Package com.pulumi.aws.lambda

Class Function

  • public class Function
extends com.pulumi.resources.CustomResource
    Manages an AWS Lambda Function. Use this resource to create serverless functions that run code in response to events without provisioning or managing servers. For information about Lambda and how to use it, see [What is AWS Lambda?](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html). For a detailed example of setting up Lambda and API Gateway, see Serverless Applications with AWS Lambda and API Gateway. > **Note:** Due to [AWS Lambda improved VPC networking changes that began deploying in September 2019](https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/), EC2 subnets and security groups associated with Lambda Functions can take up to 45 minutes to successfully delete. Pulumi AWS Provider version 2.31.0 and later automatically handles this increased timeout, however prior versions require setting the customizable deletion timeouts of those Pulumi resources to 45 minutes (`delete = "45m"`). AWS and HashiCorp are working together to reduce the amount of time required for resource deletion and updates can be tracked in this GitHub issue. > **Note:** If you get a `KMSAccessDeniedException: Lambda was unable to decrypt the environment variables because KMS access was denied` error when invoking an `aws.lambda.Function` with environment variables, the IAM role associated with the function may have been deleted and recreated after the function was created. You can fix the problem two ways: 1) updating the function's role to another role and then updating it back again to the recreated role. (When you create a function, Lambda grants permissions on the KMS key to the function's IAM role. If the IAM role is recreated, the grant is no longer valid. Changing the function's role or recreating the function causes Lambda to update the grant.) > **Tip:** To give an external source (like an EventBridge Rule, SNS, or S3) permission to access the Lambda function, use the `aws.lambda.Permission` resource. See [Lambda Permission Model](https://docs.aws.amazon.com/lambda/latest/dg/intro-permission-model.html) for more details. On the other hand, the `role` argument of this resource is the function's execution role for identity and access to AWS services and resources. ## Example Usage ### Container Image Function 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionImageConfigArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Function("example", FunctionArgs.builder()
             .imageConfig(FunctionImageConfigArgs.builder()
                 .entryPoints("/lambda-entrypoint.sh")
                 .commands("app.handler")
                 .build())
             .name("example_container_function")
             .role(exampleAwsIamRole.arn())
             .packageType("Image")
             .imageUri(String.format("%s:latest", exampleAwsEcrRepository.repositoryUrl()))
             .memorySize(512)
             .timeout(30)
             .architectures("arm64")
             .build());
 
     }
 }
    ### Function with Lambda Layers > **Note:** The `aws.lambda.LayerVersion` attribute values for `arn` and `layerArn` were swapped in version 2.0.0 of the Pulumi AWS Provider. For version 2.x, use `arn` references. 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.LayerVersion;
 import com.pulumi.aws.lambda.LayerVersionArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionTracingConfigArgs;
 import com.pulumi.asset.FileArchive;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         // Common dependencies layer
         var example = new LayerVersion("example", LayerVersionArgs.builder()
             .code(new FileArchive("layer.zip"))
             .layerName("example_dependencies_layer")
             .description("Common dependencies for Lambda functions")
             .compatibleRuntimes(            
                 "nodejs24.x",
                 "python3.12")
             .compatibleArchitectures(            
                 "x86_64",
                 "arm64")
             .build());
 
         // Function using the layer
         var exampleFunction = new Function("exampleFunction", FunctionArgs.builder()
             .tracingConfig(FunctionTracingConfigArgs.builder()
                 .mode("Active")
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_layered_function")
             .role(exampleAwsIamRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .layers(example.arn())
             .build());
 
     }
 }
    ### VPC Function with Enhanced Networking 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionVpcConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionEphemeralStorageArgs;
 import com.pulumi.aws.lambda.inputs.FunctionSnapStartArgs;
 import com.pulumi.asset.FileArchive;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Function("example", FunctionArgs.builder()
             .vpcConfig(FunctionVpcConfigArgs.builder()
                 .subnetIds(                
                     examplePrivate1.id(),
                     examplePrivate2.id())
                 .securityGroupIds(exampleLambda.id())
                 .ipv6AllowedForDualStack(true)
                 .build())
             .ephemeralStorage(FunctionEphemeralStorageArgs.builder()
                 .size(5120)
                 .build())
             .snapStart(FunctionSnapStartArgs.builder()
                 .applyOn("PublishedVersions")
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_vpc_function")
             .role(exampleAwsIamRole.arn())
             .handler("app.handler")
             .runtime("python3.12")
             .memorySize(1024)
             .timeout(30)
             .build());
 
     }
 }
    ### Function with EFS Integration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.efs.FileSystem;
 import com.pulumi.aws.efs.FileSystemArgs;
 import com.pulumi.aws.efs.MountTarget;
 import com.pulumi.aws.efs.MountTargetArgs;
 import com.pulumi.aws.efs.AccessPoint;
 import com.pulumi.aws.efs.AccessPointArgs;
 import com.pulumi.aws.efs.inputs.AccessPointRootDirectoryArgs;
 import com.pulumi.aws.efs.inputs.AccessPointRootDirectoryCreationInfoArgs;
 import com.pulumi.aws.efs.inputs.AccessPointPosixUserArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionVpcConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionFileSystemConfigArgs;
 import com.pulumi.asset.FileArchive;
 import com.pulumi.codegen.internal.KeyedValue;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var config = ctx.config();
         // EFS file system for Lambda
         var example = new FileSystem("example", FileSystemArgs.builder()
             .encrypted(true)
             .tags(Map.of("Name", "lambda-efs"))
             .build());
 
         final var subnetIds = config.get("subnetIds").orElse(        
             "subnet-12345678",
             "subnet-87654321");
         // Mount target in each subnet
         for (var i = 0; i < subnetIds.size(); i++) {
             new MountTarget("exampleMountTarget-" + i, MountTargetArgs.builder()
                 .fileSystemId(example.id())
                 .subnetId(subnetIds[range.value()])
                 .securityGroups(efs.id())
                 .build());
 
         
 }
         // Access point for Lambda
         var exampleAccessPoint = new AccessPoint("exampleAccessPoint", AccessPointArgs.builder()
             .rootDirectory(AccessPointRootDirectoryArgs.builder()
                 .creationInfo(AccessPointRootDirectoryCreationInfoArgs.builder()
                     .ownerGid(1000)
                     .ownerUid(1000)
                     .permissions("755")
                     .build())
                 .path("/lambda")
                 .build())
             .posixUser(AccessPointPosixUserArgs.builder()
                 .gid(1000)
                 .uid(1000)
                 .build())
             .fileSystemId(example.id())
             .build());
 
         // Lambda function with EFS
         var exampleFunction = new Function("exampleFunction", FunctionArgs.builder()
             .vpcConfig(FunctionVpcConfigArgs.builder()
                 .subnetIds(subnetIds)
                 .securityGroupIds(lambda.id())
                 .build())
             .fileSystemConfig(FunctionFileSystemConfigArgs.builder()
                 .arn(exampleAccessPoint.arn())
                 .localMountPath("/mnt/data")
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_efs_function")
             .role(exampleAwsIamRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .build(), CustomResourceOptions.builder()
                 .dependsOn(exampleMountTarget)
                 .build());
 
     }
 }
    ### Function with S3 Files File System 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.AwsFunctions;
 import com.pulumi.aws.inputs.GetCallerIdentityArgs;
 import com.pulumi.aws.inputs.GetRegionArgs;
 import com.pulumi.aws.s3.Bucket;
 import com.pulumi.aws.s3.BucketArgs;
 import com.pulumi.aws.s3.BucketVersioning;
 import com.pulumi.aws.s3.BucketVersioningArgs;
 import com.pulumi.aws.s3.inputs.BucketVersioningVersioningConfigurationArgs;
 import com.pulumi.aws.s3.FilesFileSystem;
 import com.pulumi.aws.s3.FilesFileSystemArgs;
 import com.pulumi.aws.s3.FilesAccessPoint;
 import com.pulumi.aws.s3.FilesAccessPointArgs;
 import com.pulumi.aws.s3.inputs.FilesAccessPointPosixUserArgs;
 import com.pulumi.aws.s3.inputs.FilesAccessPointRootDirectoryArgs;
 import com.pulumi.aws.s3.inputs.FilesAccessPointRootDirectoryCreationPermissionArgs;
 import com.pulumi.aws.ec2.SecurityGroup;
 import com.pulumi.aws.ec2.SecurityGroupArgs;
 import com.pulumi.aws.vpc.SecurityGroupIngressRule;
 import com.pulumi.aws.vpc.SecurityGroupIngressRuleArgs;
 import com.pulumi.aws.vpc.SecurityGroupEgressRule;
 import com.pulumi.aws.vpc.SecurityGroupEgressRuleArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionVpcConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionFileSystemConfigArgs;
 import com.pulumi.asset.FileArchive;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
             .build());
 
         final var currentGetRegion = AwsFunctions.getRegion(GetRegionArgs.builder()
             .build());
 
         var lambdaFileSystem = new Bucket("lambdaFileSystem", BucketArgs.builder()
             .bucket(String.format("example-%s-%s-an", current.accountId(),currentGetRegion.name()))
             .bucketNamespace("account-regional")
             .build());
 
         var lambdaFileSystemBucketVersioning = new BucketVersioning("lambdaFileSystemBucketVersioning", BucketVersioningArgs.builder()
             .versioningConfiguration(BucketVersioningVersioningConfigurationArgs.builder()
                 .status("Enabled")
                 .build())
             .bucket(lambdaFileSystem.bucket())
             .build());
 
         var forLambda = new FilesFileSystem("forLambda", FilesFileSystemArgs.builder()
             .bucket(lambdaFileSystem.arn())
             .roleArn(s3files.arn())
             .build(), CustomResourceOptions.builder()
                 .dependsOn(lambdaFileSystemBucketVersioning)
                 .build());
 
         var forLambdaFilesAccessPoint = new FilesAccessPoint("forLambdaFilesAccessPoint", FilesAccessPointArgs.builder()
             .posixUsers(FilesAccessPointPosixUserArgs.builder()
                 .gid(1000)
                 .uid(1000)
                 .build())
             .rootDirectories(FilesAccessPointRootDirectoryArgs.builder()
                 .creationPermissions(FilesAccessPointRootDirectoryCreationPermissionArgs.builder()
                     .ownerGid(1000)
                     .ownerUid(1000)
                     .permissions("755")
                     .build())
                 .path("/lambda")
                 .build())
             .fileSystemId(forLambda.id())
             .build());
 
         var s3filesMountTargets = new SecurityGroup("s3filesMountTargets", SecurityGroupArgs.builder()
             .name("example-s3files-mount-targets-sg")
             .vpcId(vpcForLambda.id())
             .build());
 
         var lambdaS3files = new SecurityGroup("lambdaS3files", SecurityGroupArgs.builder()
             .name("example-lambda-s3files-sg")
             .vpcId(vpcForLambda.id())
             .build());
 
         var s3filesMountTargetsNfs = new SecurityGroupIngressRule("s3filesMountTargetsNfs", SecurityGroupIngressRuleArgs.builder()
             .ipProtocol("tcp")
             .fromPort(2049)
             .toPort(2049)
             .referencedSecurityGroupId(lambdaS3files.id())
             .securityGroupId(s3filesMountTargets.id())
             .build());
 
         var lambdaS3filesNfs = new SecurityGroupEgressRule("lambdaS3filesNfs", SecurityGroupEgressRuleArgs.builder()
             .ipProtocol("tcp")
             .securityGroupId(lambdaS3files.id())
             .fromPort(2049)
             .toPort(2049)
             .referencedSecurityGroupId(s3filesMountTargets.id())
             .build());
 
         var example = new Function("example", FunctionArgs.builder()
             .vpcConfig(FunctionVpcConfigArgs.builder()
                 .subnetIds(subnetForLambdaAz1.id())
                 .securityGroupIds(lambdaS3files.id())
                 .build())
             .fileSystemConfig(FunctionFileSystemConfigArgs.builder()
                 .arn(forLambdaFilesAccessPoint.arn())
                 .localMountPath("/mnt/s3files")
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_s3files_function")
             .role(iamForLambda.arn())
             .handler("exports.example")
             .runtime("nodejs24.x")
             .build(), CustomResourceOptions.builder()
                 .dependsOn(forLambdaAwsS3filesMountTarget)
                 .build());
 
     }
 }
    ### Function with Advanced Logging 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cloudwatch.LogGroup;
 import com.pulumi.aws.cloudwatch.LogGroupArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionLoggingConfigArgs;
 import com.pulumi.asset.FileArchive;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new LogGroup("example", LogGroupArgs.builder()
             .name("/aws/lambda/example_function")
             .retentionInDays(14)
             .tags(Map.ofEntries(
                 Map.entry("Environment", "production"),
                 Map.entry("Application", "example")
             ))
             .build());
 
         var exampleFunction = new Function("exampleFunction", FunctionArgs.builder()
             .loggingConfig(FunctionLoggingConfigArgs.builder()
                 .logFormat("JSON")
                 .applicationLogLevel("INFO")
                 .systemLogLevel("WARN")
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_function")
             .role(exampleAwsIamRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .build(), CustomResourceOptions.builder()
                 .dependsOn(example)
                 .build());
 
     }
 }
    ### Function with logging to S3 or Data Firehose #### Required Resources * An S3 bucket or Data Firehose delivery stream to store the logs. * A CloudWatch Log Group with: * `logGroupClass = "DELIVERY"` * A subscription filter whose `destinationArn` points to the S3 bucket or the Data Firehose delivery stream. * IAM roles: * Assumed by the `logs.amazonaws.com` service to deliver logs to the S3 bucket or Data Firehose delivery stream. * Assumed by the `lambda.amazonaws.com` service to send logs to CloudWatch Logs * A Lambda function: * In the `loggingConfiguration`, specify the name of the Log Group created above using the `logGroup` field * No special configuration is required to use S3 or Firehose as the log destination For more details, see [Sending Lambda function logs to Amazon S3](https://docs.aws.amazon.com/lambda/latest/dg/logging-with-s3.html). ### Example: Exporting Lambda Logs to S3 Bucket 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.s3.Bucket;
 import com.pulumi.aws.s3.BucketArgs;
 import com.pulumi.aws.cloudwatch.LogGroup;
 import com.pulumi.aws.cloudwatch.LogGroupArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.iam.RolePolicy;
 import com.pulumi.aws.iam.RolePolicyArgs;
 import com.pulumi.aws.cloudwatch.LogSubscriptionFilter;
 import com.pulumi.aws.cloudwatch.LogSubscriptionFilterArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionLoggingConfigArgs;
 import com.pulumi.asset.FileArchive;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var lambdaFunctionName = "lambda-log-export-example";
 
         var lambdaLogExportBucket = new Bucket("lambdaLogExportBucket", BucketArgs.builder()
             .bucket(String.format("%s-bucket", lambdaFunctionName))
             .build());
 
         var export = new LogGroup("export", LogGroupArgs.builder()
             .name(String.format("/aws/lambda/%s", lambdaFunctionName))
             .logGroupClass("DELIVERY")
             .build());
 
         final var logsAssumeRole = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("logs.amazonaws.com")
                     .build())
                 .actions("sts:AssumeRole")
                 .effect("Allow")
                 .build())
             .build());
 
         var logsLogExport = new Role("logsLogExport", RoleArgs.builder()
             .name(String.format("%s-lambda-log-export-role", lambdaFunctionName))
             .assumeRolePolicy(logsAssumeRole.json())
             .build());
 
         final var lambdaLogExport = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .actions("s3:PutObject")
                 .effect("Allow")
                 .resources(lambdaLogExportBucket.arn().applyValue(_arn -> String.format("%s/*", _arn)))
                 .build())
             .build());
 
         var lambdaLogExportRolePolicy = new RolePolicy("lambdaLogExportRolePolicy", RolePolicyArgs.builder()
             .policy(lambdaLogExport.applyValue(_lambdaLogExport -> _lambdaLogExport.json()))
             .role(logsLogExport.name())
             .build());
 
         var lambdaLogExportLogSubscriptionFilter = new LogSubscriptionFilter("lambdaLogExportLogSubscriptionFilter", LogSubscriptionFilterArgs.builder()
             .name(String.format("%s-filter", lambdaFunctionName))
             .logGroup(export.name())
             .filterPattern("")
             .destinationArn(lambdaLogExportBucket.arn())
             .roleArn(logsLogExport.arn())
             .build());
 
         var logExport = new Function("logExport", FunctionArgs.builder()
             .loggingConfig(FunctionLoggingConfigArgs.builder()
                 .logFormat("Text")
                 .logGroup(export.name())
                 .build())
             .name(lambdaFunctionName)
             .handler("index.lambda_handler")
             .runtime("python3.13")
             .role(example.arn())
             .code(new FileArchive("function.zip"))
             .build(), CustomResourceOptions.builder()
                 .dependsOn(export)
                 .build());
 
     }
 }
    ### Function with Error Handling 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionDeadLetterConfigArgs;
 import com.pulumi.aws.lambda.FunctionEventInvokeConfig;
 import com.pulumi.aws.lambda.FunctionEventInvokeConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionEventInvokeConfigDestinationConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionEventInvokeConfigDestinationConfigOnFailureArgs;
 import com.pulumi.aws.lambda.inputs.FunctionEventInvokeConfigDestinationConfigOnSuccessArgs;
 import com.pulumi.asset.FileArchive;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         // Main Lambda function
         var example = new Function("example", FunctionArgs.builder()
             .deadLetterConfig(FunctionDeadLetterConfigArgs.builder()
                 .targetArn(dlq.arn())
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_function")
             .role(exampleAwsIamRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .build());
 
         // Event invoke configuration for retries
         var exampleFunctionEventInvokeConfig = new FunctionEventInvokeConfig("exampleFunctionEventInvokeConfig", FunctionEventInvokeConfigArgs.builder()
             .destinationConfig(FunctionEventInvokeConfigDestinationConfigArgs.builder()
                 .onFailure(FunctionEventInvokeConfigDestinationConfigOnFailureArgs.builder()
                     .destination(dlq.arn())
                     .build())
                 .onSuccess(FunctionEventInvokeConfigDestinationConfigOnSuccessArgs.builder()
                     .destination(success.arn())
                     .build())
                 .build())
             .functionName(example.name())
             .maximumEventAgeInSeconds(60)
             .maximumRetryAttempts(2)
             .build());
 
     }
 }
    ### CloudWatch Logging and Permissions 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.cloudwatch.LogGroup;
 import com.pulumi.aws.cloudwatch.LogGroupArgs;
 import com.pulumi.aws.iam.Role;
 import com.pulumi.aws.iam.RoleArgs;
 import com.pulumi.aws.iam.Policy;
 import com.pulumi.aws.iam.PolicyArgs;
 import com.pulumi.aws.iam.RolePolicyAttachment;
 import com.pulumi.aws.iam.RolePolicyAttachmentArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionLoggingConfigArgs;
 import com.pulumi.asset.FileArchive;
 import static com.pulumi.codegen.internal.Serialization.*;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         final var config = ctx.config();
         final var functionName = config.get("functionName").orElse("example_function");
         // CloudWatch Log Group with retention
         var example = new LogGroup("example", LogGroupArgs.builder()
             .name(String.format("/aws/lambda/%s", functionName))
             .retentionInDays(14)
             .tags(Map.ofEntries(
                 Map.entry("Environment", "production"),
                 Map.entry("Function", functionName)
             ))
             .build());
 
         // Lambda execution role
         var exampleRole = new Role("exampleRole", RoleArgs.builder()
             .name("lambda_execution_role")
             .assumeRolePolicy(serializeJson(
                 jsonObject(
                     jsonProperty("Version", "2012-10-17"),
                     jsonProperty("Statement", jsonArray(jsonObject(
                         jsonProperty("Action", "sts:AssumeRole"),
                         jsonProperty("Effect", "Allow"),
                         jsonProperty("Principal", jsonObject(
                             jsonProperty("Service", "lambda.amazonaws.com")
                         ))
                     )))
                 )))
             .build());
 
         // CloudWatch Logs policy
         var lambdaLogging = new Policy("lambdaLogging", PolicyArgs.builder()
             .name("lambda_logging")
             .path("/")
             .description("IAM policy for logging from Lambda")
             .policy(serializeJson(
                 jsonObject(
                     jsonProperty("Version", "2012-10-17"),
                     jsonProperty("Statement", jsonArray(jsonObject(
                         jsonProperty("Effect", "Allow"),
                         jsonProperty("Action", jsonArray(
                             "logs:CreateLogGroup", 
                             "logs:CreateLogStream", 
                             "logs:PutLogEvents"
                         )),
                         jsonProperty("Resource", jsonArray("arn:aws:logs:*:*:*"))
                     )))
                 )))
             .build());
 
         // Attach logging policy to Lambda role
         var lambdaLogs = new RolePolicyAttachment("lambdaLogs", RolePolicyAttachmentArgs.builder()
             .role(exampleRole.name())
             .policyArn(lambdaLogging.arn())
             .build());
 
         // Lambda function with logging
         var exampleFunction = new Function("exampleFunction", FunctionArgs.builder()
             .loggingConfig(FunctionLoggingConfigArgs.builder()
                 .logFormat("JSON")
                 .applicationLogLevel("INFO")
                 .systemLogLevel("WARN")
                 .build())
             .code(new FileArchive("function.zip"))
             .name(functionName)
             .role(exampleRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .build(), CustomResourceOptions.builder()
                 .dependsOn(                
                     lambdaLogs,
                     example)
                 .build());
 
     }
 }
    ### Function with Durable Configuration Stopping durable executions and deleting the Lambda function may take up to `60m`. Use configured `timeouts` as shown below. 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionDurableConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionEnvironmentArgs;
 import com.pulumi.asset.FileArchive;
 import com.pulumi.resources.CustomResourceOptions;
 import com.pulumi.resources.CustomTimeouts;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new Function("example", FunctionArgs.builder()
             .durableConfig(FunctionDurableConfigArgs.builder()
                 .executionTimeout(3600)
                 .retentionPeriod(7)
                 .build())
             .environment(FunctionEnvironmentArgs.builder()
                 .variables(Map.of("DURABLE_MODE", "enabled"))
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example_durable_function")
             .role(exampleAwsIamRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .memorySize(512)
             .timeout(30)
             .tags(Map.ofEntries(
                 Map.entry("Environment", "production"),
                 Map.entry("Type", "durable")
             ))
             .build(), CustomResourceOptions.builder()
                 .customTimeouts(CustomTimeouts.builder()
                     .delete(CustomTimeouts.parseTimeoutString("60m"))
                 .build())
                 .build());
 
     }
 }
    ### Capacity Provider Configuration 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.lambda.CapacityProvider;
 import com.pulumi.aws.lambda.CapacityProviderArgs;
 import com.pulumi.aws.lambda.inputs.CapacityProviderVpcConfigArgs;
 import com.pulumi.aws.lambda.inputs.CapacityProviderPermissionsConfigArgs;
 import com.pulumi.aws.lambda.Function;
 import com.pulumi.aws.lambda.FunctionArgs;
 import com.pulumi.aws.lambda.inputs.FunctionCapacityProviderConfigArgs;
 import com.pulumi.aws.lambda.inputs.FunctionCapacityProviderConfigLambdaManagedInstancesCapacityProviderConfigArgs;
 import com.pulumi.asset.FileArchive;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleCapacityProvider = new CapacityProvider("exampleCapacityProvider", CapacityProviderArgs.builder()
             .vpcConfig(CapacityProviderVpcConfigArgs.builder()
                 .subnetIds(exampleAwsSubnet.id())
                 .securityGroupIds(exampleAwsSecurityGroup.id())
                 .build())
             .permissionsConfig(CapacityProviderPermissionsConfigArgs.builder()
                 .capacityProviderOperatorRoleArn(exampleAwsIamRole.arn())
                 .build())
             .name("example")
             .build());
 
         var example = new Function("example", FunctionArgs.builder()
             .capacityProviderConfig(FunctionCapacityProviderConfigArgs.builder()
                 .lambdaManagedInstancesCapacityProviderConfig(FunctionCapacityProviderConfigLambdaManagedInstancesCapacityProviderConfigArgs.builder()
                     .capacityProviderArn(exampleCapacityProvider.arn())
                     .build())
                 .build())
             .code(new FileArchive("function.zip"))
             .name("example")
             .role(exampleAwsIamRole.arn())
             .handler("index.handler")
             .runtime("nodejs24.x")
             .memorySize(2048)
             .publish(true)
             .build());
 
     }
 }
    See the `aws.lambda.CapacityProvider` resource for more details, such as configuring instance requirements and the scaling policy. AWS Lambda expects source code to be provided as a deployment package whose structure varies depending on which `runtime` is in use. See [Runtimes](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-Runtime) for the valid values of `runtime`. The expected structure of the deployment package can be found in [the AWS Lambda documentation for each runtime](https://docs.aws.amazon.com/lambda/latest/dg/deployment-package-v2.html). Once you have created your deployment package you can specify it either directly as a local file (using the `filename` argument) or indirectly via Amazon S3 (using the `s3Bucket`, `s3Key` and `s3ObjectVersion` arguments). When providing the deployment package via S3 it may be useful to use the `aws.s3.BucketObjectv2` resource to upload it. For larger deployment packages it is recommended by Amazon to upload via S3, since the S3 API has better support for uploading large files efficiently. ## Import ### Identity Schema #### Required * `functionName` (String) Name of the Lambda function. #### Optional * `accountId` (String) AWS Account where this resource is managed. * `region` (String) Region where this resource is managed. Using `pulumi import`, import Lambda Functions using the `functionName`. For example: ```sh $ pulumi import aws:lambda/function:Function example example ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Constructor Summary

      Constructors 
      Constructor Description
      Function​(java.lang.String name)  
      Function​(java.lang.String name, FunctionArgs args)  
      Function​(java.lang.String name, FunctionArgs args, com.pulumi.resources.CustomResourceOptions options)  

    • Constructor Detail

      • Function

        public Function​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • Function

        public Function​(java.lang.String name,
                FunctionArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • Function

        public Function​(java.lang.String name,
                FunctionArgs args,
                @Nullable
                com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • architectures

        public com.pulumi.core.Output<java.util.List<java.lang.String>> architectures()
        Returns:
        Instruction set architecture for your Lambda function. Valid values are `["x8664"]` and `["arm64"]`. Default is `["x8664"]`. Removing this attribute, function's architecture stays the same.

      • arn

        public com.pulumi.core.Output<java.lang.String> arn()
        Returns:
        ARN identifying your Lambda Function.

      • capacityProviderConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionCapacityProviderConfig>> capacityProviderConfig()
        Returns:
        Configuration block for Lambda Capacity Provider. See below.

      • code

        public com.pulumi.core.Output<java.util.Optional<com.pulumi.asset.Archive>> code()
        Returns:
        Path to the function's deployment package within the local filesystem. Conflicts with `imageUri` and `s3Bucket`. One of `filename`, `imageUri`, or `s3Bucket` must be specified.

      • codeSha256

        public com.pulumi.core.Output<java.lang.String> codeSha256()
        Returns:
        Base64-encoded representation the source code package file. Use this argument to trigger updates when the function source code changes. For OCI, this value is relayed directly from the image digest. For zip files, this value is the Base64 encoded SHA-256 hash of the `.zip` file. Layers are not included in the calculation. To trigger updates using a non-standard hashing algorithm, use the `sourceCodeHash` argument instead.

      • codeSigningConfigArn

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> codeSigningConfigArn()
        Returns:
        ARN of a code-signing configuration to enable code signing for this function.

      • deadLetterConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionDeadLetterConfig>> deadLetterConfig()
        Returns:
        Configuration block for dead letter queue. See below.

      • description

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> description()
        Returns:
        Description of what your Lambda Function does.

      • durableConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionDurableConfig>> durableConfig()
        Returns:
        Configuration block for durable function settings. See below. `durableConfig` may only be available in [limited regions](https://builder.aws.com/build/capabilities), including `us-east-2`.

      • environment

        public com.pulumi.core.Output<java.util.Optional<FunctionEnvironment>> environment()
        Returns:
        Configuration block for environment variables. See below.

      • ephemeralStorage

        public com.pulumi.core.Output<FunctionEphemeralStorage> ephemeralStorage()
        Returns:
        Amount of ephemeral storage (`/tmp`) to allocate for the Lambda Function. See below.

      • fileSystemConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionFileSystemConfig>> fileSystemConfig()
        Returns:
        Configuration block for EFS or S3 Files file system. See below.

      • handler

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> handler()
        Returns:
        Function entry point in your code. Required if `packageType` is `Zip`.

      • imageConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionImageConfig>> imageConfig()
        Returns:
        Container image configuration values. See below.

      • imageUri

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> imageUri()
        Returns:
        ECR image URI containing the function's deployment package. Conflicts with `filename` and `s3Bucket`. One of `filename`, `imageUri`, or `s3Bucket` must be specified.

      • invokeArn

        public com.pulumi.core.Output<java.lang.String> invokeArn()
        Returns:
        ARN to be used for invoking Lambda Function from API Gateway - to be used in `aws.apigateway.Integration`'s `uri`.

      • kmsKeyArn

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> kmsKeyArn()
        Returns:
        ARN of the KMS key used to encrypt environment variables. If not provided when environment variables are in use, AWS Lambda uses a default service key. If provided when environment variables are not in use, the AWS Lambda API does not save this configuration.

      • lastModified

        public com.pulumi.core.Output<java.lang.String> lastModified()
        Returns:
        Date this resource was last modified.

      • layers

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> layers()
        Returns:
        List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function.

      • loggingConfig

        public com.pulumi.core.Output<FunctionLoggingConfig> loggingConfig()
        Returns:
        Configuration block for advanced logging settings. See below.

      • memorySize

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> memorySize()
        Returns:
        Amount of memory in MB your Lambda Function can use at runtime. Valid value between 128 MB to 32,768 MB (32 GB), in 1 MB increments. Defaults to 128.

      • name

        public com.pulumi.core.Output<java.lang.String> name()
        Returns:
        Unique name for your Lambda Function.

      • packageType

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> packageType()
        Returns:
        Lambda deployment package type. Valid values are `Zip` and `Image`. Defaults to `Zip`.

      • publish

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> publish()
        Returns:
        Whether to publish creation/change as new Lambda Function Version. Defaults to `false`.

      • publishTo

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> publishTo()
        Returns:
        Whether to publish to a alias or version number. Omit for regular version publishing. Option is `LATEST_PUBLISHED`.

      • qualifiedArn

        public com.pulumi.core.Output<java.lang.String> qualifiedArn()
        Returns:
        ARN identifying your Lambda Function Version (if versioning is enabled via `publish = true`).

      • qualifiedInvokeArn

        public com.pulumi.core.Output<java.lang.String> qualifiedInvokeArn()
        Returns:
        Qualified ARN (ARN with lambda version number) to be used for invoking Lambda Function from API Gateway - to be used in `aws.apigateway.Integration`'s `uri`.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • replaceSecurityGroupsOnDestroy

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> replaceSecurityGroupsOnDestroy()
        Returns:
        Whether to replace the security groups on the function's VPC configuration prior to destruction. Default is `false`.

      • replacementSecurityGroupIds

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> replacementSecurityGroupIds()
        Returns:
        List of security group IDs to assign to the function's VPC configuration prior to destruction. Required if `replaceSecurityGroupsOnDestroy` is `true`.

      • reservedConcurrentExecutions

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> reservedConcurrentExecutions()
        Returns:
        Amount of reserved concurrent executions for this lambda function. A value of `0` disables lambda from being triggered and `-1` removes any concurrency limitations. Defaults to Unreserved Concurrency Limits `-1`.

      • responseStreamingInvokeArn

        public com.pulumi.core.Output<java.lang.String> responseStreamingInvokeArn()
        Returns:
        ARN to be used for invoking Lambda Function from API Gateway with response streaming - to be used in `aws.apigateway.Integration`'s `uri`.

      • role

        public com.pulumi.core.Output<java.lang.String> role()
        Returns:
        ARN of the function's execution role. The role provides the function's identity and access to AWS services and resources. The following arguments are optional:

      • runtime

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> runtime()
        Returns:
        Identifier of the function's runtime. Required if `packageType` is `Zip`. See [Runtimes](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html#SSS-CreateFunction-request-Runtime) for valid values.

      • s3Bucket

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> s3Bucket()
        Returns:
        S3 bucket location containing the function's deployment package. Conflicts with `filename` and `imageUri`. One of `filename`, `imageUri`, or `s3Bucket` must be specified.

      • s3Key

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> s3Key()
        Returns:
        S3 key of an object containing the function's deployment package. Required if `s3Bucket` is set.

      • s3ObjectVersion

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> s3ObjectVersion()
        Returns:
        Object version containing the function's deployment package. Conflicts with `filename` and `imageUri`.

      • signingJobArn

        public com.pulumi.core.Output<java.lang.String> signingJobArn()
        Returns:
        ARN of the signing job.

      • signingProfileVersionArn

        public com.pulumi.core.Output<java.lang.String> signingProfileVersionArn()
        Returns:
        ARN of the signing profile version.

      • skipDestroy

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> skipDestroy()
        Returns:
        Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`.

      • snapStart

        public com.pulumi.core.Output<java.util.Optional<FunctionSnapStart>> snapStart()
        Returns:
        Configuration block for snap start settings. See below.

      • sourceCodeHash

        public com.pulumi.core.Output<java.lang.String> sourceCodeHash()
        Returns:
        User-defined hash of the source code package file. Use this argument to trigger updates when the local function source code changes. This is a synthetic argument tracked only by the AWS provider and does not need to match the hashing algorithm used by Lambda to compute the `CodeSha256` response value. Out-of-band changes to the source code _will not_ be captured by this argument. To include out-of-band source code changes as an update trigger, use the `codeSha256` argument instead.

      • sourceCodeSize

        public com.pulumi.core.Output<java.lang.Integer> sourceCodeSize()
        Returns:
        Size in bytes of the function .zip file.

      • sourceKmsKeyArn

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> sourceKmsKeyArn()
        Returns:
        ARN of the KMS key used to encrypt the function's `.zip` deployment package. Conflicts with `imageUri`.

      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Key-value map of tags for the Lambda function. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.

      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.

      • tenancyConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionTenancyConfig>> tenancyConfig()
        Returns:
        Configuration block for Tenancy. See below.

      • timeout

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> timeout()
        Returns:
        Amount of time your Lambda Function has to run in seconds. Defaults to 3. Valid between 1 and 900.

      • tracingConfig

        public com.pulumi.core.Output<FunctionTracingConfig> tracingConfig()
        Returns:
        Configuration block for X-Ray tracing. See below.

      • useResourceTimeoutForPropagation

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> useResourceTimeoutForPropagation()
        Returns:
        Whether to apply resource level timeout values while retrying eventually consistent API operations. By default the provider uses a 5 minute timeout to allow for propagation in the Lambda service. When set to `true`, this default value is replaced with the configurable resource timeouts. Increased timeout values may be useful in highly active accounts, or regions where propagation delays are inconsistent.

      • version

        public com.pulumi.core.Output<java.lang.String> version()
        Returns:
        Latest published version of your Lambda Function.

      • vpcConfig

        public com.pulumi.core.Output<java.util.Optional<FunctionVpcConfig>> vpcConfig()
        Returns:
        Configuration block for VPC. See below.

      • get

        public static Function get​(java.lang.String name,
                           com.pulumi.core.Output<java.lang.String> id,
                           @Nullable
                           FunctionState state,
                           @Nullable
                           com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.