This pattern deploys the smallest possible Lambda Web Function: a Node.js server built with the standard http module and no dependencies. Lambda Web Functions run a long-lived HTTP server inside a Firecracker microVM and forward requests to it directly, so the code has no Lambda handler, no event object and no response mapping. The same index.js runs locally with node index.js and on AWS without changes.

The application reads the address it must listen on from the AWS_LAMBDA_HTTP_ENDPOINT environment variable, which the runtime sets to 0.0.0.0:3000, and falls back to that value when the variable is absent (local development). Each sandbox serves many requests concurrently on one process, so the app keeps in-memory counters (active requests, peak concurrency, total requests) and returns them in every JSON response. Sending parallel requests makes the concurrency model visible: the counters grow per sandbox, and a second sandbox starts from zero. On SIGTERM the server closes gracefully.

A single AWS::Serverless::WebFunction resource in the SAM template expands into three CloudFormation resources: AWS::Lambda::WebFunction (the function), AWS::Lambda::WebFunctionRevision (an immutable snapshot of code plus configuration, referencing a zip in a versioning-enabled S3 bucket) and AWS::Lambda::WebFunctionEndpoint (the HTTPS endpoint, routed 100% to that revision). SAM also generates the execution role with CloudWatch Logs permissions and writes logs to the log group named in LoggingConfig.

The endpoint uses AuthType ApplicationManaged, which makes it publicly reachable: the application owns authentication, input validation and rate limiting. Switch to IamAuth to accept only SigV4-signed requests. EndpointType HomeRegion creates a single regional endpoint; MultiRegion and PerRegion replicate it to other Regions.

Deploying a change means uploading a new zip under a new S3 key and deploying again: CloudFormation creates a new immutable revision only when the revision's properties change, so re-deploying with an unchanged key reports no changes. Because the endpoint uses AutoDeploymentMode LatestRevision, traffic moves to the new revision as soon as it is active; for weighted canaries between two revisions, set AutoDeploymentMode Disabled and RevisionWeights instead.