higher-throughput path.

A - Deploys, Versions & Aliases

Never route production at $LATEST. Publish an immutable version and point an alias (prod) at it; $LATEST changes the instant you touch the draft.
Publish with the code update. Pass Publish: true to update_function_code so the version snapshots the exact code you shipped, with no race.
Wait between control-plane changes. Use the function_updated_v2 waiter until LastUpdateStatus is Successful; back-to-back updates raise ResourceConflictException.
Canary with weighted aliases. Shift a fraction of traffic via RoutingConfig.AdditionalVersionWeights, watch per-version metrics, then promote.
Keep rollback one call away. Because versions are immutable, roll back by repointing the alias - no rebuild.

Publish and route through an alias, not the mutable draft.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
with open("function.zip", "rb") as f:
    v = lam.update_function_code(FunctionName="my-func", ZipFile=f.read(), Publish=True)["Version"]
lam.update_alias(FunctionName="my-func", Name="prod", FunctionVersion=v)

// --- TypeScript (AWS SDK v3) ---
import { LambdaClient, UpdateFunctionCodeCommand, UpdateAliasCommand } from "@aws-sdk/client-lambda";
import { readFileSync } from "node:fs";
 
const lam = new LambdaClient({});
const { Version } = await lam.send(new UpdateFunctionCodeCommand({
  FunctionName: "my-func", ZipFile: readFileSync("function.zip"), Publish: true,
}));
await lam.send(new UpdateAliasCommand({ FunctionName: "my-func", Name: "prod", FunctionVersion: Version! }));

B - Package Hygiene & Sizing

Keep deployment packages small. Smaller ZIPs download and initialize faster; move shared dependencies into layers.
Respect the 250 MB unzipped limit. Function plus layers must fit; switch to a container image when you outgrow it.
Right-size memory deliberately. MemorySize also scales CPU, so more memory can be both faster and cheaper per invoke - measure it.
Set a realistic timeout. Match Timeout to the work; do not leave a long default that hides hangs (max 900 seconds).
Do heavy setup once, at init. Initialize clients and connections outside the handler so warm invokes reuse them.

C - Invocation

Pick the invocation type on purpose. RequestResponse when you need the result; Event for fire-and-forget with Lambda-managed retries.
Check FunctionError on sync invokes. A 200 with FunctionError set is a failed handler - inspect the payload.
Decode the payload correctly. boto3 returns a streaming body (.read()); SDK v3 returns a Uint8Array (TextDecoder).
Use Invoke from AWS callers, URLs from HTTP callers. Do not wrap the SDK just to hit a Function URL, and do not expose Invoke to non-AWS clients.
Add an idempotency key for retried async work. Make handlers idempotent so Lambda's automatic async retries do not double-apply effects.

Distinguish a failed call from a failed handler.

# --- Python (boto3) ---
resp = lam.invoke(FunctionName="my-func:prod", InvocationType="RequestResponse", Payload=b"{}")
if "FunctionError" in resp:
    raise RuntimeError(resp["Payload"].read().decode())

// --- TypeScript (AWS SDK v3) ---
import { InvokeCommand } from "@aws-sdk/client-lambda";
 
const resp = await lam.send(new InvokeCommand({ FunctionName: "my-func:prod", Payload: new TextEncoder().encode("{}") }));
if (resp.FunctionError) throw new Error(new TextDecoder().decode(resp.Payload));

D - Triggers & Concurrency

Enable partial-batch reporting. Set FunctionResponseTypes: ["ReportBatchItemFailures"] on stream/queue mappings so only failed records retry.
Isolate poison records on streams. Use BisectBatchOnFunctionError, a retry/age limit, and an OnFailure destination so one record cannot stall a shard.
Tune batch size and window together. Trade latency for fewer, fuller invocations with BatchSize and MaximumBatchingWindowInSeconds.
Reserve concurrency for critical or noisy functions. Use PutFunctionConcurrency to guarantee capacity or cap a runaway function within the account limit.
Provision concurrency for latency-critical paths. Pre-warm a version/alias with PutProvisionedConcurrencyConfig, sized to baseline, and poll until READY.

E - Security & Permissions

Grant least privilege on the execution role. Give only the actions the handler and its triggers need (queue/stream reads, downstream calls).
Match Function URL permissions to AuthType. A NONE URL needs an AddPermission with FunctionUrlAuthType="NONE"; keep the two in sync.
Prefer AWS_IAM for Function URLs. Use NONE only for genuinely public endpoints, and authenticate inside the handler.
Scope resource-based invoke permissions. When another service invokes a function, restrict Principal and SourceArn rather than allowing *.
Keep secrets out of env vars in plaintext. Reference Secrets Manager / SSM Parameter Store; env vars are visible via GetFunctionConfiguration.

F - Observability & Cost

Capture tail logs when debugging. Set LogType: "Tail" on synchronous invokes and base64-decode LogResult for the last 4 KB.
Alarm per version during rollouts. Lambda emits metrics per version, so alarm on the canary's errors/duration before promoting.
Enable tracing for distributed calls. Turn on active tracing (X-Ray) via TracingConfig to see downstream latency.
Log the request id on failure. Capture ResponseMetadata.RequestId (boto3) / $metadata.requestId (SDK v3) for support and tracing.
Scale provisioned concurrency to demand. Use Application Auto Scaling so you do not pay for warm capacity you are not using.

FAQs

What is the single most important Lambda deploy rule?

Do not point production at $LATEST. Publish an immutable version and route a prod alias to it, so callers get a fixed snapshot and rollback is one UpdateAlias away.

Why wait between control-plane updates?

Config and code changes are eventually consistent. Issuing another update before the last one finishes raises ResourceConflictException. Use the function_updated_v2 waiter until LastUpdateStatus is Successful.

How should I size memory?

Deliberately, by measuring. MemorySize also sets CPU, so raising it often lowers duration - and sometimes total cost. Do not leave the default; test a few sizes against real load.

How do I tell a failed call from a failed handler?

The HTTP status covers the invoke; FunctionError covers your code. A 200 response with FunctionError set means the handler threw. Always check both on synchronous invokes.

What is the most important trigger setting?

Partial-batch failure reporting (ReportBatchItemFailures). Without it, one failed record retries the whole batch and reprocesses records that already succeeded.

When do I need reserved vs provisioned concurrency?

Reserve concurrency to guarantee or cap how many environments a function may use. Provision concurrency to pre-warm environments for a latency-critical path. They solve different problems and combine.

How do I keep a public Function URL secure?

Prefer AWS_IAM. If you must use NONE, add the matching public permission, authenticate inside the handler, and remove the public statement the moment you tighten auth.

Where should heavy initialization go?

Outside the handler, at init time. Clients, connections, and config loaded there are reused by warm invocations, so you pay the cost once per environment rather than per request.

How do I avoid paying for idle warm capacity?

Size provisioned concurrency to your baseline and use Application Auto Scaling to raise it at peak and lower it off-peak. Delete the config when a function no longer needs warm capacity.

Why keep secrets out of environment variables?

Environment variables are returned in plaintext by GetFunctionConfiguration to anyone with read access. Reference Secrets Manager or SSM Parameter Store and fetch at runtime instead.

Lambda's Execution Model for SDK Callers - the model these rules build on.
Lambda Deep Dive Basics - group C in depth.
Versions, Aliases & Traffic Shifting - group A in depth.
Event Source Mappings: SQS, DynamoDB Streams & Kinesis - group D in depth.
Provisioned Concurrency & Cold-Start Management - concurrency sizing in depth.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

Walk the list once now, then use it as a review checklist before shipping code that deploys, invokes, triggers, or tunes a function via the SDK.

How to Use This List

Each item is a rule stated positively, with a one-line rationale.
Groups run roughly in order of impact: deploys and updates first, then invocation, sizing, triggers, security, and observability.
Check the boxes against your own code as a quick audit.
Revisit whenever you add a new function, trigger, or a higher-throughput path.

A - Deploys, Versions & Aliases

Never route production at $LATEST. Publish an immutable version and point an alias (prod) at it; $LATEST changes the instant you touch the draft.
Publish with the code update. Pass Publish: true to update_function_code so the version snapshots the exact code you shipped, with no race.
Wait between control-plane changes. Use the function_updated_v2 waiter until LastUpdateStatus is Successful; back-to-back updates raise ResourceConflictException.
Canary with weighted aliases. Shift a fraction of traffic via RoutingConfig.AdditionalVersionWeights, watch per-version metrics, then promote.
Keep rollback one call away. Because versions are immutable, roll back by repointing the alias - no rebuild.

Publish and route through an alias, not the mutable draft.

# --- Python (boto3) ---
import boto3
 
lam = boto3.client("lambda")
with open("function.zip", "rb") as f:
    v = lam.update_function_code(FunctionName="my-func", ZipFile=f.read(), Publish=True)["Version"]
lam.update_alias(FunctionName="my-func", Name="prod", FunctionVersion=v)

// --- TypeScript (AWS SDK v3) ---
import { LambdaClient, UpdateFunctionCodeCommand, UpdateAliasCommand } from "@aws-sdk/client-lambda";
import { readFileSync } from "node:fs";
 
const lam = new LambdaClient({});
const { Version } = await lam.send(new UpdateFunctionCodeCommand({
  FunctionName: "my-func", ZipFile: readFileSync("function.zip"), Publish: true,
}));
await lam.send(new UpdateAliasCommand({ FunctionName: "my-func", Name: "prod", FunctionVersion: Version! }));

B - Package Hygiene & Sizing

Keep deployment packages small. Smaller ZIPs download and initialize faster; move shared dependencies into layers.
Respect the 250 MB unzipped limit. Function plus layers must fit; switch to a container image when you outgrow it.
Right-size memory deliberately. MemorySize also scales CPU, so more memory can be both faster and cheaper per invoke - measure it.
Set a realistic timeout. Match Timeout to the work; do not leave a long default that hides hangs (max 900 seconds).
Do heavy setup once, at init. Initialize clients and connections outside the handler so warm invokes reuse them.

C - Invocation

Pick the invocation type on purpose. RequestResponse when you need the result; Event for fire-and-forget with Lambda-managed retries.
Check FunctionError on sync invokes. A 200 with FunctionError set is a failed handler - inspect the payload.
Decode the payload correctly. boto3 returns a streaming body (.read()); SDK v3 returns a Uint8Array (TextDecoder).
Use Invoke from AWS callers, URLs from HTTP callers. Do not wrap the SDK just to hit a Function URL, and do not expose Invoke to non-AWS clients.
Add an idempotency key for retried async work. Make handlers idempotent so Lambda's automatic async retries do not double-apply effects.

Distinguish a failed call from a failed handler.

# --- Python (boto3) ---
resp = lam.invoke(FunctionName="my-func:prod", InvocationType="RequestResponse", Payload=b"{}")
if "FunctionError" in resp:
    raise RuntimeError(resp["Payload"].read().decode())

// --- TypeScript (AWS SDK v3) ---
import { InvokeCommand } from "@aws-sdk/client-lambda";
 
const resp = await lam.send(new InvokeCommand({ FunctionName: "my-func:prod", Payload: new TextEncoder().encode("{}") }));
if (resp.FunctionError) throw new Error(new TextDecoder().decode(resp.Payload));

D - Triggers & Concurrency

Enable partial-batch reporting. Set FunctionResponseTypes: ["ReportBatchItemFailures"] on stream/queue mappings so only failed records retry.
Isolate poison records on streams. Use BisectBatchOnFunctionError, a retry/age limit, and an OnFailure destination so one record cannot stall a shard.
Tune batch size and window together. Trade latency for fewer, fuller invocations with BatchSize and MaximumBatchingWindowInSeconds.
Reserve concurrency for critical or noisy functions. Use PutFunctionConcurrency to guarantee capacity or cap a runaway function within the account limit.
Provision concurrency for latency-critical paths. Pre-warm a version/alias with PutProvisionedConcurrencyConfig, sized to baseline, and poll until READY.

E - Security & Permissions

Grant least privilege on the execution role. Give only the actions the handler and its triggers need (queue/stream reads, downstream calls).
Match Function URL permissions to AuthType. A NONE URL needs an AddPermission with FunctionUrlAuthType="NONE"; keep the two in sync.
Prefer AWS_IAM for Function URLs. Use NONE only for genuinely public endpoints, and authenticate inside the handler.
Scope resource-based invoke permissions. When another service invokes a function, restrict Principal and SourceArn rather than allowing *.
Keep secrets out of env vars in plaintext. Reference Secrets Manager / SSM Parameter Store; env vars are visible via GetFunctionConfiguration.

F - Observability & Cost

Capture tail logs when debugging. Set LogType: "Tail" on synchronous invokes and base64-decode LogResult for the last 4 KB.
Alarm per version during rollouts. Lambda emits metrics per version, so alarm on the canary's errors/duration before promoting.
Enable tracing for distributed calls. Turn on active tracing (X-Ray) via TracingConfig to see downstream latency.
Log the request id on failure. Capture ResponseMetadata.RequestId (boto3) / $metadata.requestId (SDK v3) for support and tracing.
Scale provisioned concurrency to demand. Use Application Auto Scaling so you do not pay for warm capacity you are not using.

FAQs

What is the single most important Lambda deploy rule?

Do not point production at $LATEST. Publish an immutable version and route a prod alias to it, so callers get a fixed snapshot and rollback is one UpdateAlias away.

Why wait between control-plane updates?

How should I size memory?

Deliberately, by measuring. MemorySize also sets CPU, so raising it often lowers duration - and sometimes total cost. Do not leave the default; test a few sizes against real load.

How do I tell a failed call from a failed handler?

The HTTP status covers the invoke; FunctionError covers your code. A 200 response with FunctionError set means the handler threw. Always check both on synchronous invokes.

What is the most important trigger setting?

Partial-batch failure reporting (ReportBatchItemFailures). Without it, one failed record retries the whole batch and reprocesses records that already succeeded.

When do I need reserved vs provisioned concurrency?

How do I keep a public Function URL secure?

Prefer AWS_IAM. If you must use NONE, add the matching public permission, authenticate inside the handler, and remove the public statement the moment you tighten auth.

Where should heavy initialization go?

Outside the handler, at init time. Clients, connections, and config loaded there are reused by warm invocations, so you pay the cost once per environment rather than per request.

How do I avoid paying for idle warm capacity?

Size provisioned concurrency to your baseline and use Application Auto Scaling to raise it at peak and lower it off-peak. Delete the config when a function no longer needs warm capacity.

Why keep secrets out of environment variables?

Environment variables are returned in plaintext by GetFunctionConfiguration to anyone with read access. Reference Secrets Manager or SSM Parameter Store and fetch at runtime instead.

Lambda's Execution Model for SDK Callers - the model these rules build on.
Lambda Deep Dive Basics - group C in depth.
Versions, Aliases & Traffic Shifting - group A in depth.
Event Source Mappings: SQS, DynamoDB Streams & Kinesis - group D in depth.
Provisioned Concurrency & Cold-Start Management - concurrency sizing in depth.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

Lambda via SDK Best Practices

Buscar na documentação

Lambda via SDK Best Practices