aws-serverless-patterns

AWS Serverless Patterns

When uncertain about an AWS API parameter, IAM action, or service quota, resolve and call the AWS docs-search tool (search_documentation) from the aws-mcp-server MCP server — see steering/aws-agent-toolkit.md → "Resolving the correct tool name" if the literal tool name doesn't resolve on first try. If unsure which MCP tool covers your task, see skills/mcp-tool-discovery/SKILL.md for the discovery flow.

Lambda Function Template

from aws_lambda_powertools import Logger, Tracer, Metrics
from aws_lambda_powertools.utilities.typing import LambdaContext

logger = Logger()
tracer = Tracer()
metrics = Metrics()

@logger.inject_lambda_context
@tracer.capture_lambda_handler
@metrics.log_metrics
def lambda_handler(event: dict, context: LambdaContext) -> dict:
    logger.info("Processing request", extra={"request_id": context.aws_request_id})
    metrics.add_metric(name="RequestProcessed", unit="Count", value=1)
    return {"statusCode": 200, "body": json.dumps({"status": "success"})}

CDK Lambda Pattern

from aws_cdk.aws_lambda_python_alpha import PythonFunction
from aws_cdk.aws_lambda import Runtime, Tracing

PythonFunction(self, 'MyFunction',
    runtime=Runtime.PYTHON_3_14,
    entry='cdk-backend/lambda/functions/my_function',
    index='my_function.py',
    tracing=Tracing.ACTIVE,
    memory_size=512,
    timeout=Duration.seconds(30),
)

DynamoDB Single-Table Pattern

• PK: ENTITY#id (e.g., USER#123, ORDER#456)
• SK: METADATA for base item, RELATION#id for relationships
• GSI1PK/GSI1SK for secondary access patterns
• Always use on-demand billing for variable workloads
• Enable point-in-time recovery

API Gateway Pattern

• REST API with Cognito authorizer
• Request validation models at gateway level
• Defense in depth: validate again in Lambda with pydantic
• CORS: explicit origins, never * in production
• Set CORS headers on every Lambda response, not just the OPTIONS preflight — if the frontend calls the API cross-origin (no CloudFront routing to API Gateway), a real 4xx/5xx from application code still needs Access-Control-Allow-Origin etc. on it or the browser reports it as a CORS failure regardless of the actual status code.
• A Lambda that throws during cold start (missing import, bad env var, etc.) returns a headerless 502 with no CORS headers at all — this looks exactly like a CORS error in the browser console but isn't one. If a request that used to work suddenly "fails with CORS" after a deploy, check CloudWatch logs for the function first (Runtime.ImportModuleError, unhandled exception in module-scope code) before touching CORS configuration — CORS headers can't be attached to a response the runtime never got a chance to send.