canonical: https://jentic.com/apis/amazonaws.com/aws-lambda-api

# AWS Lambda API

AWS Lambda runs code in response to events without requiring you to provision or manage servers. The Lambda API gives full control over functions, including creating and updating function code from zip archives or container images, configuring memory and timeout, attaching layers, managing aliases and versions, and wiring event source mappings to streams from Kinesis, DynamoDB, SQS, MSK, and self-managed Kafka. It also supports synchronous, asynchronous, and streaming invocation, plus URL-based public endpoints via Lambda function URLs.

## For AI agents

Create, update, invoke, and configure AWS Lambda functions, manage versions and aliases, attach layers, and wire event source mappings to streams and queues so an agent can deploy and run serverless code on demand.

## Scope

Does not run long-lived servers, host containers without per-request scaling, or manage VM fleets. Use for serverless function execution and configuration only.

## Capabilities

- Create and update Lambda functions from a zip deployment package or a container image stored in Amazon ECR
- Invoke a function synchronously, asynchronously, or with response streaming for long-lived outputs
- Manage published versions and weighted aliases for blue/green and canary traffic shifting
- Attach Lambda layers to share code, dependencies, or runtimes across multiple functions
- Wire event source mappings from Kinesis, DynamoDB streams, Amazon SQS, Amazon MSK, and self-managed Kafka to drive functions automatically
- Configure function URL endpoints with IAM or none auth for HTTP-triggered serverless apps
- Tune concurrency, memory, ephemeral storage, and reserved or provisioned concurrency per function

## Use cases

### Event-Driven SQS Processing

Run a Lambda function for every message that lands on an SQS queue without writing a poller. Create the function with createFunction, then create an event source mapping that points at the queue ARN with a configured batch size and reporting on partial batch failures. Lambda scales the function up to the queue's concurrency limit, retries failed messages, and routes poison messages to a dead-letter queue. Setup takes around an hour including IAM permissions.

Example prompt: Create a Lambda function order-processor (Python 3.12, 512 MB, 30s timeout) from a zip in S3, then create an event source mapping pointing at queue arn:aws:sqs:eu-west-1:...:orders with BatchSize=10 and FunctionResponseTypes=ReportBatchItemFailures.

### Canary Deploys via Aliases

Roll out a new function version to a small percentage of production traffic and ramp up if metrics stay healthy. Use publishVersion to snapshot the current function, then updateAlias on the production alias with a routing config that sends 10 percent of invokes to the new version. Cut over to 100 percent or roll back by editing the alias. This is the standard pattern for AWS SAM and AWS CodeDeploy traffic shifting.

Example prompt: Call publishVersion on function checkout-api, then updateAlias prod with FunctionVersion set to the previous live version and RoutingConfig.AdditionalVersionWeights set to {newVersion: 0.1}.

### Container Image Function for Heavy Dependencies

Package a Lambda function as a container image when the deployment exceeds the 250 MB unzipped zip limit or needs custom runtimes, common for ML inference, headless browsers, or large native libraries. Build and push the image to Amazon ECR, then create a function with PackageType=Image pointing at the ECR URI. Lambda runs the image with up to 10 GB memory and 15-minute timeouts.

Example prompt: Create function pdf-renderer with PackageType=Image, ImageUri=123456789012.dkr.ecr.eu-west-1.amazonaws.com/pdf-renderer:v3, MemorySize=3008, Timeout=120, and Architectures=['arm64'].

### Agent-Triggered Serverless Tasks

Let an AI agent execute one-off serverless work, such as reformatting a document, fetching a fresh report, or running a price calculation, by invoking pre-deployed Lambda functions through Jentic. The agent picks the right function from Jentic's intent search, passes structured input, and receives the function response. Long-lived AWS credentials stay in your Jentic One instance; the agent only ever calls Jentic with a scoped key.

Example prompt: Search Jentic for 'invoke a lambda function and get the response', load the invoke schema, and execute it with FunctionName=customer-summary, Payload=JSON of {customerId: 'cus_42'}.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /2015-03-31/functions | Create a Lambda function |
| GET | /2015-03-31/functions | List functions in this region |
| GET | /2015-03-31/functions/{FunctionName} | Get a function and its configuration |
| PUT | /2015-03-31/functions/{FunctionName}/code | Update function code |
| PUT | /2015-03-31/functions/{FunctionName}/configuration | Update function memory, timeout, env, and other config |
| POST | /2015-03-31/functions/{FunctionName}/invocations | Invoke a function synchronously or asynchronously |
| POST | /2015-03-31/functions/{FunctionName}/invoke-with-response-stream | Invoke a function and stream the response |
| POST | /2015-03-31/functions/{FunctionName}/aliases | Create an alias for traffic routing |

## Key resources

- **Functions** — Create, update, list, get, and delete Lambda functions; manage code, configuration, and concurrency.
- **Versions and Aliases** — Publish immutable versions and route traffic between them with weighted aliases.
- **Event Source Mappings** — Connect Kinesis, DynamoDB streams, SQS, MSK, and Kafka topics to functions.
- **Layers** — Publish reusable layers of code, libraries, or runtimes and attach them to functions.
- **Function URLs** — Expose a function over HTTPS without API Gateway, with optional IAM auth.
- **Invocation** — Synchronous invoke, asynchronous invoke, and invoke-with-response-stream.

## Why Jentic

- **Setup:** Wiring the AWS Lambda API by hand means holding an access key ID and secret access key, computing an AWS Signature Version 4 signature on every request, resolving the right regional host such as lambda.us-east-1.amazonaws.com, and handling throttling and retries yourself. Through Jentic you install once, import the AWS Lambda API from the API Directory, store the AWS access key once, and your agent calls it.
- **Permission scoping:** Lambda puts the function name in the URL path (/2015-03-31/functions/{FunctionName}/...), so a rule can pin your agent to the functions it works with: it can invoke and read configuration for that function and nothing else. You choose the operations it may call, so destructive ones like deleting a function or updating its code are not included unless you add them.
- **Credential handling:** Your AWS access key ID and secret access key are stored once, encrypted, by your own Jentic One instance, and the Signature Version 4 signature is computed at execution time. The raw keys never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'invoke a Lambda function' or 'update function code from a zip', and Jentic returns the matching AWS Lambda operation with its input schema so the agent calls the right endpoint without crawling the AWS reference.

## Related APIs

- **Amazon EC2** — Long-running VMs for workloads that need persistent state, custom networking, or runtimes Lambda does not support.
- **Amazon API Gateway** — Fronts Lambda functions with REST or HTTP APIs, custom domains, throttling, and request validation.
- **Amazon CloudWatch** — Captures Lambda function logs, metrics, and alarms for observability of running functions.

## FAQ

### What authentication does the AWS Lambda API use?

All requests are signed with AWS Signature Version 4 using an AWS access key ID and secret access key. Through Jentic, the keys live encrypted in your Jentic One instance and signing is performed server-side; the agent only sees a scoped Jentic credential reference.

### Can I deploy a Lambda function from a container image with this API?

Yes. Call createFunction with PackageType=Image and an ImageUri pointing at an Amazon ECR repository in the same region. Container image functions support up to 10 GB memory, 15-minute timeouts, and arm64 or x86_64 architectures.

### What are the rate limits for the AWS Lambda API?

Lambda enforces account-level concurrent execution limits (default 1,000) and per-function reserved or provisioned concurrency that you set explicitly. The control-plane API operations (createFunction, updateFunctionCode, etc.) are subject to standard AWS request throttling and return ThrottlingException with retry guidance.

### How do I invoke a Lambda function and get the response through Jentic?

Search Jentic for 'invoke a Lambda function' and execute the returned operation with FunctionName and a JSON Payload. The operation maps to POST /2015-03-31/functions/{FunctionName}/invocations and returns the function's payload synchronously when InvocationType is RequestResponse.

### Does the API support streaming responses?

Yes. Use POST /2015-03-31/functions/{FunctionName}/invoke-with-response-stream to receive a chunked response from a function configured with response streaming. This is suitable for LLM-style outputs and large file generation that should not buffer in memory.

### Is AWS Lambda free to use?

Lambda has an always-free tier of 1 million requests and 400,000 GB-seconds of compute per month. Beyond that, you pay per request and per GB-second of memory consumed at the duration billed in 1 ms increments.

### Can I limit what my agent is allowed to do with the AWS Lambda API?

Yes. Because Jentic One is self-hosted by you, your own rules decide which Lambda operations and credentials the agent may use. Since the function name sits in the URL path (/2015-03-31/functions/{FunctionName}/...), you can pin the agent to specific functions and grant only the operations you want, such as letting it invoke a function and read its configuration while withholding destructive calls like deleting a function or updating its code. Your AWS access key is stored encrypted in your own Jentic One instance and the request is signed at execution time, so the agent never handles the raw key.