aws-lambda

AWS Lambda + .NET Gotchas

VPC Networking

• ENIs are shared since the Hyperplane rework (2019) — one ENI per subnet + security-group combo, created when the function is created or its VPC config changes, NOT per concurrent execution. Scale-up does not consume a subnet IP per instance, so subnet IP exhaustion from Lambda scaling is largely a pre-2019 concern.
• ENI provisioning takes up to ~90s at function create / VPC-config change; the function reports LastUpdateStatus: InProgress until done. (The old per-invoke ENI cold-start penalty is gone.)
• S3/Secrets Manager calls timeout silently (not connection refused) when Lambda is in VPC without NAT/VPC Endpoint. Easy to misdiagnose as SDK bug.

Logging

• Console.Error.WriteLine() IS captured by CloudWatch on the managed .NET runtime (Lambda redirects the process's stdout/stderr) — but entries lack the request-id prefix and multi-line output splits into separate events. Output genuinely disappears only in narrower cases: writes during a crashed INIT (process torn down before flush) or a custom-runtime bootstrap that doesn't forward stderr. Prefer ILambdaContext.Logger.LogLine() in handler code or ILogger in the ASP.NET pipeline.
• Missing logs:CreateLogGroup permission = logs silently lost. Log group created lazily on first invoke. No permission = no log group = nowhere to write = no error visible anywhere.

ASP.NET Core in Lambda

• UseHttpsRedirection() hangs Lambda. No Kestrel HTTPS port. Middleware hangs trying to discover one (aws-lambda-dotnet #1543; discussion #1424 reports the same shape — handler completes but the response never reaches the runtime — as warm-invoke middleware timeouts on a custom runtime). Only enable in Development.
• Response > 6MB fails the invoke — no clean HTTP 413. 6MB is the synchronous INVOKE-phase request/response payload limit (nothing to do with INIT). APIGatewayHttpApiV2ProxyFunction surfaces it as a runtime-client error for that invocation, so the caller sees a generic 500-style failure instead of a 413.