[{"data":1,"prerenderedAt":566},["ShallowReactive",2],{"content-svc-lambda-guides-aws-lambda-operator-guide-public-endpoints":3},{"markdown":4,"frontMatterAttributes":5,"bodyRaw":8,"menu":9,"menuType":563,"isCollapseableMenu":12,"nextDocItem":295,"previousDocItem":285,"contributorPaths":564,"contentName":565,"slug":294,"readingTime":17},"\u003Cp>For workloads that are accessible publicly, AWS provides a number of features and services that can help mitigate certain risks. This section covers authentication and authorization of application users and protecting API endpoints.\u003C\u002Fp>\n\u003Ch2>Authentication and authorization\u003C\u002Fh2>\n\u003Cp>Authentication relates to identity and authorization refers to actions. Use authentication to control who can invoke a Lambda function, and then use authorization to control what they can do. For many applications, IAM is sufficient for managing both control mechanisms.\u003C\u002Fp>\n\u003Cp>For applications with external users, such as web or mobile applications, it is common to use \u003Ca href=\"https:\u002F\u002Fjwt.io\u002Fintroduction\u002F\">JSON Web Tokens\u003C\u002Fa> (JWTs) to manage authentication and authorization. Unlike traditional, server-based password management, JWTs are passed from the client on every request. They are a cryptographically secure way to verify identity and claims using data passed from the client. For Lambda-based applications, this allows you to secure every call to each API endpoint without relying on a central server for authentication.\u003C\u002Fp>\n\u003Cp>You can \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fcognito\u002Flatest\u002Fdeveloperguide\u002Famazon-cognito-user-pools-using-tokens-with-identity-providers.html\">implement JWTs with Amazon Cognito\u003C\u002Fa>, a user directory service that can handle registration, authentication, account recovery, and other common account management operations. \u003Ca href=\"https:\u002F\u002Fdocs.amplify.aws\u002Fstart\u002Fgetting-started\u002Fauth\u002Fq\u002Fintegration\u002Freact\">Amplify Framework\u003C\u002Fa> provides libraries to simplify integrating this service into your frontend application. You can also use third-party partner services like \u003Ca href=\"https:\u002F\u002Fauth0.com\u002F\">Auth0\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Given the critical security role of an identity provider service, it’s important to use professional tooling to safeguard your application. It’s not recommended that you write your own services to handle authentication or authorization. Any vulnerabilities in custom libraries may have significant implications for the security of your workload and its data.\u003C\u002Fp>\n\u003Ch2>Protecting API endpoints\u003C\u002Fh2>\n\u003Cp>For serverless applications, the preferred way to serve a backend application publicly is to use API Gateway. This can help you protect an API from malicious users or spikes in traffic.\u003C\u002Fp>\n\u003Cp>API Gateway offers two endpoint types for serverless developers: \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-rest-api.html\">REST APIs\u003C\u002Fa> and \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api.html\">HTTP APIs\u003C\u002Fa>. Both support \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-use-lambda-authorizer.html\">authorization using AWS Lambda\u003C\u002Fa>, IAM, or Amazon Cognito. When using IAM or Amazon Cognito, incoming requests are evaluated and if they are missing a required token or contain invalid authentication, the request is rejected. You are not charged for these requests and they do not count towards any throttling quotas.\u003C\u002Fp>\n\u003Cp>Unauthenticated API routes may be accessed by anyone on the public internet so it’s recommended that you limit the use of unauthenticated APIs. If you must use unauthenticated APIs, it’s important to protect these against common risks, such as \u003Ca href=\"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FDenial-of-service_attack\">denial-of-service\u003C\u002Fa> (DoS) attacks. \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-aws-waf.html\">Applying AWS WAF\u003C\u002Fa> to these APIs can help protect your application from SQL injection and cross-site scripting (XSS) attacks. API Gateway also implements \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-request-throttling.html\">throttling\u003C\u002Fa>  at the AWS account-level and per-client level when API keys are used.\u003C\u002Fp>\n\u003Cp>In many cases, the functionality provided by unauthenticated API can be achieved with an alternative approach. For example, a web application may provide a list of customer retail stores from a DynamoDB table to users who are not logged in. This request may originate from a frontend web application or from any other source that calls the URL endpoint. This diagram compares three solutions:\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fassets\u002Fimages\u002Fsecurity-ops-figure-5.png\" alt=\"\">\u003C\u002Fp>\n\u003Col>\n\u003Cli>This unauthenticated API can be called by anyone on the internet. In a denial of service attack, it’s possible to exhaust API throttling limits, Lambda concurrency, or DynamoDB provisioned read capacity on an underlying table.\u003C\u002Fli>\n\u003Cli>A CloudFront distribution in front of the API endpoint with an appropriate \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudFront\u002Flatest\u002FDeveloperGuide\u002FExpiration.html\">time-to-live\u003C\u002Fa> (TTL) configuration would absorb most of the traffic in a DoS attack, without changing the underlying solution for fetching the data.\u003C\u002Fli>\n\u003Cli>Alternatively, for static data that rarely changes, the CloudFront distribution could serve the data from an S3 bucket.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>The AWS Well-Architected Tool provides a \u003Ca href=\"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fuserguide\u002Fintro.html\">Serverless Lens\u003C\u002Fa> that can help analyze the security posture of serverless workloads.\u003C\u002Fp>\n",{"title":6,"order":7},"Securing workloads with public endpoints",46,"For workloads that are accessible publicly, AWS provides a number of features and services that can help mitigate certain risks. This section covers authentication and authorization of application users and protecting API endpoints.\n\n## Authentication and authorization\n\nAuthentication relates to identity and authorization refers to actions. Use authentication to control who can invoke a Lambda function, and then use authorization to control what they can do. For many applications, IAM is sufficient for managing both control mechanisms.\n\nFor applications with external users, such as web or mobile applications, it is common to use [JSON Web Tokens](https:\u002F\u002Fjwt.io\u002Fintroduction\u002F) (JWTs) to manage authentication and authorization. Unlike traditional, server-based password management, JWTs are passed from the client on every request. They are a cryptographically secure way to verify identity and claims using data passed from the client. For Lambda-based applications, this allows you to secure every call to each API endpoint without relying on a central server for authentication.\n\nYou can [implement JWTs with Amazon Cognito](https:\u002F\u002Fdocs.aws.amazon.com\u002Fcognito\u002Flatest\u002Fdeveloperguide\u002Famazon-cognito-user-pools-using-tokens-with-identity-providers.html), a user directory service that can handle registration, authentication, account recovery, and other common account management operations. [Amplify Framework](https:\u002F\u002Fdocs.amplify.aws\u002Fstart\u002Fgetting-started\u002Fauth\u002Fq\u002Fintegration\u002Freact) provides libraries to simplify integrating this service into your frontend application. You can also use third-party partner services like [Auth0](https:\u002F\u002Fauth0.com\u002F).\n\nGiven the critical security role of an identity provider service, it’s important to use professional tooling to safeguard your application. It’s not recommended that you write your own services to handle authentication or authorization. Any vulnerabilities in custom libraries may have significant implications for the security of your workload and its data.\n\n## Protecting API endpoints\n\nFor serverless applications, the preferred way to serve a backend application publicly is to use API Gateway. This can help you protect an API from malicious users or spikes in traffic.\n\nAPI Gateway offers two endpoint types for serverless developers: [REST APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-rest-api.html) and [HTTP APIs](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fhttp-api.html). Both support [authorization using AWS Lambda](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-use-lambda-authorizer.html), IAM, or Amazon Cognito. When using IAM or Amazon Cognito, incoming requests are evaluated and if they are missing a required token or contain invalid authentication, the request is rejected. You are not charged for these requests and they do not count towards any throttling quotas.\n\nUnauthenticated API routes may be accessed by anyone on the public internet so it’s recommended that you limit the use of unauthenticated APIs. If you must use unauthenticated APIs, it’s important to protect these against common risks, such as [denial-of-service](https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FDenial-of-service_attack) (DoS) attacks. [Applying AWS WAF](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapigateway-control-access-aws-waf.html) to these APIs can help protect your application from SQL injection and cross-site scripting (XSS) attacks. API Gateway also implements [throttling](https:\u002F\u002Fdocs.aws.amazon.com\u002Fapigateway\u002Flatest\u002Fdeveloperguide\u002Fapi-gateway-request-throttling.html)  at the AWS account-level and per-client level when API keys are used.\n\nIn many cases, the functionality provided by unauthenticated API can be achieved with an alternative approach. For example, a web application may provide a list of customer retail stores from a DynamoDB table to users who are not logged in. This request may originate from a frontend web application or from any other source that calls the URL endpoint. This diagram compares three solutions:\n\n![](\u002Fassets\u002Fexternal\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fassets\u002Fimages\u002Fsecurity-ops-figure-5.png)\n\n\n1.  This unauthenticated API can be called by anyone on the internet. In a denial of service attack, it’s possible to exhaust API throttling limits, Lambda concurrency, or DynamoDB provisioned read capacity on an underlying table.\n2.  A CloudFront distribution in front of the API endpoint with an appropriate [time-to-live](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudFront\u002Flatest\u002FDeveloperGuide\u002FExpiration.html) (TTL) configuration would absorb most of the traffic in a DoS attack, without changing the underlying solution for fetching the data.\n3.  Alternatively, for static data that rarely changes, the CloudFront distribution could serve the data from an S3 bucket.\n\nThe AWS Well-Architected Tool provides a [Serverless Lens](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fuserguide\u002Fintro.html) that can help analyze the security posture of serverless workloads.",[10,21,139,247,312,382,486,555],{"title":-1,"collapsible":11,"isCollapsed":12,"content":13},false,true,[14],{"title":15,"order":16,"time":17,"path":18,"id":19,"link":20},"Introduction",1,"4 min","intro","intro.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fintro",{"title":22,"collapsible":12,"isCollapsed":12,"content":23},"Event-driven architectures",[24,30,37,43,49,55,62,68,74,80,86,92,98,104,110,116,122,128,133],{"title":22,"order":25,"time":26,"path":27,"id":28,"link":29},2,"1 min","event-driven-architectures","event-driven-architectures.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fevent-driven-architectures",{"title":31,"order":32,"time":33,"path":34,"id":35,"link":36},"How Lambda fits into the event-driven paradigm",3,"3 min","lambda-event-driven-paradigm","lambda-event-driven-paradigm.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Flambda-event-driven-paradigm",{"title":38,"order":39,"time":33,"path":40,"id":41,"link":42},"The benefits of event-driven architectures",4,"event-driven-benefits","event-driven-benefits.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fevent-driven-benefits",{"title":44,"order":45,"time":17,"path":46,"id":47,"link":48},"Trade-offs of event-driven architectures",5,"tradeoffs-event-driven","tradeoffs-event-driven.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Ftradeoffs-event-driven",{"title":50,"order":51,"time":26,"path":52,"id":53,"link":54},"Design principles",6,"design-principles","design-principles.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fdesign-principles",{"title":56,"order":57,"time":58,"path":59,"id":60,"link":61},"Use services instead of custom code",7,"2 min","services-custom-code","services-custom-code.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fservices-custom-code",{"title":63,"order":64,"time":26,"path":65,"id":66,"link":67},"Understanding the level of abstraction",8,"level-abstraction","level-abstraction.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Flevel-abstraction",{"title":69,"order":70,"time":26,"path":71,"id":72,"link":73},"Implementing statelessness in functions",9,"statelessness-functions","statelessness-functions.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fstatelessness-functions",{"title":75,"order":76,"time":26,"path":77,"id":78,"link":79},"Lambda function design",10,"function-design","function-design.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Ffunction-design",{"title":81,"order":82,"time":58,"path":83,"id":84,"link":85},"Building for on-demand data instead of batches",11,"on-demand-batches","on-demand-batches.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fon-demand-batches",{"title":87,"order":88,"time":26,"path":89,"id":90,"link":91},"Orchestration",12,"orchestration","orchestration.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Forchestration",{"title":93,"order":94,"time":58,"path":95,"id":96,"link":97},"Developing for retries and failures",13,"retries-failure","retries-failure.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fretries-failure",{"title":99,"order":100,"time":26,"path":101,"id":102,"link":103},"Anti-patterns in Lambda-based applications",14,"anti-patterns","anti-patterns.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fanti-patterns",{"title":105,"order":106,"time":17,"path":107,"id":108,"link":109},"The Lambda monolith",15,"monolith","monolith.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fmonolith",{"title":111,"order":112,"time":58,"path":113,"id":114,"link":115},"Lambda as orchestrator",16,"orchestrator","orchestrator.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Forchestrator",{"title":117,"order":118,"time":58,"path":119,"id":120,"link":121},"Recursive patterns that cause run-away Lambda functions",17,"recursive-runaway","recursive-runaway.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Frecursive-runaway",{"title":123,"order":124,"time":33,"path":125,"id":126,"link":127},"Lambda functions calling Lambda functions",19,"functions-calling-functions","functions-calling-functions.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Ffunctions-calling-functions",{"title":129,"order":124,"time":26,"path":130,"id":131,"link":132},"Synchronous waiting within a single Lambda function","synchronous-waiting","synchronous-waiting.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fsynchronous-waiting",{"title":134,"order":135,"time":33,"path":136,"id":137,"link":138},"Frequently asked questions",20,"event-driven-faq","event-driven-faq.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fevent-driven-faq",{"title":140,"collapsible":12,"isCollapsed":12,"content":141},"Application design",[142,147,153,159,165,171,177,182,188,194,200,206,212,218,224,230,236,242],{"title":140,"order":143,"time":26,"path":144,"id":145,"link":146},21,"application-design","application-design.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fapplication-design",{"title":148,"order":149,"time":33,"path":150,"id":151,"link":152},"Understanding quotas",22,"quotas","quotas.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fquotas",{"title":154,"order":155,"time":58,"path":156,"id":157,"link":158},"Architecting with Service Quotas",23,"service-quotas","service-quotas.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fservice-quotas",{"title":160,"order":161,"time":58,"path":162,"id":163,"link":164},"Using multiple AWS accounts for managing quotas",24,"multiple-accounts","multiple-accounts.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fmultiple-accounts",{"title":166,"order":167,"time":26,"path":168,"id":169,"link":170},"Scaling and concurrency in Lambda",25,"scaling-concurrency","scaling-concurrency.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fscaling-concurrency",{"title":172,"order":173,"time":58,"path":174,"id":175,"link":176},"On-demand scaling example",26,"on-demand-scaling","on-demand-scaling.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fon-demand-scaling",{"title":178,"order":173,"time":58,"path":179,"id":180,"link":181},"Provisioned Concurrency scaling example","provisioned-scaling","provisioned-scaling.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fprovisioned-scaling",{"title":183,"order":184,"time":58,"path":185,"id":186,"link":187},"Using service integrations and asynchronous processing",28,"integrations-asynchronous","integrations-asynchronous.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fintegrations-asynchronous",{"title":189,"order":190,"time":58,"path":191,"id":192,"link":193},"Reserved concurrency",29,"reserved-concurrency","reserved-concurrency.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Freserved-concurrency",{"title":195,"order":196,"time":26,"path":197,"id":198,"link":199},"Choosing and managing runtimes in Lambda functions",30,"runtimes-functions","runtimes-functions.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fruntimes-functions",{"title":201,"order":202,"time":26,"path":203,"id":204,"link":205},"Runtimes and performance",31,"runtimes-performance","runtimes-performance.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fruntimes-performance",{"title":207,"order":208,"time":26,"path":209,"id":210,"link":211},"Multiple runtimes in single applications",32,"runtimes-multiple","runtimes-multiple.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fruntimes-multiple",{"title":213,"order":214,"time":26,"path":215,"id":216,"link":217},"Managing AWS SDKs in Lambda functions",33,"sdks-functions","sdks-functions.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fsdks-functions",{"title":219,"order":220,"time":33,"path":221,"id":222,"link":223},"Networking and VPC configurations",34,"networking-vpc","networking-vpc.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fnetworking-vpc",{"title":225,"order":226,"time":33,"path":227,"id":228,"link":229},"Comparing Lambda invocation modes",35,"invocation-modes","invocation-modes.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Finvocation-modes",{"title":231,"order":232,"time":58,"path":233,"id":234,"link":235},"Understanding SQS retries",36,"sqs-retries","sqs-retries.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fsqs-retries",{"title":237,"order":238,"time":58,"path":239,"id":240,"link":241},"Controlling traffic flow for server-based resources",37,"traffic-server-based","traffic-server-based.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Ftraffic-server-based",{"title":134,"order":243,"time":33,"path":244,"id":245,"link":246},38,"application-design-faq","application-design-faq.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fapplication-design-faq",{"title":248,"collapsible":12,"isCollapsed":11,"content":249},"Security",[250,255,261,267,273,279,285,291,295,301,307],{"title":248,"order":251,"time":58,"path":252,"id":253,"link":254},39,"security-ops","security-ops.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fsecurity-ops",{"title":256,"order":257,"time":33,"path":258,"id":259,"link":260},"Understanding the Lambda execution environment",40,"execution-environment","execution-environment.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fexecution-environment",{"title":262,"order":263,"time":58,"path":264,"id":265,"link":266},"Applying the principles of least privilege",41,"least-privilege","least-privilege.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fleast-privilege",{"title":268,"order":269,"time":58,"path":270,"id":271,"link":272},"Developing least privilege IAM roles",42,"least-privilege-iam","least-privilege-iam.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fleast-privilege-iam",{"title":274,"order":275,"time":26,"path":276,"id":277,"link":278},"Access to CloudWatch Logs",43,"access-logs","access-logs.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Faccess-logs",{"title":280,"order":281,"time":58,"path":282,"id":283,"link":284},"Avoiding granting wildcard permissions in IAM policies",44,"wildcard-permissions-iam","wildcard-permissions-iam.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fwildcard-permissions-iam",{"title":286,"order":287,"time":26,"path":288,"id":289,"link":290},"Specialized Lambda functions compared with all-purpose functions",45,"specialized-all-purpose","specialized-all-purpose.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fspecialized-all-purpose",{"title":6,"order":7,"time":17,"path":292,"id":293,"link":294},"public-endpoints","public-endpoints.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fpublic-endpoints",{"title":296,"order":297,"time":58,"path":298,"id":299,"link":300},"Encrypting data in Lambda-based applications",47,"data-in-applications","data-in-applications.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fdata-in-applications",{"title":302,"order":303,"time":33,"path":304,"id":305,"link":306},"Security governance controls",48,"governance-controls","governance-controls.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fgovernance-controls",{"title":134,"order":308,"time":58,"path":309,"id":310,"link":311},49,"security-ops-faq","security-ops-faq.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fsecurity-ops-faq",{"title":313,"collapsible":12,"isCollapsed":12,"content":314},"Debugging",[315,320,326,332,338,345,352,358,364,370,376],{"title":313,"order":316,"time":26,"path":317,"id":318,"link":319},50,"debugging-ops","debugging-ops.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fdebugging-ops",{"title":321,"order":322,"time":33,"path":323,"id":324,"link":325},"Standardizing a debugging approach",51,"debugging-approach","debugging-approach.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fdebugging-approach",{"title":327,"order":328,"time":58,"path":329,"id":330,"link":331},"General types of error",52,"general-types","general-types.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fgeneral-types",{"title":333,"order":334,"time":17,"path":335,"id":336,"link":337},"Troubleshooting payloads",53,"payload","payload.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fpayload",{"title":339,"order":340,"time":341,"path":342,"id":343,"link":344},"Troubleshooting integration errors",54,"5 min","integration-errors","integration-errors.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fintegration-errors",{"title":346,"order":347,"time":348,"path":349,"id":350,"link":351},"Troubleshooting Lambda configurations",55,"9 min","configurations","configurations.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fconfigurations",{"title":353,"order":354,"time":58,"path":355,"id":356,"link":357},"Troubleshooting queue processing by Lambda functions",56,"queue-processing","queue-processing.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fqueue-processing",{"title":359,"order":360,"time":58,"path":361,"id":362,"link":363},"Identifying and managing throttling",57,"throttling","throttling.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fthrottling",{"title":365,"order":366,"time":26,"path":367,"id":368,"link":369},"Errors in the processing function",58,"processing-function","processing-function.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fprocessing-function",{"title":371,"order":372,"time":26,"path":373,"id":374,"link":375},"Identifying and handling backpressure",59,"backpressure","backpressure.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fbackpressure",{"title":377,"order":378,"time":33,"path":379,"id":380,"link":381},"Best practices for your debugging environment",60,"best-practices-debugging","best-practices-debugging.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fbest-practices-debugging",{"title":383,"collapsible":12,"isCollapsed":12,"content":384},"Monitoring and observability",[385,390,396,402,408,414,420,426,432,438,444,450,456,462,468,474,480],{"title":383,"order":386,"time":26,"path":387,"id":388,"link":389},61,"monitoring-observability","monitoring-observability.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fmonitoring-observability",{"title":391,"order":392,"time":33,"path":393,"id":394,"link":395},"Monitoring concepts in Lambda-based applications",62,"monitoring-concepts","monitoring-concepts.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fmonitoring-concepts",{"title":397,"order":398,"time":26,"path":399,"id":400,"link":401},"Logging and metrics with Amazon CloudWatch",63,"logging-metrics","logging-metrics.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Flogging-metrics",{"title":403,"order":404,"time":58,"path":405,"id":406,"link":407},"How CloudWatch structures logs",64,"log-structure","log-structure.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Flog-structure",{"title":409,"order":410,"time":33,"path":411,"id":412,"link":413},"Important metrics for CloudWatch",65,"important-metrics","important-metrics.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fimportant-metrics",{"title":415,"order":416,"time":58,"path":417,"id":418,"link":419},"Custom metrics",66,"custom-metrics","custom-metrics.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fcustom-metrics",{"title":421,"order":422,"time":26,"path":423,"id":424,"link":425},"Using AWS Resource Groups to organize your workload",67,"organize-workload","organize-workload.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Forganize-workload",{"title":427,"order":428,"time":58,"path":429,"id":430,"link":431},"Searching across logs with CloudWatch Logs Insights",68,"search-logs","search-logs.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fsearch-logs",{"title":433,"order":434,"time":33,"path":435,"id":436,"link":437},"Parsing logs and structured logging",69,"parse-logs","parse-logs.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fparse-logs",{"title":439,"order":440,"time":26,"path":441,"id":442,"link":443},"Querying AWS-generated events",70,"query-events","query-events.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fquery-events",{"title":445,"order":446,"time":26,"path":447,"id":448,"link":449},"Log visualization and dashboard",71,"visualization","visualization.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fvisualization",{"title":451,"order":452,"time":58,"path":453,"id":454,"link":455},"Useful Insights queries",72,"useful-queries","useful-queries.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fuseful-queries",{"title":457,"order":458,"time":58,"path":459,"id":460,"link":461},"Tracing requests with AWS X-Ray",73,"trace-requests","trace-requests.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Ftrace-requests",{"title":463,"order":464,"time":341,"path":465,"id":466,"link":467},"Troubleshooting walkthrough: isolating and resolving issues",74,"troubleshooting-walkthrough","troubleshooting-walkthrough.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Ftroubleshooting-walkthrough",{"title":469,"order":470,"time":58,"path":471,"id":472,"link":473},"A general approach to debugging Lambda performance issues and errors",75,"general-approach","general-approach.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fgeneral-approach",{"title":475,"order":476,"time":26,"path":477,"id":478,"link":479},"Monitoring Lambda code storage",76,"code-storage","code-storage.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fcode-storage",{"title":481,"order":482,"time":33,"path":483,"id":484,"link":485},"Best practices for managing code storage",77,"code-storage-best-practice","code-storage-best-practice.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fcode-storage-best-practice",{"title":487,"collapsible":12,"isCollapsed":12,"content":488},"Performance optimization",[489,494,501,507,513,519,525,531,537,543,549],{"title":487,"order":490,"time":26,"path":491,"id":492,"link":493},78,"perf-optimize","perf-optimize.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fperf-optimize",{"title":495,"order":496,"time":497,"path":498,"id":499,"link":500},"Lambda execution environments",79,"7 min","execution-environments","execution-environments.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fexecution-environments",{"title":502,"order":503,"time":58,"path":504,"id":505,"link":506},"Memory and computing power",80,"computing-power","computing-power.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fcomputing-power",{"title":508,"order":509,"time":58,"path":510,"id":511,"link":512},"Profiling functions with AWS Lambda Power Tuning",81,"profile-functions","profile-functions.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fprofile-functions",{"title":514,"order":515,"time":33,"path":516,"id":517,"link":518},"Optimizing static initialization",82,"static-initialization","static-initialization.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fstatic-initialization",{"title":520,"order":521,"time":58,"path":522,"id":523,"link":524},"Comparing the effect of global scope",83,"global-scope","global-scope.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fglobal-scope",{"title":526,"order":527,"time":26,"path":528,"id":529,"link":530},"Static initialization and Provisioned Concurrency",84,"initialization-pc","initialization-pc.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Finitialization-pc",{"title":532,"order":533,"time":26,"path":534,"id":535,"link":536},"Architecture and Best Practices",85,"architecture-best-practice","architecture-best-practice.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Farchitecture-best-practice",{"title":538,"order":539,"time":58,"path":540,"id":541,"link":542},"Comparing performance of interactive and asynchronous workloads",86,"interactive-asynchronous","interactive-asynchronous.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Finteractive-asynchronous",{"title":544,"order":545,"time":58,"path":546,"id":547,"link":548},"When not to use a Lambda function",87,"no-function","no-function.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fno-function",{"title":550,"order":551,"time":58,"path":552,"id":553,"link":554},"Cost optimization",88,"cost-optimize","cost-optimize.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fcost-optimize",{"title":-1,"collapsible":11,"isCollapsed":12,"content":556},[557],{"title":558,"order":559,"time":26,"path":560,"id":561,"link":562},"Document history",89,"doc-history","doc-history.md","\u002Fcontent\u002Fservice\u002Flambda\u002Fguides\u002Faws-lambda-operator-guide\u002Fdoc-history","LIST",[],"AWS Lambda Operator Guide",1792665271822]