AWS Solutions Architect · Lesson

Lambda Functions: Runtimes, Triggers, and Handlers

Write a Lambda function, choose a runtime, configure memory and timeout, and wire it to an S3 event or API Gateway trigger.

Lambda Functions: Runtimes, Triggers, and Handlers is a free AWS Solutions Architect lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AWS Solutions Architect learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is AWS Lambda?

AWS Lambda is a serverless compute service that runs your code in response to events without requiring you to provision or manage servers. You pay only for the compute time consumed—measured in milliseconds—making Lambda extremely cost-efficient for sporadic, event-driven workloads. Lambda automatically scales from zero to thousands of concurrent executions based on incoming events.

Supported Runtimes

Lambda supports managed runtimes including Python, Node.js, Java, Go, Ruby, .NET, and more. AWS maintains these runtimes and applies security patches. For languages or runtime versions not natively supported, you can provide a Custom Runtime via a bootstrap executable, or package your function in a container image (up to 10 GB) rather than a ZIP deployment package.

The Lambda Handler Function

Every Lambda function has a handler—the entry point your code must export. AWS calls the handler with two arguments: the event object (the input data from the trigger) and a context object (metadata about the invocation, like function name, remaining time, and request ID). The handler returns a response that, depending on the invocation type, may be returned to the caller.

# Python handler example
def lambda_handler(event, context):
    # event contains the trigger payload
    bucket = event['Records'][0]['s3']['bucket']['name']
    key = event['Records'][0]['s3']['object']['key']
    print(f'Processing {key} from {bucket}')
    return {
        'statusCode': 200,
        'body': 'Processed successfully'
    }

Memory, Timeout, and Ephemeral Storage

Lambda allows you to configure memory from 128 MB to 10,240 MB. CPU is allocated proportionally to memory—more memory means more CPU. The timeout can be set from 1 second to 15 minutes; if your function exceeds this, Lambda terminates it. You also get /tmp ephemeral storage (512 MB by default, configurable up to 10 GB) for temporary files within a single invocation. This storage does not persist across invocations.

Synchronous vs Asynchronous Invocation

Lambda functions can be invoked synchronously (caller waits for the result—used by API Gateway and ALB) or asynchronously (caller does not wait—used by S3 events and SNS). In asynchronous mode, Lambda retries failed executions up to twice and can route failed events to a Dead Letter Queue (SQS or SNS) or an EventBridge event bus. Choosing the right invocation mode affects error handling design.

Common Lambda Triggers

Lambda integrates natively with dozens of AWS services as event sources (triggers):

API Gateway / ALB: HTTP requests (synchronous)
S3: Object create/delete events (asynchronous)
DynamoDB Streams / Kinesis: Record streaming (poll-based, synchronous)
SQS: Queue messages (poll-based)
SNS: Topic notifications (asynchronous)
EventBridge: Scheduled or custom events
CloudWatch Logs: Log subscription filters

IAM Execution Role

Every Lambda function must have an IAM execution role that grants the function permissions to call other AWS services. For example, if your function reads from S3 and writes to DynamoDB, the execution role needs s3:GetObject and dynamodb:PutItem permissions. Follow least-privilege: grant only the permissions your function actually needs. The basic execution role must also include logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents for CloudWatch Logs.

Deployment Packages and Size Limits

Lambda accepts two deployment formats: a ZIP file (50 MB compressed, 250 MB unzipped) uploaded directly or via S3, and a container image (up to 10 GB) stored in Amazon ECR. ZIP packages are faster to deploy and well-suited for small functions and Lambda Layers. Container images are ideal for large dependency sets or teams that already use Docker-based workflows. Both formats can use the same runtime runtimes and handler pattern.

# Deploy a ZIP package from S3
aws lambda update-function-code \
  --function-name 'MyFunction' \
  --s3-bucket 'my-lambda-packages' \
  --s3-key 'my-function-v2.zip'

Environment Variables and Secrets

Pass configuration to Lambda via environment variables. For sensitive values (API keys, database passwords) store them in AWS Secrets Manager or Parameter Store and retrieve them at function initialisation time (outside the handler) to benefit from execution context reuse. Never hardcode secrets in your function code or environment variables in plaintext—use KMS encryption for Lambda environment variables to protect them at rest.

import boto3
import os

# Fetch secret once during cold start (outside handler)
ssm = boto3.client('ssm')
DB_PASSWORD = ssm.get_parameter(
    Name=os.environ['DB_PASSWORD_PARAM'],
    WithDecryption=True
)['Parameter']['Value']

def lambda_handler(event, context):
    # DB_PASSWORD is already loaded; no SSM call on each invocation
    pass

Cold Starts and Execution Context Reuse

The first invocation of a Lambda function after deployment or after a period of inactivity incurs a cold start: AWS must initialise the runtime environment, download your deployment package, and run the initialisation code. Subsequent invocations within the same execution environment are warm starts and are much faster. Keep global initialisation code (SDK clients, DB connections) outside the handler to reuse the execution context across warm invocations.

Lambda in a VPC

By default Lambda runs in an AWS-managed VPC and can access the internet but not your private VPC resources. To access an RDS database or ElastiCache cluster in a private subnet, configure Lambda to run inside your VPC by specifying subnets and security groups. VPC-enabled Lambda functions use Hyperplane ENIs for networking (no more per-function ENI provisioning), which eliminates the historical cold-start penalty for VPC Lambdas.

aws lambda update-function-configuration \
  --function-name 'MyFunction' \
  --vpc-config 'SubnetIds=subnet-aaa111,subnet-bbb222,SecurityGroupIds=sg-xyz'

Quick Check

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

Lesson Recap

In this lesson you learned: Lambda runtimes support Python, Node.js, Java, Go, and more, with custom runtimes and container images for advanced cases, triggers including API Gateway (synchronous) and S3/SNS (asynchronous) define how events flow into Lambda functions, and the execution role, environment variables, and VPC configuration are key aspects of securely connecting Lambda to other AWS services. Next up we explore Lambda concurrency, throttling, and reserved concurrency.

Frequently asked questions

Is the “Lambda Functions: Runtimes, Triggers, and Handlers” lesson free?

Yes — the full text of “Lambda Functions: Runtimes, Triggers, and Handlers” is free to read here on the web, and the AWS Solutions Architect course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AWS Solutions Architect course, upgrade to CoddyKit PRO.

What will I learn in “Lambda Functions: Runtimes, Triggers, and Handlers”?

Write a Lambda function, choose a runtime, configure memory and timeout, and wire it to an S3 event or API Gateway trigger. You practise AWS Solutions Architect with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start AWS Solutions Architect?

No prior experience is required. AWS Solutions Architect on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Lambda Functions: Runtimes, Triggers, and Handlers” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this AWS Solutions Architect lesson?

Yes. Every AWS Solutions Architect lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Lambda Functions: Runtimes, Triggers, and Handlers
Concurrency, Throttling, and Reserved Concurrency
Lambda Layers and Deployment Packages
Lambda@Edge and Event-Driven Patterns

← Back to AWS Solutions Architect