Lambda

A Lambda function whose role can only write logs until you grant more. Graviton, one-year log retention and IAM-only function URLs by default.

Compute · anvil:aws:Lambda

Arguments

Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).

runtime required
string

The Lambda runtime.

  • nodejs24.x— Node.js 24 (LTS) — recommended
  • nodejs22.x— Node.js 22 (LTS)
  • rust— Rust, built with cargo-lambda and run on provided.al2023. See the Runtimes tab.
handler
string

Where the function's code is, relative to the project root. Node: the file without its extension plus the export, e.g. "functions/api/index.handler" for export const handler in functions/api/index.ts; omit to deploy a blank placeholder. Rust (required): a Cargo package directory or a .rs file, e.g. "functions/api".

architecture
string

CPU architecture. Default: arm64 (Graviton).

  • arm64— Graviton — 20% cheaper, better performance. Default.
  • x86_64— Intel/AMD — use for x86-specific native dependencies.
memory
integer

Memory in MB. Valid: 128 to 32768 in 1MB increments. Default: 1024.

timeout
integer

Timeout in seconds. Valid: 1 to 900. Default: 5.

environment
map<string, string>

Environment variables available to the function at runtime. Supports plain strings and Pulumi outputs.

encryption
string

Upgrade environment variable encryption to SSE-KMS. Set to "kms" to enable. Incurs KMS API call cost. Required by HIPAA, PCI-DSS, FedRAMP. Supply a KMS key ARN via hatch.

logRetention
string

CloudWatch log group retention period. Default: "1y" (satisfies SOC 2, ISO 27001, PCI-DSS baseline).

  • 7d— 7 days
  • 30d— 30 days (1 month)
  • 90d— 90 days (3 months)
  • 1y— 1 year — SOC 2 / ISO 27001 / PCI-DSS baseline. Default.
  • 3y— 3 years — FedRAMP minimum
  • 6y— 6 years — HIPAA minimum
  • 7y— 7 years — IRAP minimum
tracing
boolean

Enable AWS X-Ray tracing. Incurs per-trace cost (~$5/million traces). Default: false.

url
boolean

Enable a direct HTTPS endpoint for the function. Auth mode is AWS_IAM — never public. Default: false.

vpc
object (LambdaVpcArgs)

Places the Lambda inside a VPC for access to private resources such as RDS or ElastiCache. Anvil creates a dedicated security group with zero inbound and zero outbound rules — nothing is reachable until explicitly granted.

permissions
array

Inline IAM permissions added to the execution role. Use for ad-hoc access not covered by the grant system.

permissions[] 3 fields
actions
array<string>
path
string
resource
string

ARN of the resource to grant access to. Accepts plain strings and Pulumi outputs.

vpc 5 fields
privateSubnetIds required
array<string>

The IDs of the private subnets to attach the Lambda to. Always private - Lambda must never be placed in public subnets. Accepts Output<string[]> - pass vpc.privateSubnetIds directly.

vpcId required
string

The ID of the VPC to place the Lambda in. Accepts Output<string> - pass vpc.vpcId directly.

cidrs
array (LambdaVpcCidrArgs)

CIDR-scoped egress rules. One SG rule per port per CIDR. Use for peered VPCs or on-premise ranges.

hasNat
boolean

Only needed for imported VPCs with NAT. Omit when using an Anvil Vpc component.

vpcEndpoints
array (LambdaVpcEndpointArgs)

VPC endpoints this Lambda needs access to. Anvil wires both SG rules automatically.

vpc.cidrs[] 2 fields
ports required
array<integer>

TCP ports to allow. Required - be explicit.

range required
string

IPv4 CIDR block, e.g. 10.0.0.0/8

vpc.vpcEndpoints[] 2 fields

A VPC endpoint to grant this Lambda access to. Both fields accept Output<string> - pass component outputs directly.

endpointId required
string

The endpoint's ID. Use ep.endpointId. Accepts Output<string>.

securityGroupId required
string

The endpoint's security group ID. Use ep.securityGroupId. Accepts Output<string>.

This component also accepts a hatch argument to override the underlying resource configuration. See Overrides & Escape Hatch.

Attributes

Outputs available once the resource is deployed.

arn
string

The ARN of the Lambda function.

functionName
string

The physical name of the Lambda function.

functionUrl
string

The HTTPS endpoint URL when url: true. Empty string otherwise.

roleArn
string

The ARN of the Lambda's IAM execution role.

securityGroupId
string

The ID of the dedicated security group created for this Lambda. Only populated when vpc is set.