Lambda

A Lambda function whose role can only write logs until you grant more. Graviton, one-year log retention and IAM-only function URLs by default.

Compute · anvil:aws:Lambda

Write the function in TypeScript or JavaScript on Node.js, or in Rust. The Runtimes tab shows each one: how its handler is written, how it is built, and an example.

Minimal

The smallest config that deploys.

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const api = new anvil.aws.Lambda('api', {
      runtime: 'nodejs24.x',
      handler: 'functions/api/index.handler',
    });
  },
});

import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    api = anvil.aws.Lambda("api",
        runtime="nodejs24.x",
        handler="functions/api/index.handler",
    )

anvil.App(run=infra)

package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
    "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            _, err := anvilaws.NewLambda(ctx.PulumiCtx(), "api", &anvilaws.LambdaArgs{
                Runtime: anvilaws.LambdaRuntime_Nodejs24_x,
                Handler: pulumi.String("functions/api/index.handler"),
            })
            if err != nil {
                return err
            }
            return nil
        },
    })
}

Permissions

A new function can only write its own logs. Give it access with the grant method on the resource it uses, such as uploads.grantRead(api), and let other compute invoke it with api.grantInvoke(other). For anything without a grant method, list the actions in permissions.

uploads.grantRead(api);  // api may read the uploads bucket
api.grantInvoke(worker); // worker may invoke api

uploads.grant_read(api)  # api may read the uploads bucket
api.grant_invoke(worker) # worker may invoke api

// Go has no grant methods yet: give the Lambda the same actions with permissions.
api, err := anvilaws.NewLambda(ctx.PulumiCtx(), "api", &anvilaws.LambdaArgs{
    Runtime: anvilaws.LambdaRuntime_Nodejs24_x,
    Handler: pulumi.String("functions/api/index.handler"),
    Permissions: anvilaws.LambdaPermissionArray{
        anvilaws.LambdaPermissionArgs{
            Actions:  pulumi.ToStringArray([]string{"s3:GetObject", "s3:ListBucket"}),
            Resource: uploads.Arn,
        },
    },
})
if err != nil {
    return err
}

What Anvil creates

An IAM role for the function with AWS's AWSLambdaBasicExecutionRole (AWSLambdaVPCAccessExecutionRole with vpc), so it can write logs. Nothing else until you grant it.
Each grant adds an inline policy on that role with only that grant's actions, on only that resource. Removing the grant removes the policy.
grantInvoke gives the other compute's role lambda:InvokeFunction on this function only.
With url: true, the function URL uses AWS_IAM auth, so only signed requests from principals allowed lambda:InvokeFunctionUrl can call it.

Good to know

Defaults: arm64 (Graviton), 1024 MB of memory, a 5-second timeout and 1-year log retention. Raise timeout for anything slower than a quick API call.
Omit handler to deploy a placeholder function before the code exists.
With vpc, the function's security group starts with no inbound or outbound rules. List what it needs to reach under vpc.vpcEndpoints or vpc.cidrs.
The Runtimes tab shows how Node.js and Rust handlers are written and built.

The Full example tab has a complete program. Every argument and attribute is on the Reference tab.