Lambda

AWS Lambda serverless compute for running code without provisioning or managing servers.

Protocol: RestJson1Signing name: lambdaPersistent: Yes (function configuration via lambda.json; function zip bytes under {data_dir}/lambda/) when --data-dir is set; in-memory only otherwise

Quick Start

Package a function, create it, and invoke it:

# 1. Create a minimal Node.js handler file
cat > index.js << 'EOF'
exports.handler = async (event) => {
  console.log('Event:', JSON.stringify(event));
  return { statusCode: 200, body: JSON.stringify({ message: 'Hello!', input: event }) };
};
EOF

# 2. Package it
zip function.zip index.js

# 3. Create the function
aws --endpoint-url http://localhost:4566 lambda create-function \
  --function-name hello-world \
  --runtime nodejs20.x \
  --handler index.handler \
  --role arn:aws:iam::000000000000:role/any-role \
  --zip-file fileb://function.zip

# 4. Invoke it
aws --endpoint-url http://localhost:4566 lambda invoke \
  --function-name hello-world \
  --payload '{"name":"Alice"}' \
  response.json && cat response.json

Operations

Functions

Operation	Description
CreateFunction	Create a function from a ZIP file or S3 object. Input: FunctionName, Runtime, Handler (e.g., index.handler), Role (IAM ARN), Code ({ZipFile} or {S3Bucket, S3Key}), Environment ({Variables: {KEY: VALUE}}), Timeout (seconds, default 3), MemorySize (MB)
GetFunction	Get function metadata and code location. Returns Configuration and Code.Location
GetFunctionConfiguration	Get just the configuration (runtime, handler, env vars, etc.)
UpdateFunctionCode	Update the deployment package. Input: FunctionName, ZipFile or S3Bucket/S3Key
UpdateFunctionConfiguration	Update runtime, handler, env vars, timeout, memory. Input: FunctionName plus fields to update
DeleteFunction	Delete a function. Input: FunctionName, optional Qualifier (version or alias)
ListFunctions	List all functions. Returns paginated Functions list

Invocation

Operation	Description
Invoke	Invoke a function synchronously. Input: FunctionName, Payload (JSON body), InvocationType (RequestResponse, Event, DryRun). Returns: StatusCode, Payload (function response), FunctionError (if function threw), LogResult (base64 tail of logs if LogType=Tail)

Versions and Aliases

Operation	Description
PublishVersion	Publish the current $LATEST code as a numbered version. Returns: Version (number string)
ListVersionsByFunction	List all published versions. Returns: Versions list
CreateAlias	Create an alias (e.g., prod) pointing to a version. Input: FunctionName, Name, FunctionVersion
GetAlias	Get alias configuration
DeleteAlias	Delete an alias
ListAliases	List all aliases for a function

Event Source Mappings

Operation	Description
CreateEventSourceMapping	Map SQS, Kinesis, or DynamoDB Streams as a trigger. Honored fields: FunctionName, EventSourceArn, BatchSize, Enabled, StartingPosition (TRIM_HORIZON / LATEST / AT_TIMESTAMP), StartingPositionTimestamp, MaximumBatchingWindowInSeconds, FilterCriteria, DestinationConfig.OnFailure.Destination, MaximumRetryAttempts, ParallelizationFactor, BisectBatchOnFunctionError
GetEventSourceMapping	Get mapping configuration including LastProcessingResult
DeleteEventSourceMapping	Remove a trigger
ListEventSourceMappings	List all mappings, optionally filtered by EventSourceArn / FunctionName
UpdateEventSourceMapping	Patch any creation field; LastModified is bumped

Poller behavior

Background pollers (one for SQS, one for Kinesis) iterate every (account, region) pair every 2–5 seconds and drive every enabled mapping in that scope. DynamoDB streams are push-based — write events on the source table immediately fan out to matching mappings.

• FilterCriteria is evaluated against each record using EventBridge content-pattern syntax: equality arrays, prefix, suffix, exists, anything-but, numeric ranges. SQS records that fail the filter are deleted from the queue (matching real Lambda behavior).
• Kinesis uses the NextShardIterator returned by GetRecords and persists it on the mapping, so records aren't re-delivered every tick.
• DestinationConfig.OnFailure is honored for SQS and SNS ARNs — failed Lambda invocations route the offending batch to that destination. Source messages stay in their queue / shard so the next tick retries them.
• LastProcessingResult is updated to OK or PROBLEM: <message> after each cycle and surfaced via Get / List.

Layers

Operation	Description
PublishLayerVersion	Publish a layer version. Input: LayerName, Content ({ZipFile}), CompatibleRuntimes
GetLayerVersion	Get layer version metadata
ListLayers	List layers
ListLayerVersions	List versions of a layer

Function URL Configs

Operation	Description
CreateFunctionUrlConfig	Create a function URL for a function. Input: FunctionName, AuthType (NONE or AWS_IAM), optional Cors. Returns FunctionUrl, FunctionArn, AuthType
GetFunctionUrlConfig	Get the URL configuration for a function. Returns FunctionUrl, FunctionArn, AuthType, Cors
DeleteFunctionUrlConfig	Remove the URL config from a function
ListFunctionUrlConfigs	List URL configs for a function (zero or one entry)

Tags

Operation	Description
TagResource	Add or update tags on a function. Input: Resource (function ARN or name), Tags (object)
UntagResource	Remove tags from a function. Input: Resource, TagKeys (list)
ListTags	List tags on a function. Input: Resource. Returns Tags object

Resource Policy / Permissions

Operation	Description
GetPolicy	Return the function's resource-based policy as a JSON string. Returns 404 if no permissions have been added
AddPermission	Grant a principal (e.g., S3, SNS, EventBridge) permission to invoke the function. Input: FunctionName, StatementId, Action, Principal, optional SourceArn, SourceAccount
RemovePermission	Remove a policy statement from the function. Input: FunctionName, StatementId

Account Settings

Operation	Description
GetAccountSettings	Return account-level Lambda limits (total code size, concurrency limits, function count). Useful for SDK health checks

Concurrency

Operation	Description
PutFunctionConcurrency	Reserve concurrent executions for a function. Input: FunctionName, ReservedConcurrentExecutions. Rejects values above the 1000 account-pool cap
GetFunctionConcurrency	Return the function's reserved concurrency (omitted from the response when unreserved)
DeleteFunctionConcurrency	Release the reserved concurrency back to the unreserved pool
PutProvisionedConcurrencyConfig	Allocate provisioned (warm-pool) concurrency for a published version or alias. Input: FunctionName, Qualifier, ProvisionedConcurrentExecutions. Rejects $LATEST per real Lambda
GetProvisionedConcurrencyConfig	Describe a provisioned-concurrency config (returns ProvisionedConcurrencyConfigNotFoundException when none exists)
DeleteProvisionedConcurrencyConfig	Remove a provisioned-concurrency config
ListProvisionedConcurrencyConfigs	List all provisioned-concurrency configs on a function

Curl Examples

# 1. Create a function using base64-encoded ZIP
ZIP_B64=$(base64 -w 0 function.zip)
curl -s -X POST http://localhost:4566/2015-03-31/functions \
  -H "Content-Type: application/json" \
  -H "Authorization: AWS4-HMAC-SHA256 Credential=test/20260421/us-east-1/lambda/aws4_request, SignedHeaders=host, Signature=fake" \
  -d "{\"FunctionName\":\"my-fn\",\"Runtime\":\"nodejs20.x\",\"Handler\":\"index.handler\",\"Role\":\"arn:aws:iam::000000000000:role/any\",\"Code\":{\"ZipFile\":\"$ZIP_B64\"}}"

# 2. Invoke a function
curl -s -X POST http://localhost:4566/2015-03-31/functions/my-fn/invocations \
  -H "Content-Type: application/json" \
  -H "Authorization: AWS4-HMAC-SHA256 Credential=test/20260421/us-east-1/lambda/aws4_request, SignedHeaders=host, Signature=fake" \
  -d '{"key":"value","nested":{"items":[1,2,3]}}'

# 3. List all functions
curl -s http://localhost:4566/2015-03-31/functions \
  -H "Authorization: AWS4-HMAC-SHA256 Credential=test/20260421/us-east-1/lambda/aws4_request, SignedHeaders=host, Signature=fake"

SDK Example

import { LambdaClient, CreateFunctionCommand, InvokeCommand, UpdateFunctionCodeCommand } from '@aws-sdk/client-lambda';
import { readFileSync } from 'fs';

const lambda = new LambdaClient({
  region: 'us-east-1',
  endpoint: 'http://localhost:4566',
  credentials: { accessKeyId: 'test', secretAccessKey: 'test' },
});

// Create function from ZIP
const zipBytes = readFileSync('function.zip');
await lambda.send(new CreateFunctionCommand({
  FunctionName: 'my-function',
  Runtime: 'nodejs20.x',
  Handler: 'index.handler',
  Role: 'arn:aws:iam::000000000000:role/lambda-role',
  Code: { ZipFile: zipBytes },
  Environment: {
    Variables: {
      TABLE_NAME: 'my-table',
      STAGE: 'staging',
    },
  },
  Timeout: 30,
  MemorySize: 256,
}));

// Invoke
const { Payload, StatusCode, FunctionError } = await lambda.send(new InvokeCommand({
  FunctionName: 'my-function',
  Payload: JSON.stringify({ userId: '123', action: 'getProfile' }),
  LogType: 'Tail',
}));

if (FunctionError) {
  console.error('Function error:', FunctionError);
}

const result = JSON.parse(Buffer.from(Payload!).toString());
console.log('Status:', StatusCode); // 200
console.log('Result:', result);

// Update code after changes
const newZip = readFileSync('function-v2.zip');
await lambda.send(new UpdateFunctionCodeCommand({
  FunctionName: 'my-function',
  ZipFile: newZip,
}));

Supported Runtimes

• nodejs* — any string starting with nodejs, e.g. nodejs18.x, nodejs20.x, nodejs22.x
• python* — any string starting with python, e.g. python3.11, python3.12, python3.13

See Lambda Execution for full runtime details and limitations.

Behavior Notes

• Lambda actually executes Node.js and Python code as local processes on the AWSim host machine.
• Functions share the host filesystem and network — no container/sandbox isolation. A function can read /etc/passwd or make outbound network calls.
• Invoke always behaves synchronously even if InvocationType: "Event" is specified.
• Function output (stdout/stderr) is captured and written to CloudWatch Logs at /aws/lambda/{function-name}.
• Layers are stored as metadata but their contents are not merged into the function's execution environment.
• Function configuration and zip bytes persist across restarts when --data-dir is set: configuration lives in {data_dir}/snapshots/lambda.json and zip bytes live at {data_dir}/lambda/{function}/$LATEST (plus {data_dir}/lambda/{function}/{version} for each published version). See Persistence for details.
• Environment variables are injected as real OS environment variables during execution.
• SQS event source mappings are actively polled every 2 seconds — messages received on the queue trigger the Lambda function automatically.
• Reserved concurrency (PutFunctionConcurrency) is stored and round-tripped but the emulator does not actually throttle invocations against the configured ceiling.
• Provisioned concurrency configs flip from IN_PROGRESS to READY immediately because there's no real warm pool to provision. Allocated and Available always equal Requested.
• Invoke returns the function's payload as the response body and surfaces FunctionError in the X-Amz-Function-Error header (the channel SDKs read), matching real Lambda. The body field is also kept for the in-process admin / inspector path.