cloud-native-aws-serverless

AWS Lambda Internals and Function Design

Purpose

Explain what actually happens when a Lambda function is invoked — Firecracker microVM isolation, the execution environment lifecycle, and the concurrency model — so that function code, timeouts, memory, and event-source settings are chosen from mechanics rather than folklore.

Agent Protocol

Trigger

"aws lambda internals", "firecracker", "lambda execution environment", "lambda concurrency", "event source mapping", "lambda function url", "lambda layers", "reserved concurrency", "lambda timeout".

Input Context

• Runtime and package type (ZIP managed runtime, container image, custom runtime).
• Invocation source (API Gateway, Function URL, SQS, Kinesis/DynamoDB Streams, EventBridge, S3).
• Traffic shape (steady, bursty), latency SLO, downstream limits (DB connections, third-party rate limits).

Output Artifact

Function configuration (IaC snippet) plus handler structure. No file unless requested.

Response Format

Invocation model: {sync|async|poll-based (ESM)}
Memory / timeout: {MB} / {s}  (why)
Concurrency: {unreserved|reserved=N|provisioned=N}
Retries / failure destination: {...}
Handler notes: {init vs handler work}

Completion Criteria

• Invocation model identified and retry semantics stated.
• Timeout set below the caller's timeout (API Gateway integration timeout defaults to 29 s).
• Concurrency protects downstream dependencies.
• Failure path defined (DLQ, on-failure destination, or partial batch response).

How an Invocation Runs

1. Firecracker microVM. Lambda runs each execution environment inside a Firecracker microVM on KVM. Firecracker exposes a minimal device model (virtio-net, virtio-block, serial console, keyboard for reset) and is documented to boot in about 125 ms with under 5 MiB memory overhead per microVM. Isolation boundary = the VM, not a container.
2. Execution environment lifecycle (Lambda Runtime API phases):
   • INIT — download code/layers, start runtime, run extensions' init, run your module-level code. Limited to 10 s for on-demand functions; if it exceeds, init is retried inside the first invoke.
   • INVOKE — handler runs; one environment processes one request at a time.
   • SHUTDOWN — environment reclaimed after idle; the phase lasts 0 ms with no extensions, 500 ms with internal extensions, 2,000 ms with external extensions.
3. Reuse. A warm environment is reused for later invocations; globals, /tmp (512 MB default, configurable up to 10,240 MB), and open sockets survive. Never rely on reuse for correctness.