AWS Lambda: The Serverless Powerhouse

API Gateway routes HTTP/HTTPS requests to Lambda synchronously (RequestResponse). Lambda processes business logic and returns a response. API Gateway handles auth (Cognito, Lambda authorizers), throttling, caching, and SSL. The canonical serverless web API pattern. Watch for the concurrency mismatch: API Gateway throttles at 10,000 req/s but Lambda defaults to 1,000 concurrent executions — use reserved concurrency and request increases proactively.

S3 sends event notifications (PUT, POST, COPY, DELETE) to Lambda asynchronously. Lambda processes files (image resizing, ETL, virus scanning) and writes results to another S3 bucket or database. Use separate source and destination buckets to avoid recursive trigger loops. Lambda retries up to 2 times on failure — use DLQ/Destinations for error capture.

Lambda polls SQS queues via event source mapping. Lambda scales based on queue depth (up to 1,000 concurrent for standard queues, 1 concurrent per shard for FIFO). Messages are deleted from queue only after successful processing. On failure, messages return to queue and eventually go to SQS DLQ. Batch size and batch window are configurable. Use SQS as a buffer between high-throughput event producers and Lambda to prevent throttling.

Lambda processes DynamoDB Streams records via event source mapping. Receives old and new item images. Use for replication, audit logging, cache invalidation, or triggering downstream workflows. Lambda scales to one concurrent execution per shard. Failures block the shard — use bisect-on-error and maximum retry attempts to handle poison pills.

Lambda reads from Kinesis shards via event source mapping. One concurrent execution per shard. Supports enhanced fan-out for lower latency. Use parallelization factor (1–10) to process multiple batches per shard concurrently. Critical for real-time analytics, IoT data processing, and log aggregation pipelines.

SNS delivers messages to Lambda asynchronously. Lambda is invoked once per SNS message. Use SNS→Lambda fan-out to trigger multiple Lambda functions in parallel from a single event. SNS does NOT support event source mapping — it pushes directly. Lambda retries 2 times on failure; configure DLQ on Lambda for unprocessed messages.

EventBridge invokes Lambda on a cron/rate schedule or in response to AWS service events, custom events, or SaaS partner events. Replaces CloudWatch Events (same service, rebranded). Use for automated operations, compliance checks, data pipeline triggers, and cross-account event routing. EventBridge invokes Lambda asynchronously.

Step Functions orchestrates Lambda functions for workflows exceeding 15 minutes, requiring human approval, parallel branches, error handling, or retry logic. Each Lambda handles one discrete task. Avoids the anti-pattern of synchronous nested Lambda calls. Express Workflows suit high-volume, short-duration; Standard Workflows suit long-running, durable workflows (up to 1 year).

Lambda automatically ships logs to CloudWatch Logs. Enable X-Ray active tracing for distributed tracing across services. Use Lambda Insights (CloudWatch) for enhanced metrics (memory usage, init duration, cold starts). Lambda Extensions can integrate third-party APM tools without modifying function code.

Lambda functions connecting directly to RDS can exhaust database connection limits under high concurrency (each execution = new connection). Use RDS Proxy as a connection pooler between Lambda and RDS. RDS Proxy maintains a warm pool of connections, dramatically reducing connection overhead. Requires Lambda in the same VPC as RDS.

Cognito User Pools invoke Lambda synchronously via triggers (pre-signup, post-confirmation, pre-token generation, custom auth). Lambda customizes auth flows, validates data, enriches JWT tokens, or integrates with external identity providers. Lambda must respond within Cognito's timeout window.

Lambda invokes SageMaker endpoints for real-time ML inference as part of API or event-driven workflows. Lambda handles pre/post-processing; SageMaker handles the model. For lightweight models, Lambda can host inference directly using container images (up to 10 GB). Lambda is NOT suitable for training — use SageMaker Training Jobs.

Lambda invokes Bedrock Foundation Models (Claude, Titan, Llama, etc.) via the Bedrock Runtime API for text generation, summarization, and RAG patterns. Lambda handles prompt construction, Bedrock invocation, and response processing. Combine with Knowledge Bases for RAG and Agents for multi-step AI workflows. Watch for timeout limits with large model responses.

Every Lambda function needs an IAM execution role (what the function can DO — e.g., read S3, write DynamoDB). Resource-based policies control who can INVOKE the function (push model — e.g., allow S3 to invoke). These are two separate IAM constructs. Exam questions frequently test whether you modify the execution role vs. the resource policy.

Mount Amazon EFS access points to Lambda for shared, persistent storage accessible across concurrent executions and other compute services. Use for ML model files, shared datasets, or stateful processing. Requires Lambda in VPC. EFS is the ONLY way to share data between concurrent Lambda executions in real time.