Lambda — Cheat Sheet (DVA-C02)
Verified against AWS documentation on 2026-10-12 · ⚠️ = changed vs older material: learn the value shown here (older practice material may say otherwise; full list in notes/lambda-guide.md#changed-vs-older-material) · explanations and examples: notes/lambda-guide.md.
Invocation types and synchronous calls
| Topic | Current facts | Memory hook |
|---|---|---|
| Invocation types | RequestResponse (sync, default, HTTP 200) · Event (async, HTTP 202) · DryRun (checks parameters and permission only, HTTP 204) |
Wait, queue, or just check |
| Synchronous callers | SDK/CLI Invoke, API Gateway, ALB, function URLs, Cognito triggers, Step Functions, Lex, S3 Batch Operations, Data Firehose transforms |
Someone is waiting for the answer |
| Asynchronous callers | S3 notifications, SNS, EventBridge rules and Scheduler, CloudWatch Logs subscriptions, SES, AWS Config, CloudFormation custom resources, CodeCommit, CodePipeline, IoT | Fire and forget |
| Function error on a sync call | Status stays 200; X-Amz-Function-Error header (FunctionError field); errorType/errorMessage in the payload |
200 doesn't mean OK |
| Retries of sync calls | None by Lambda; the caller or SDK decides; API Gateway relays the error | Caller owns the retry |
| Payload quotas | 6 MB sync request and response · 1 MB async ⚠️ · 200 MB streamed ⚠️ · not adjustable; a request over its type's quota → RequestTooLargeException (413) |
6, 1, 200 |
| Log tail in the response | --log-type Tail → last 4 KB, base64, X-Amz-Log-Result header (sync only) |
|
| Version that ran | X-Amz-Executed-Version header / ExecutedVersion field |
|
| Context object (Python) | aws_request_id, function_name, invoked_function_arn, memory_limit_in_mb, get_remaining_time_in_millis() |
|
| ALB targets | Target type lambda, 1 function per target group, 1 MB request and response, invoke permission for elasticloadbalancing.amazonaws.com |
|
| ALB repeated values | lambda.multi_value_headers.enabled=true → multiValueHeaders / multiValueQueryStringParameters; otherwise last value wins |
|
| 502-class invoke errors | Configuration, not code: KMSAccessDeniedException, ENILimitReachedException, SubnetIPAddressLimitReachedException, ResourceNotReadyException |
502 = setup problem |
Asynchronous invocation with retries and destinations
| Topic | Current facts | Memory hook |
|---|---|---|
| Retries on function errors | 2 retries (3 attempts): ~1 min, then ~2 min; MaximumRetryAttempts 0–2 |
Two more tries |
| Throttles and system errors | Event re-queued and retried up to 6 h; backoff 1 s → 5 min | Waits instead of failing |
| Maximum event age | MaximumEventAgeInSeconds 60–21,600 (default 6 h) |
|
| On-failure destinations | SQS standard, SNS standard, S3 bucket ⚠️ (failure only), Lambda, EventBridge bus | S3 only catches failures |
| On-success destinations | SQS, SNS, Lambda, EventBridge (no S3) | |
| Destination record | requestContext.condition (RetriesExhausted / EventAgeExceeded), requestPayload, responsePayload |
Destinations tell the whole story |
| Dead-letter queue | SQS or SNS standard, function level, original event only + RequestID, ErrorCode, ErrorMessage; failures → DeadLetterErrors |
DLQ keeps only the letter |
| Unsupported targets | FIFO queues and FIFO topics → DestinationDeliveryFailures |
|
| Config commands | put-function-event-invoke-config replaces everything; update-function-event-invoke-config merges |
Put replaces, update merges |
| Async metrics | AsyncEventsReceived, AsyncEventAge, AsyncEventsDropped |
|
| Duplicates | Possible even without errors → idempotent handlers | At least once |
| Reserved concurrency 0 | New async events go straight to the DLQ / on-failure destination, no retries | |
| Scheduled jobs | EventBridge Scheduler assumes an execution role with lambda:InvokeFunction; an EventBridge rule uses a resource-policy statement for events.amazonaws.com or an execution role on the target ⚠️ |
|
| CodePipeline invoke action | Async call; the code must report PutJobSuccessResult or PutJobFailureResult |
Call back or hang |
Event source mappings for queues and streams
| Topic | Current facts | Memory hook |
|---|---|---|
| Sources ⚠️ | SQS, Kinesis, DynamoDB Streams, Amazon MSK, self-managed Kafka, Amazon MQ, DocumentDB | Lambda polls these |
| Permissions | Execution role reads the source (AWSLambdaSQSQueueExecutionRole, AWSLambdaKinesisExecutionRole, AWSLambdaDynamoDBExecutionRole) |
Poll = role |
| Batch triggers | Batch size reached, batching window (0–300 s) expires, or payload hits 6 MB | Size, time or 6 MB |
| SQS batch size | Standard up to 10,000 ⚠️ (window ≥ 1 s above 10), FIFO 10, default 10 | |
| SQS visibility timeout | ≥ 6 × function timeout (+ batching window); function timeout > visibility timeout is rejected | Six times the timeout |
| SQS failures | Batch reappears after the visibility timeout; DLQ in the queue's redrive policy (maxReceiveCount ≥ 5) |
The queue keeps its own DLQ |
| Partial batch response | FunctionResponseTypes=ReportBatchItemFailures + return batchItemFailures[].itemIdentifier |
Name the failures |
| SQS scaling (default mode) | Starts at 5, +300 per minute, max 1,250 per mapping ⚠️ | |
| SQS concurrency cap | ScalingConfig.MaximumConcurrency 2–1,000 per mapping; not with provisioned mode |
|
| Stream defaults | Failing batch retried until it succeeds or expires; the shard is blocked meanwhile | Poison record stalls the shard |
| Stream error settings | BisectBatchOnFunctionError, MaximumRetryAttempts (-1 to 10,000), MaximumRecordAgeInSeconds (-1 or 60–604,800) |
|
| Stream on-failure targets | SQS / SNS (metadata only), S3 (whole batch) ⚠️, Kafka topic (Kafka mappings); none for SQS mappings | |
| Stream parallelism | ParallelizationFactor 1–10 batches per shard; order kept per partition key |
|
| Filtering | FilterCriteria ≤ 5 filters (10 on request), ORed; keys body (SQS), data (Kinesis), dynamodb |
Execution roles and resource based policies
| Topic | Current facts | Memory hook |
|---|---|---|
| Execution role | Role Lambda assumes; trust lambda.amazonaws.com; credentials reach code as AWS_ACCESS_KEY_ID / AWS_SESSION_TOKEN env vars |
What the function can do |
| Resource-based policy | Who may invoke or manage the function, version or alias; max 20 KB | Who can call the function |
| Push vs poll | Push sources (S3, SNS, EventBridge, API Gateway, ALB) → resource policy (EventBridge rules: or a target execution role ⚠️); event source mappings → execution role | Push = policy, poll = role |
add-permission |
One Allow statement per call; conditions aws:SourceArn, aws:SourceAccount, aws:PrincipalOrgID |
|
put-resource-policy ⚠️ |
Full JSON: several principals, explicit Deny, any global condition key; overwrites the whole policy (--revision-id) |
Put replaces |
| Confused deputy | Add --source-arn and --source-account (S3 bucket ARNs have no account ID) |
|
| Cross-account invoke | Function resource policy AND the caller's identity policy | Both doors |
| Managed policies | AWSLambdaBasicExecutionRole (logs), AWSLambdaVPCAccessExecutionRole (ENIs), AWSXRayDaemonWriteAccess (traces) |
|
| Passing the role | iam:PassRole on the execution role to create or update a function |
|
| Restricting the code | lambda:SourceFunctionArn matches calls made with a function's credentials |
Concurrency scaling and throttling
| Topic | Current facts | Memory hook |
|---|---|---|
| Concurrency estimate | ≈ requests per second × average duration in seconds | |
| Account quota | 1,000 per Region (new accounts lower); raise in Service Quotas, code L-B99A9384 ⚠️ |
|
| Reserved concurrency | Guarantee + cap, free; max = unreserved − 100; 0 = stop all invocations | Reserved = fence |
| Scaling rate ⚠️ | 1,000 execution environments every 10 s per function; not adjustable | |
| Sync request ceiling | 10 requests/s per environment → 10 × concurrency | |
| Throttle error ⚠️ | TooManyRequestsException (429); reason ConcurrentInvocationLimitExceeded or ReservedFunctionConcurrentInvocationLimitExceeded |
|
| Throttle outcome by type | Sync → caller error · async → retried up to 6 h · event source mapping → backoff and retry | |
| Concurrency metrics | ConcurrentExecutions (Maximum), UnreservedConcurrentExecutions, ClaimedAccountConcurrency |
|
| Throttles metric | Throttles only; throttled requests are in neither Invocations nor Errors |
Throttles aren't errors |
Cold starts with provisioned concurrency and SnapStart
| Topic | Current facts | Memory hook |
|---|---|---|
| Lifecycle | Init → Invoke (repeated) → Shutdown; frozen between calls; recycled every few hours | |
| Init time limit | 10 s on demand; up to 15 min with provisioned concurrency, SnapStart or Managed Instances | |
| Init billing ⚠️ | Billed for every configuration since 2025-08-01 | |
| Cold start fixes in code | Clients and connections outside the handler, fewer imports, smaller package | Init once, reuse often |
| Provisioned concurrency | Pre-initialized environments on a version or alias (never $LATEST), billed; excess spills over to on-demand |
Warm and paid |
| PC auto scaling | Application Auto Scaling, lambda:function:ProvisionedConcurrency, target LambdaProvisionedConcurrencyUtilization 0.1–0.9, or scheduled |
|
| SnapStart runtimes ⚠️ | Java 11+, Python 3.12+, .NET 8+; .zip and container images on AWS base images | |
| SnapStart rules | ApplyOn=PublishedVersions; published versions only; not with PC, EFS, S3 Files or /tmp > 512 MB |
|
| SnapStart cost | Java: no extra charge · Python/.NET: snapshot caching (min 3 h) + each restore | |
| SnapStart hooks | Java CRaC beforeCheckpoint()/afterRestore() · Python @register_before_snapshot/@register_after_restore · restore ≤ 10 s |
|
| Uniqueness | Regenerate IDs, random seeds and credentials after restore | Snapshots clone everything |
Versions and aliases with traffic shifting
| Topic | Current facts | Memory hook |
|---|---|---|
| Version | Immutable copy of code + config, ARN function:<name>:<N>, numbers never reused |
Version = photograph |
$LATEST |
The only editable version; unqualified ARN invokes it | |
| Still editable on a version | Triggers, destinations, provisioned concurrency, async settings | |
| Alias | Mutable pointer to a version or $LATEST; can't point to an alias; name can't be only digits |
Alias = pointer |
| Weighted alias | 2 versions, both published, same execution role and DLQ config; AdditionalVersionWeights |
|
| Which version ran | X-Amz-Executed-Version header, START … Version: N log line, ExecutedVersion metric dimension |
|
| CodeDeploy canary configs | CodeDeployDefault.LambdaCanary10Percent5Minutes / 10Minutes / 15Minutes / 30Minutes |
10% first, rest later |
| CodeDeploy linear configs | CodeDeployDefault.LambdaLinear10PercentEvery1Minute / 2Minutes / 3Minutes / 10Minutes; also LambdaAllAtOnce |
10% steps |
| Lambda AppSpec | Function name, alias, current version, target version; hooks BeforeAllowTraffic, AfterAllowTraffic |
Deployment packages with layers and container images
| Topic | Current facts | Memory hook |
|---|---|---|
| Package types | .zip or container image, fixed at creation | |
| .zip limits | 50 MB zipped direct upload, 250 MB unzipped incl. layers, 3 MB console editor; > 50 MB via S3 | 50 in, 250 out |
| Code storage ⚠️ | 300 GB per Region; self-managed S3 storage (S3ObjectStorageMode=REFERENCE) doesn't count |
|
| Runtime-included SDK ⚠️ | Only Node.js, Python and Ruby runtimes; bundle your own SDK | |
| Go and Rust ⚠️ | OS-only runtime provided.al2023, executable named bootstrap (go1.x deprecated) |
|
| Layers | ≤ 5 per function, .zip only, extracted to /opt, immutable versioned ARNs, share with add-layer-version-permission |
|
| Container images | 10 GB, ECR in the same Region, Runtime Interface Client required, RIE for local tests; image deleted or ECR access lost → function Failed |
|
| AWS base images ⚠️ | public.ecr.aws/lambda/<runtime>:<tag>, Amazon Linux 2023 for Node.js 20+, Python 3.12+, Java 21+, .NET 8+, Ruby 3.3+ |
|
| Image updates | Tag is pinned to a digest → run update-function-code after each push |
Push isn't deploy |
| CloudFormation code | ZipFile inline (Node.js/Python, ≤ 4 MB); S3 code redeploys only when S3Key or S3ObjectVersion changes |
New key, new code |
| Code signing | AWS Signer profiles + code signing config; Warn (default) or Enforce |
Environment variables and secrets
| Topic | Current facts | Memory hook |
|---|---|---|
| Size | 4 KB for all variables combined, not adjustable | |
| Versions | Part of the version's frozen config; publish to change them | |
| Updating | --environment replaces the whole Variables map |
Send the whole map |
| Encryption at rest | Always: AWS managed key (default) or customer managed key (--kms-key-arn) |
|
| Customer managed key permissions | Configure: kms:CreateGrant + kms:Encrypt · view: kms:Decrypt |
|
| Encryption helpers | Client-side encryption; code calls KMS Decrypt; role needs kms:Decrypt |
|
| KMS failures | KMSAccessDeniedException, KMSDisabledException → HTTP 502 on invoke |
|
| Secrets ⚠️ | Secrets Manager recommended over environment variables; the variable holds only the secret ID | |
| Parameters and Secrets extension | localhost:2773, header X-Aws-Parameters-Secrets-Token, cache TTL 300 s, up to 1,000 items |
|
| Reserved variables | AWS_REGION, AWS_LAMBDA_FUNCTION_NAME, _HANDLER, AWS_LAMBDA_INITIALIZATION_TYPE, _X_AMZN_TRACE_ID |
VPC access and storage options
| Topic | Current facts | Memory hook |
|---|---|---|
| Default networking | Lambda-owned VPC with internet access, no route to your private resources | |
| VPC attachment | Subnets + security groups; Hyperplane ENI per subnet/SG combination, shared | |
| Role permissions | ec2:CreateNetworkInterface, DescribeNetworkInterfaces, DeleteNetworkInterface, AssignPrivateIpAddresses… (AWSLambdaVPCAccessExecutionRole) |
|
| Internet from a VPC | Private subnets + NAT gateway; a public subnet gives no public IP | Public subnet = no internet |
| AWS services from a VPC | VPC endpoints (gateway for S3 and DynamoDB, interface for others) or NAT | |
| Function states | New VPC function: Pending (not invocable) while its ENI is built · existing function being updated: stays Active (LastUpdateStatus InProgress), old configuration keeps serving · Inactive after 14 idle days (next call fails, back to Pending) |
|
| VPC errors | SubnetIPAddressLimitReachedException, ENILimitReachedException, EC2AccessDeniedException (502) |
|
/tmp |
512 MB default, up to 10,240 MB, per environment, never shared; always encrypted at rest with an AWS managed key ⚠️ | |
| EFS | VPC + access point + /mnt/ path + elasticfilesystem:ClientMount/ClientWrite + NFS 2049 |
|
| Governance keys | lambda:VpcIds, lambda:SubnetIds, lambda:SecurityGroupIds |
Function URLs and response streaming
| Topic | Current facts | Memory hook |
|---|---|---|
| Endpoint | https://<url-id>.lambda-url.<region>.on.aws, dual-stack, fixed for the URL's lifetime |
|
| Targets | An alias or $LATEST only |
|
| Auth types | AWS_IAM (SigV4) or NONE (public; the resource policy is still required) |
|
| Permissions ⚠️ | lambda:InvokeFunctionUrl + lambda:InvokeFunction (lambda:InvokedViaFunctionUrl), else 403 |
Two keys for one door |
Cross-account AWS_IAM |
Identity policy and resource policy both | |
| CORS | Configure on the URL, not in code | |
| Throttling | Reserved concurrency (429); 0 disables the URL | |
| Invoke modes | BUFFERED (default, 6 MB) or RESPONSE_STREAM (200 MB ⚠️; 6 MB fast, then 2 MBps) |
|
| Not supported | PrivateLink, numbered versions, URL streaming inside a VPC | |
| Choose API Gateway instead | Cognito or Lambda authorizers, API keys and usage plans, caching, validation, custom domains, WAF |
Observability with logs metrics and traces
| Topic | Current facts | Memory hook |
|---|---|---|
| Logs | /aws/lambda/<function>; needs logs:CreateLogStream + logs:PutLogEvents; S3 or Firehose also possible |
|
| Advanced logging | LogFormat JSON required for filtering; ApplicationLogLevel TRACE–FATAL, SystemLogLevel DEBUG/INFO/WARN (default INFO); custom LogGroup (not aws/…) |
|
REPORT line |
Duration, Billed Duration, Max Memory Used, Init Duration on cold starts |
|
| Key metrics | Invocations, Errors, Throttles, Duration, ConcurrentExecutions, IteratorAge, DeadLetterErrors |
|
| X-Ray | --tracing-config Mode=Active; AWSXRayDaemonWriteAccess; sampling fixed at 1/s + 5% |
|
PassThrough ⚠️ |
Default mode; forwards the header only, sends no Lambda segments | Active or invisible |
| Instrumentation ⚠️ | OpenTelemetry / ADOT recommended; X-Ray SDK in maintenance mode | |
| Recursion guard | Stops loops through Lambda, SQS, SNS, S3 and EventBridge custom buses after ~16 calls; RecursiveInvocationsDropped |
Performance tuning and limits
| Topic | Current facts | Memory hook |
|---|---|---|
| Memory and CPU | 128–10,240 MB; CPU proportional; 1 vCPU at 1,769 MB ⚠️; 6 vCPUs at the maximum | Memory is the CPU dial |
| Tuning tools | AWS Lambda Power Tuning; Compute Optimizer (x86_64 only); Max Memory Used |
|
| Timeout | Default 3 s, maximum 900 s | |
| Pricing (US East, x86) ⚠️ | $0.20 per million requests; $0.0000166667 per GB-second; billed per 1 ms | |
| Free tier | 1 million requests + 400,000 GB-seconds per month | |
| Billed extras | /tmp above 512 MB, provisioned concurrency, SnapStart cache/restore (Python/.NET), Init time |
|
| Jobs over 15 minutes | Split the work (SQS, Step Functions) or use a container service | |
| Switching to arm64 | Rebuild for arm64 and set --architectures arm64 on update-function-code |
Numbers to know
| Item | Value | Note |
|---|---|---|
| Memory range | 128–10,240 MB, 1-MB steps | Default 128 MB |
| Memory for one full vCPU | 1,769 MB ⚠️ | Up to 6 vCPUs at 10,240 MB |
| Timeout | Default 3 s, max 900 s | 15 minutes, not adjustable |
| Synchronous payload | 6 MB request, 6 MB response | Not adjustable |
| Asynchronous payload | 1 MB ⚠️ | Since 2025-10-24 |
| Streamed response | 200 MB ⚠️ | First 6 MB uncapped, then 2 MBps |
| Environment variables | 4 KB total | Not adjustable |
/tmp storage |
512 MB default, up to 10,240 MB | Above 512 MB is billed |
| Layers per function | 5 | .zip functions only |
| .zip direct upload | 50 MB zipped | Larger through S3 |
| Unzipped package | 250 MB | Function + all layers |
| Console code editor | 3 MB | |
| Container image | 10 GB uncompressed | Stored in ECR |
| Code storage | 300 GB per Region ⚠️ | Self-managed S3 storage not counted |
| Resource-based policy | 20 KB | |
| Default concurrency | 1,000 per Region | New accounts start lower |
| Concurrency kept unreserved | 100 | Can't be reserved |
| Scaling rate | 1,000 environments per 10 s per function ⚠️ | |
| Sync requests per environment | 10 per second | RPS ceiling = 10 × concurrency |
| Async retries | 2 (3 attempts) | ~1 min, then ~2 min |
| Async event age | 60–21,600 s | Default 6 h |
| Throttled async retry window | Up to 6 h | Backoff 1 s → 5 min |
| SQS batch size | Standard 10,000 ⚠️, FIFO 10 | Default 10 |
| Batching window | 0–300 s | ≥ 1 s when batch size > 10 |
| SQS visibility timeout | ≥ 6 × function timeout | Plus the batching window |
SQS maxReceiveCount |
≥ 5 recommended | Redrive to the queue's DLQ |
| SQS scaling | +300 per minute, max 1,250 per mapping ⚠️ | Default mode |
SQS MaximumConcurrency |
2–1,000 | Per mapping |
| Kinesis / DynamoDB batch size | Default 100, max 10,000 | |
ParallelizationFactor |
1–10 | Batches per shard |
MaximumRecordAgeInSeconds |
-1, or 60–604,800 | Streams and Kafka |
| Event filters per mapping | 5 (10 on request) | ORed |
| Init phase limit | 10 s | On-demand environments |
| Versions per weighted alias | 2 | Both published |
| PC target tracking | 0.1–0.9 utilization | LambdaProvisionedConcurrencyUtilization |
| SnapStart restore limit | 10 s | Else SnapStartTimeoutException |
| Recursive loop stop | ~16 invocations | RecursiveInvocationsDropped |
| Log tail returned | Last 4 KB | --log-type Tail |
| Secrets extension | Port 2773, TTL 300 s | Cache up to 1,000 items |
| Free tier | 1 million requests + 400,000 GB-seconds per month |
Decision rules
Invocation and failure handling (§1–§3)
- If you see a synchronous caller that must detect function failures, think
FunctionError/X-Amz-Function-Error(status still 200). - If you see failed asynchronous events to keep with their error details, think on-failure destination, not a DLQ.
- If you see async events that expire after N minutes or may be retried once, think
MaximumEventAgeInSecondsandMaximumRetryAttempts. - If you see chaining functions without SDK calls, think destinations (on-success to EventBridge or Lambda).
- If you see failed SQS messages that must be kept, think DLQ in the source queue's redrive policy.
- If you see a whole SQS batch reprocessed because of one message, think
ReportBatchItemFailures. - If you see SQS messages processed twice while still running, think visibility timeout ≥ 6 × function timeout.
- If you see a stalled shard with rising
IteratorAge, think bisect + retry limit + maximum record age + on-failure destination. - If you see a stream consumer falling behind, think
ParallelizationFactoror more shards. - If you see "process only some messages", think
FilterCriteria.
Permissions (§4)
- If you see a function calling AWS services, think least-privilege execution role.
- If you see S3, SNS, EventBridge or another account unable to invoke, think resource-based policy with
--source-arnand--source-account(an EventBridge rule can use a target execution role instead). - If you see an event source mapping with access errors, think execution role permissions on the source.
- If you see an explicit Deny or several principals in a function policy, think
put-resource-policy.
- If you see a database overwhelmed by a scaling function, think reserved concurrency (or RDS Proxy).
- If you see 429
TooManyRequestsExceptionwith risingThrottles, think a concurrency quota increase or reserved concurrency. - If you see predictable peaks needing the lowest latency, think provisioned concurrency with Application Auto Scaling.
- If you see slow Java, Python or .NET init and no budget for idle capacity, think SnapStart.
Releases and packaging (§7–§8)
- If you see a canary release with automatic rollback, think CodeDeploy with a weighted alias.
- If you see dependencies above 250 MB unzipped, think container image.
- If you see a pushed image but old code running, think
update-function-code. - If you see CloudFormation ignoring new S3 code, think change
S3KeyorS3ObjectVersion.
Configuration, networking and endpoints (§9–§11)
- If you see credentials for a function, think Secrets Manager + Parameters and Secrets extension.
- If you see a VPC-attached function without internet access, think NAT gateway from private subnets.
- If you see files shared by concurrent invocations, think EFS access point under
/mnt/. - If you see a cheap HTTPS endpoint for a webhook, think function URL with both invoke permissions.
- If you see authorizers, API keys, caching or request validation, think API Gateway, not a function URL.
Observability and tuning (§12–§13)
- If you see a running function with no logs, think missing
logs:CreateLogStream/logs:PutLogEvents. - If you see no Lambda segments in X-Ray, think
Activetracing. - If you see a CPU-bound function, think more memory, measured with Power Tuning.
Memory hooks
Invocation and failure handling (§1–§3)
- Sync waits, async queues, event source mappings poll.
- 200 doesn't mean OK: read
FunctionError. - Two retries and six hours: the async pair.
- Six, one, two hundred: MB for sync, async and streamed payloads.
- Six times the timeout for SQS visibility.
- Queue failures stay with the queue; stream failures go to a destination.
- Name the failures:
batchItemFailures.
Permissions and scaling (§4–§6)
- Push needs a policy, poll needs the role.
- Put replaces, update merges (event invoke config, resource policy, environment map).
- Reserved is a free fence; provisioned is a paid warm-up.
- A thousand every ten seconds, per function.
- Throttles aren't errors.
- Snapshots clone everything: regenerate uniqueness after restore.
Releases, packaging and configuration (§7–§11)
- Version = photograph, alias = pointer.
- Two versions, one role, one DLQ per weighted alias.
- Push isn't deploy: images are pinned by digest.
- 50 in, 250 out, 10 GB for images.
- A public subnet gives a function nothing.
- Two keys for one door:
InvokeFunctionUrl+InvokeFunction.
Observability and tuning (§12–§13)
- Active tracing or invisible.
- Memory is the CPU dial: 1,769 MB buys one vCPU.
- Fifteen minutes is a wall, not a setting.