Learn
AWS
Compute
Lambda

AWSGCP laterAzure later

LambdaAWS Lambda

ComputeCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

Runs your code in response to events, with no servers to manage. You pay per request and by the millisecond, and a run lasts 15 minutes at most.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalMEDDeveloper – AssociateHIGHSysOps Administrator – AssociateMEDSecurity – SpecialtyLOWData Engineer – AssociateLOW

Where Lambda takes you7 steps, all open

I know the problem it solves
I can picture it
I know how it scales
I know how it fails
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

Code that runs when something happens

Lambda runs your code when something happens: a call to its function URL, a file landing in S3, a message on a queue. It gives each request it is handling at the same moment an execution environment of its own, adds environments as the load grows, and removes them after they sit idle. There is no server to size or patch.

It is built for short work. A run lasts 15 minutes at most, and a function gets between 128 MB and 10,240 MB of memory, with CPU in proportion. You pay for each request and for the time the code runs, to the millisecond.

Reach for it when

code runs in response to events and finishes in seconds or minutes
the load is spiky, or often zero
nobody wants to manage servers
work joins AWS services together: resize an upload, process a queue

It is the wrong tool when

a job runs longer than 15 minutes: that is EC2
the software needs a kernel driver or full control of the operating system: that is EC2
one request needs more than 10,240 MB of memory

Mental model

A taxi rank

You do not own a car; you take a taxi when you need a ride and pay for the trip. When a crowd arrives, more taxis come, up to the number the rank is licensed for. A taxi that has been standing cold takes a moment to start. One kept waiting with its engine running leaves at once, but you pay for it while it waits.

A rideone run of the functionInvocation

A taxireused from ride to rideExecution environment

The rank's licencehow many run at once in the accountConcurrency limit

Starting a cold enginea new environment's extra start-up timeCold start

Taxis kept runningenvironments initialised in advance, and chargedProvisioned concurrency

Taxis kept for one firmcapacity set aside for one functionReserved concurrency

How it works

A handler, a role and a trigger

Write a handlerPackage the code as a .zip file or a container image. Shared libraries can go in layers, up to five per function.
Give it a roleThe execution role is what the function may do: write logs, read a table. Lambda assumes it when the function is invoked.
Connect a triggerServices invoke it synchronously or asynchronously. For queues and streams, Lambda polls them and sends batches: an event source mapping.
Let it scaleOne execution environment per request in flight, reused when free, up to the account's concurrency: 1,000 in a Region by default.

Timeout: 15 min900 seconds, the longest a run can last
Memory: 128 to 10,240 MBin 1 MB steps
One vCPU: At 1,769 MBCPU grows with memory
Concurrency: 1,000per account per Region, by default
Payload: 6 MBeach way synchronously; 1 MB asynchronously
Layers: 5per function

Architecture

One function, two triggers

The API waits for the function's answer. S3 hands off the event and moves on, and Lambda retries it if it fails.

The role must allow every call the function makes. Here that is the table, and sending to the queue for the on-failure destination. Nothing about the triggers grants those.

The triggers need permission the other way. A resource-based policy on the function lets S3 or another service, or another account, invoke it.

Scaling

Concurrency, not servers

How much concurrency a load needs

concurrency = requests per second × average run time in seconds

100 requests a second × 0.5 s = 50 environments busy at once

5,000 requests a second × 0.2 s = 1,000, the default limit

Requests a second 2,000

Concurrent executions 400

Capacity: 5 requests a second for each.

400 concurrent executions can take 2,000 requests a second, and 100% of that is in use.

Here every request takes 200 ms, so one environment handles five a second. Past the limit, requests are throttled: a synchronous caller gets the error back, and an asynchronous event returns to Lambda's queue to be tried again.

Reserved concurrency sets aside part of the account's concurrency for one function and caps the function there, so it cannot starve the others or flood a database. It costs nothing.

Provisioned concurrency keeps environments initialised before the requests arrive, so they skip the cold start. It is charged for as long as it is configured.

How fast it grows. Each function can add up to 1,000 execution environments every 10 seconds.

Failure simulation

An event that keeps failing

Queued
Lambda puts the event on its own queue and tells the caller it was accepted.
Concurrency
A free execution environment, within the function's and the account's concurrency.
Attempts
The function runs. After an error or a timeout, Lambda tries twice more, about one and then two minutes apart.
Destination
An event that fails every attempt goes to the on-failure destination or dead-letter queue if one is set, and is otherwise discarded.

Pick a case to follow the event through each check.

The same event can arrive twice. Lambda's queue is eventually consistent, so write the handler to be safe when it runs twice on one event.

With an SQS trigger, handle failures on the queue. Set the dead-letter queue on the SQS queue, not on the function.

Security

What it may call, and who may call it

An execution role with only what the function needs. It is an IAM role that Lambda assumes. IAM Access Analyzer can generate a policy from the calls the function actually made.

Who may invoke it is a separate policy. A resource-based policy on the function grants other accounts, organisations or AWS services permission to invoke or manage it.

In a VPC only when it must be. Attached to private subnets, a function reaches resources there, such as an RDS database, and then reaches the internet only through a NAT gateway. A public subnet gives it no public IP address and no internet access.

The off switch. Setting a function's reserved concurrency to zero stops anything invoking it.

Cost

How you are charged, not what it costs today

Per request, and per GB-second. You pay for the number of requests, and for how long the code runs, rounded up to the nearest millisecond and weighted by the memory you gave it.

Memory is the dial. It runs from 128 MB to 10,240 MB, and CPU comes with it.

Extras: ephemeral storage beyond what is included, and provisioned concurrency for as long as it is configured, rounded up to five minutes. Reserved concurrency is free.

A free tier of requests and duration each month applies to standard functions, not to provisioned concurrency.

Prices change, so none are printed here. Check the Lambda pricing page on aws.amazon.com.

Comparison

Three ways in, four ways to control concurrency

How it is invoked	Who waits	When the function fails	Examples
Synchronous	The caller, for the response	The caller gets the error, and retries if it wants to	The Invoke API with RequestResponse, a function URL
Asynchronous	Nobody: Lambda queues the event and answers at once	Two more attempts, then a destination or dead-letter queue	S3 and SNS notifications, Invoke with Event
Event source mapping	Lambda, which polls the source and sends batches	Up to the source: an SQS message comes back after its visibility timeout	SQS queues, Kinesis and DynamoDB streams

Setting	What it does	Cold starts	Extra charge
No setting	The function shares the account's unreserved pool	Possible	No
Reserved concurrency	Sets aside capacity for one function, and caps it there	Possible: environments are made on demand	No
Provisioned concurrency	Keeps environments initialised in advance	Not within what is provisioned	Yes, while it is configured
SnapStart	Starts from a cached snapshot of the environment	Shorter	No, for Java 11 and Java 17

SAA traps

The phrase in the question, and what it means

the job takes 40 minutesNot Lambda

A run can last at most 15 minutes, 900 seconds.

the first requests after a quiet spell are slowProvisioned concurrency

Environments are initialised in advance, so requests skip the cold start. It is charged while it is configured.

one function must never use up the concurrency the others needReserved concurrency

It sets aside a share for that function and caps it there.

the function opens too many connections to the databaseReserved concurrency, as a ceiling

No more copies of the function run at once than it allows.

a function in a VPC cannot reach the internetPrivate subnets with a route to a NAT gateway

A function attached to a VPC gets no public IP address, even in a public subnet.

keep the asynchronous events that failed, to run again laterAn on-failure destination, or a dead-letter queue

After the last attempt Lambda sends the event there instead of discarding it.

how often does Lambda retry an asynchronous event that errorsTwice more

About a minute after the first failure, then two minutes after the second.

the same library in many functionsA layer

A .zip archive of shared code, extracted into /opt, up to five per function.

the function must write to a DynamoDB tableAllow it in the execution role

The role Lambda assumes decides what the code may call.

stop a function from being invoked at all, at onceSet its reserved concurrency to zero

With no concurrency, nothing can run it.

Scenario

Exam style, marked when you answer

A company's order API runs on Lambda behind API Gateway. At the start of each sale, the first customers wait several seconds longer than usual for a response, although the function itself runs in under 200 ms. Which change fixes this most directly?

Practice

Fill the gap, the way the challenges work

Each photo uploaded to a bucket must have its size and camera details read and written to a table within seconds. Uploads come in bursts with hours of nothing between them, and nobody wants a server to patch or to pay for while it sits idle. What reads each photo?

S3· Photo uploadsPick a service belowDynamoDB· Photo details

Quick revision

The night before the exam

Limits: 15 min a run; 128 MB to 10,240 MB of memory.
Concurrency: Requests a second × seconds each; 1,000 per Region by default.
Reserved: Sets aside and caps. Free.
Provisioned: Initialised ahead, so no cold start. Charged.
Asynchronous: Queued; two more attempts; throttled events retried for up to 6 hours.
Failures: An on-failure destination or a dead-letter queue.
VPC: Private subnets, and a NAT gateway for the internet.
Permissions: Execution role for what it calls; resource-based policy for who calls it.
Billing: Requests, plus duration to the millisecond weighted by memory.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Next: API GatewayA managed front door for APIs: REST, HTTP and WebSocket APIs that take each call, check who is calling, throttle it, and pass it to Lambda, another service or any HTTP backend.

Open API Gateway

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.