Skip to main content

functions

Creates, updates, deletes, gets or lists a functions resource.

Overview​

Namefunctions
TypeResource
Idaws.lambda.functions

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
codeobjectThe deployment package of the function or version.
concurrencyobjectThe function's reserved concurrency.
configurationobjectDetails about a function's configuration.
tagsobjectThe function's tags. Lambda returns tag data only if you have explicit allow permissions for lambda:ListTags.
tags_errorobjectAn object that contains details about an error related to retrieving tags.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
get_functionselectfunction_name, regionQualifierReturns information about the function or function version, with a link to download the deployment package that's valid for 10 minutes. If you specify a function version, only details that are specific to that version are returned.
list_functionsselectregionMasterRegion, FunctionVersion, Marker, MaxItemsReturns a list of Lambda functions, with the version-specific configuration of each. Lambda returns up to 50 functions per call. Set FunctionVersion to ALL to include all published versions of each function in addition to the unpublished version. The ListFunctions operation returns a subset of the FunctionConfiguration fields. To get the additional fields (State, StateReasonCode, StateReason, LastUpdateStatus, LastUpdateStatusReason, LastUpdateStatusReasonCode, RuntimeVersionConfig) for a function or version, use GetFunction.
create_functioninsertregion, FunctionNameCreates a Lambda function. To create a function, you need a deployment package and an execution role. The deployment package is a .zip file archive or container image that contains your function code. The execution role grants the function permission to use Amazon Web Services services, such as Amazon CloudWatch Logs for log streaming and X-Ray for request tracing. If the deployment package is a container image, then you set the package type to Image. For a container image, the code property must include the URI of a container image in the Amazon ECR registry. You do not need to specify the handler and runtime properties. If the deployment package is a .zip file archive, then you set the package type to Zip. For a .zip file archive, the code property specifies the location of the .zip file. You must also specify the handler and runtime properties. The code in the deployment package must be compatible with the target instruction set architecture of the function (x86-64 or arm64). If you do not specify the architecture, then the default value is x86-64. When you create a function, Lambda provisions an instance of the function and its supporting resources. If your function connects to a VPC, this process can take a minute or so. During this time, you can't invoke or modify the function. The State, StateReason, and StateReasonCode fields in the response from GetFunctionConfiguration indicate when the function is ready to invoke. For more information, see Lambda function states. A function has an unpublished version, and can have published versions and aliases. The unpublished version changes when you update your function's code and configuration. A published version is a snapshot of your function code and configuration that can't be changed. An alias is a named resource that maps to a version, and can be changed to map to a different version. Use the Publish parameter to create version 1 of your function from its initial configuration. The other parameters let you configure version-specific and function-level settings. You can modify version-specific settings later with UpdateFunctionConfiguration. Function-level settings apply to both the unpublished and published versions of the function, and include tags (TagResource) and per-function concurrency limits (PutFunctionConcurrency). You can use code signing if your deployment package is a .zip file archive. To enable code signing for this function, specify the ARN of a code-signing configuration. When a user attempts to deploy a code package with UpdateFunctionCode, Lambda checks that the code package has a valid signature from a trusted publisher. The code-signing configuration includes set of signing profiles, which define the trusted publishers for this function. If another Amazon Web Services account or an Amazon Web Services service invokes your function, use AddPermission to grant permission by creating a resource-based Identity and Access Management (IAM) policy. You can grant permissions at the function level, on a version, or on an alias. To invoke your function directly, use Invoke. To invoke your function in response to events in other Amazon Web Services services, create an event source mapping (CreateEventSourceMapping), or configure a function trigger in the other service. For more information, see Invoking Lambda functions.
add_permissionupdatefunction_name, region, StatementId, Action, PrincipalQualifierGrants a principal permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST. To grant permission to another account, specify the account ID as the Principal. To grant permission to an organization defined in Organizations, specify the organization ID as the PrincipalOrgID. For Amazon Web Services services, the principal is a domain-style identifier that the service defines, such as s3.amazonaws.com or sns.amazonaws.com. For Amazon Web Services services, you can also specify the ARN of the associated resource as the SourceArn. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. This operation adds a statement to a resource-based permissions policy for the function. For more information about function policies, see Using resource-based policies for Lambda.
remove_permissionupdatefunction_name, statement_id, regionQualifier, RevisionIdRevokes function-use permission from an Amazon Web Services service or another Amazon Web Services account. You can get the ID of the statement from the output of GetPolicy.
update_function_codeupdatefunction_name, regionUpdates a Lambda function's code. If code signing is enabled for the function, the code package must be signed by a trusted publisher. For more information, see Configuring code signing for Lambda. If the function's package type is Image, then you must specify the code package in ImageUri as the URI of a container image in the Amazon ECR registry. If the function's package type is Zip, then you must specify the deployment package as a .zip file archive. Enter the Amazon S3 bucket and key of the code .zip file location. You can also provide the function code inline using the ZipFile field. The code in the deployment package must be compatible with the target instruction set architecture of the function (x86-64 or arm64). The function's code is locked when you publish a version. You can't modify the code of a published version, only the unpublished version. For a function defined as a container image, Lambda resolves the image tag to an image digest. In Amazon ECR, if you update the image tag to a new image, Lambda does not automatically update the function.
delete_functiondeletefunction_name, regionQualifierDeletes a Lambda function. To delete a specific function version, use the Qualifier parameter. Otherwise, all versions and aliases are deleted. This doesn't require the user to have explicit permissions for DeleteAlias. A deleted Lambda function cannot be recovered. Ensure that you specify the correct function name and version before deleting. To delete Lambda event source mappings that invoke a function, use DeleteEventSourceMapping. For Amazon Web Services services and resources that invoke your function directly, delete the trigger in the service where you originally configured it.
invokeexecfunction_name, regionX-Amz-Invocation-Type, X-Amz-Log-Type, X-Amz-Client-Context, X-Amz-Durable-Execution-Name, Qualifier, X-Amz-Tenant-IdInvokes a Lambda function. You can invoke a function synchronously (and wait for the response), or asynchronously. By default, Lambda invokes your function synchronously (i.e. theInvocationType is RequestResponse). To invoke a function asynchronously, set InvocationType to Event. Lambda passes the ClientContext object to your function for synchronous invocations only. For synchronous invocations, the maximum payload size is 6 MB. For asynchronous invocations, the maximum payload size is 1 MB. For synchronous invocation, details about the function response, including errors, are included in the response body and headers. For either invocation type, you can find more information in the execution log and trace. When an error occurs, your function may be invoked multiple times. Retry behavior varies by error type, client, event source, and invocation type. For example, if you invoke a function asynchronously and it returns an error, Lambda executes the function up to two more times. For more information, see Error handling and automatic retries in Lambda. For asynchronous invocation, Lambda adds events to a queue before sending them to your function. If your function does not have enough capacity to keep up with the queue, events may be lost. Occasionally, your function may receive the same event multiple times, even if no error occurs. To retain events that were not processed, configure your function with a dead-letter queue. The status code in the API response doesn't reflect function errors. Error codes are reserved for errors that prevent your function from executing, such as permissions errors, quota errors, or issues with your function's code and configuration. For example, Lambda returns TooManyRequestsException if running the function would cause you to exceed a concurrency limit at either the account level (ConcurrentInvocationLimitExceeded) or function level (ReservedFunctionConcurrentInvocationLimitExceeded). For functions with a long timeout, your client might disconnect during synchronous invocation while it waits for a response. Configure your HTTP client, SDK, firewall, proxy, or operating system to allow for long connections with timeout or keep-alive settings. This operation requires permission for the lambda:InvokeFunction action. For details on how to set up permissions for cross-account invocations, see Granting function access to other accounts.
invoke_asyncexecfunction_name, region, InvokeArgsFor asynchronous function invocation, use Invoke. Invokes a function asynchronously. The payload limit is 256KB. For larger payloads, for up to 1MB, use Invoke. If you do use the InvokeAsync action, note that it doesn't support the use of X-Ray active tracing. Trace ID is not propagated to the function, even if X-Ray active tracing is turned on.
invoke_with_response_streamexecfunction_name, regionX-Amz-Log-Type, X-Amz-Client-Context, Qualifier, X-Amz-Tenant-Id, X-Amz-Invocation-TypeConfigure your Lambda functions to stream response payloads back to clients. For more information, see Configuring a Lambda function to stream responses. This operation requires permission for the lambda:InvokeFunction action. For details on how to set up permissions for cross-account invocations, see Granting function access to other accounts.
publish_versionexecfunction_name, regionCreates a version from the current code and configuration of a function. Use versions to create a snapshot of your function code and configuration that doesn't change. Lambda doesn't publish a version if the function's configuration and code haven't changed since the last version. Use UpdateFunctionCode or UpdateFunctionConfiguration to update the function before publishing a version. Clients can invoke versions directly or with an alias. To create an alias, use CreateAlias.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
function_namestringThe name or ARN of the Lambda function. Name formats Function name - MyFunction. Function ARN - arn:aws:lambda:us-west-2:123456789012:function:MyFunction. Partial ARN - 123456789012:function:MyFunction. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.
regionstringAWS region (default: us-east-1)
statement_idstringStatement ID of the permission to remove.
FunctionVersionstringSet to ALL to include entries for all published versions of each function.
MarkerstringSpecify the pagination token that's returned by a previous request to retrieve the next page of results.
MasterRegionstringFor Lambda@Edge functions, the Amazon Web Services Region of the master function. For example, us-east-1 filters the list of functions to include only Lambda@Edge functions replicated from a master function in US East (N. Virginia). If specified, you must set FunctionVersion to ALL.
MaxItemsintegerThe maximum number of functions to return in the response. Note that ListFunctions returns a maximum of 50 items in each response, even if you set the number higher.
QualifierstringThe alias name.
RevisionIdstringUpdate the policy only if the revision ID matches the ID that's specified. Use this option to avoid modifying a policy that has changed since you last read it.
X-Amz-Client-ContextstringUp to 3,583 bytes of base64-encoded data about the invoking client to pass to the function in the context object.
X-Amz-Durable-Execution-NamestringA unique name for the durable execution. If you invoke a durable function using a name that already exists with the same payload, Lambda returns the existing execution instead of creating a duplicate. If the payload differs, Lambda returns a DurableExecutionAlreadyStartedException error. If not specified, Lambda generates a unique identifier automatically. For more information, see Execution names.
X-Amz-Invocation-TypestringUse one of the following options: RequestResponse (default) – Invoke the function synchronously. Keep the connection open until the function returns a response or times out. The API operation response includes the function response and additional data. DryRun – Validate parameter values and verify that the IAM user or role has permission to invoke the function.
X-Amz-Log-TypestringSet to Tail to include the execution log in the response. Applies to synchronously invoked functions only.
X-Amz-Tenant-IdstringThe identifier of the tenant in a multi-tenant Lambda function.

SELECT examples​

Returns information about the function or function version, with a link to download the deployment package that's valid for 10 minutes. If you specify a function version, only details that are specific to that version are returned.

SELECT
code,
concurrency,
configuration,
tags,
tags_error
FROM aws.lambda.functions
WHERE function_name = '{{ function_name }}' -- required
AND region = '{{ region }}' -- required
AND Qualifier = '{{ Qualifier }}'
;

INSERT examples​

Creates a Lambda function. To create a function, you need a deployment package and an execution role. The deployment package is a .zip file archive or container image that contains your function code. The execution role grants the function permission to use Amazon Web Services services, such as Amazon CloudWatch Logs for log streaming and X-Ray for request tracing. If the deployment package is a container image, then you set the package type to Image. For a container image, the code property must include the URI of a container image in the Amazon ECR registry. You do not need to specify the handler and runtime properties. If the deployment package is a .zip file archive, then you set the package type to Zip. For a .zip file archive, the code property specifies the location of the .zip file. You must also specify the handler and runtime properties. The code in the deployment package must be compatible with the target instruction set architecture of the function (x86-64 or arm64). If you do not specify the architecture, then the default value is x86-64. When you create a function, Lambda provisions an instance of the function and its supporting resources. If your function connects to a VPC, this process can take a minute or so. During this time, you can't invoke or modify the function. The State, StateReason, and StateReasonCode fields in the response from GetFunctionConfiguration indicate when the function is ready to invoke. For more information, see Lambda function states. A function has an unpublished version, and can have published versions and aliases. The unpublished version changes when you update your function's code and configuration. A published version is a snapshot of your function code and configuration that can't be changed. An alias is a named resource that maps to a version, and can be changed to map to a different version. Use the Publish parameter to create version 1 of your function from its initial configuration. The other parameters let you configure version-specific and function-level settings. You can modify version-specific settings later with UpdateFunctionConfiguration. Function-level settings apply to both the unpublished and published versions of the function, and include tags (TagResource) and per-function concurrency limits (PutFunctionConcurrency). You can use code signing if your deployment package is a .zip file archive. To enable code signing for this function, specify the ARN of a code-signing configuration. When a user attempts to deploy a code package with UpdateFunctionCode, Lambda checks that the code package has a valid signature from a trusted publisher. The code-signing configuration includes set of signing profiles, which define the trusted publishers for this function. If another Amazon Web Services account or an Amazon Web Services service invokes your function, use AddPermission to grant permission by creating a resource-based Identity and Access Management (IAM) policy. You can grant permissions at the function level, on a version, or on an alias. To invoke your function directly, use Invoke. To invoke your function in response to events in other Amazon Web Services services, create an event source mapping (CreateEventSourceMapping), or configure a function trigger in the other service. For more information, see Invoking Lambda functions.

INSERT INTO aws.lambda.functions (
FunctionName,
Runtime,
Role,
Handler,
Code,
Description,
Timeout,
MemorySize,
Publish,
PublishTo,
VpcConfig,
PackageType,
DeadLetterConfig,
Environment,
KMSKeyArn,
TracingConfig,
Tags,
Layers,
FileSystemConfigs,
CodeSigningConfigArn,
ImageConfig,
Architectures,
EphemeralStorage,
SnapStart,
LoggingConfig,
TenancyConfig,
CapacityProviderConfig,
DurableConfig,
region
)
SELECT 
'{{ FunctionName }}' /* required */,
'{{ Runtime }}',
'{{ Role }}',
'{{ Handler }}',
'{{ Code }}',
'{{ Description }}',
{{ Timeout }},
{{ MemorySize }},
{{ Publish }},
'{{ PublishTo }}',
'{{ VpcConfig }}',
'{{ PackageType }}',
'{{ DeadLetterConfig }}',
'{{ Environment }}',
'{{ KMSKeyArn }}',
'{{ TracingConfig }}',
'{{ Tags }}',
'{{ Layers }}',
'{{ FileSystemConfigs }}',
'{{ CodeSigningConfigArn }}',
'{{ ImageConfig }}',
'{{ Architectures }}',
'{{ EphemeralStorage }}',
'{{ SnapStart }}',
'{{ LoggingConfig }}',
'{{ TenancyConfig }}',
'{{ CapacityProviderConfig }}',
'{{ DurableConfig }}',
'{{ region }}'
RETURNING
architectures,
capacity_provider_config,
code_sha_256,
code_size,
config_sha_256,
dead_letter_config,
description,
durable_config,
environment,
ephemeral_storage,
file_system_configs,
function_arn,
function_name,
handler,
image_config_response,
kms_key_arn,
last_modified,
last_update_status,
last_update_status_reason,
last_update_status_reason_code,
layers,
logging_config,
master_arn,
memory_size,
package_type,
revision_id,
role,
runtime,
runtime_version_config,
signing_job_arn,
signing_profile_version_arn,
snap_start,
state,
state_reason,
state_reason_code,
tenancy_config,
timeout,
tracing_config,
version,
vpc_config
;

UPDATE examples​

Grants a principal permission to use a function. You can apply the policy at the function level, or specify a qualifier to restrict access to a single version or alias. If you use a qualifier, the invoker must use the full Amazon Resource Name (ARN) of that version or alias to invoke the function. Note: Lambda does not support adding policies to version $LATEST. To grant permission to another account, specify the account ID as the Principal. To grant permission to an organization defined in Organizations, specify the organization ID as the PrincipalOrgID. For Amazon Web Services services, the principal is a domain-style identifier that the service defines, such as s3.amazonaws.com or sns.amazonaws.com. For Amazon Web Services services, you can also specify the ARN of the associated resource as the SourceArn. If you grant permission to a service principal without specifying the source, other accounts could potentially configure resources in their account to invoke your Lambda function. This operation adds a statement to a resource-based permissions policy for the function. For more information about function policies, see Using resource-based policies for Lambda.

UPDATE aws.lambda.functions
SET 
StatementId = '{{ StatementId }}',
Action = '{{ Action }}',
Principal = '{{ Principal }}',
SourceArn = '{{ SourceArn }}',
FunctionUrlAuthType = '{{ FunctionUrlAuthType }}',
InvokedViaFunctionUrl = {{ InvokedViaFunctionUrl }},
SourceAccount = '{{ SourceAccount }}',
EventSourceToken = '{{ EventSourceToken }}',
RevisionId = '{{ RevisionId }}',
PrincipalOrgID = '{{ PrincipalOrgID }}'
WHERE 
function_name = '{{ function_name }}' --required
AND region = '{{ region }}' --required
AND StatementId = '{{ StatementId }}' --required
AND Action = '{{ Action }}' --required
AND Principal = '{{ Principal }}' --required
AND Qualifier = '{{ Qualifier}}'
RETURNING
statement;

DELETE examples​

Deletes a Lambda function. To delete a specific function version, use the Qualifier parameter. Otherwise, all versions and aliases are deleted. This doesn't require the user to have explicit permissions for DeleteAlias. A deleted Lambda function cannot be recovered. Ensure that you specify the correct function name and version before deleting. To delete Lambda event source mappings that invoke a function, use DeleteEventSourceMapping. For Amazon Web Services services and resources that invoke your function directly, delete the trigger in the service where you originally configured it.

DELETE FROM aws.lambda.functions
WHERE function_name = '{{ function_name }}' --required
AND region = '{{ region }}' --required
AND Qualifier = '{{ Qualifier }}'
;

Lifecycle Methods​

Invokes a Lambda function. You can invoke a function synchronously (and wait for the response), or asynchronously. By default, Lambda invokes your function synchronously (i.e. theInvocationType is RequestResponse). To invoke a function asynchronously, set InvocationType to Event. Lambda passes the ClientContext object to your function for synchronous invocations only. For synchronous invocations, the maximum payload size is 6 MB. For asynchronous invocations, the maximum payload size is 1 MB. For synchronous invocation, details about the function response, including errors, are included in the response body and headers. For either invocation type, you can find more information in the execution log and trace. When an error occurs, your function may be invoked multiple times. Retry behavior varies by error type, client, event source, and invocation type. For example, if you invoke a function asynchronously and it returns an error, Lambda executes the function up to two more times. For more information, see Error handling and automatic retries in Lambda. For asynchronous invocation, Lambda adds events to a queue before sending them to your function. If your function does not have enough capacity to keep up with the queue, events may be lost. Occasionally, your function may receive the same event multiple times, even if no error occurs. To retain events that were not processed, configure your function with a dead-letter queue. The status code in the API response doesn't reflect function errors. Error codes are reserved for errors that prevent your function from executing, such as permissions errors, quota errors, or issues with your function's code and configuration. For example, Lambda returns TooManyRequestsException if running the function would cause you to exceed a concurrency limit at either the account level (ConcurrentInvocationLimitExceeded) or function level (ReservedFunctionConcurrentInvocationLimitExceeded). For functions with a long timeout, your client might disconnect during synchronous invocation while it waits for a response. Configure your HTTP client, SDK, firewall, proxy, or operating system to allow for long connections with timeout or keep-alive settings. This operation requires permission for the lambda:InvokeFunction action. For details on how to set up permissions for cross-account invocations, see Granting function access to other accounts.

EXEC aws.lambda.functions.invoke 
@function_name='{{ function_name }}' --required, 
@region='{{ region }}' --required, 
@X-Amz-Invocation-Type='{{ X-Amz-Invocation-Type }}', 
@X-Amz-Log-Type='{{ X-Amz-Log-Type }}', 
@X-Amz-Client-Context='{{ X-Amz-Client-Context }}', 
@X-Amz-Durable-Execution-Name='{{ X-Amz-Durable-Execution-Name }}', 
@Qualifier='{{ Qualifier }}', 
@X-Amz-Tenant-Id='{{ X-Amz-Tenant-Id }}' 
@@json=
'{
"Payload": "{{ Payload }}"
}'
;
Last updated on