Lambda

# Package code
zip function.zip index.js

# Create function
aws lambda create-function \
  --function-name my-func \
  --runtime nodejs22.x \
  --role arn:aws:iam::123456789012:role/lambda-exec-role \
  --handler index.handler \
  --zip-file fileb://function.zip \
  --timeout 30 \
  --memory-size 256

# Update code only
aws lambda update-function-code \
  --function-name my-func \
  --zip-file fileb://function.zip

# Update config only
aws lambda update-function-configuration \
  --function-name my-func \
  --timeout 60 \
  --memory-size 512 \
  --environment "Variables={DB_URL=postgres://...,LOG_LEVEL=info}"

# Synchronous (default)
aws lambda invoke \
  --function-name my-func \
  --payload '{"key":"value"}' \
  --cli-binary-format raw-in-base64-out \
  response.json

cat response.json

# Async (fire-and-forget)
aws lambda invoke \
  --function-name my-func \
  --invocation-type Event \
  --payload '{}' \
  --cli-binary-format raw-in-base64-out \
  /dev/null

# Dry run (check perms only)
aws lambda invoke \
  --function-name my-func \
  --invocation-type DryRun \
  --payload '{}' \
  --cli-binary-format raw-in-base64-out \
  /dev/null

aws lambda list-functions \
  --query 'Functions[*].[FunctionName,Runtime,MemorySize,LastModified]' \
  --output table

aws lambda get-function --function-name my-func
aws lambda get-function-configuration --function-name my-func
aws lambda get-policy --function-name my-func    # resource-based policy

# Publish a version (immutable snapshot)
aws lambda publish-version --function-name my-func

# Create alias pointing at version 3
aws lambda create-alias \
  --function-name my-func \
  --name prod \
  --function-version 3

# Update alias (canary: 90% v3, 10% v4)
aws lambda update-alias \
  --function-name my-func \
  --name prod \
  --function-version 3 \
  --routing-config 'AdditionalVersionWeights={"4"=0.1}'

# Invoke via alias
aws lambda invoke \
  --function-name my-func:prod \
  --payload '{}' \
  --cli-binary-format raw-in-base64-out \
  out.json

# Publish a layer
aws lambda publish-layer-version \
  --layer-name my-deps \
  --zip-file fileb://layer.zip \
  --compatible-runtimes python3.12 nodejs22.x

# Attach layer to function
aws lambda update-function-configuration \
  --function-name my-func \
  --layers arn:aws:lambda:us-east-1:123:layer:my-deps:1

aws lambda list-layers
aws lambda list-layer-versions --layer-name my-deps

# SQS trigger
aws lambda create-event-source-mapping \
  --function-name my-func \
  --event-source-arn arn:aws:sqs:us-east-1:123:my-queue \
  --batch-size 10 \
  --maximum-batching-window-in-seconds 5

# DynamoDB Streams trigger
aws lambda create-event-source-mapping \
  --function-name my-func \
  --event-source-arn arn:aws:dynamodb:us-east-1:123:table/MyTable/stream/... \
  --starting-position LATEST \
  --batch-size 100

aws lambda list-event-source-mappings --function-name my-func

# Reserved concurrency (cap max parallel executions)
aws lambda put-function-concurrency \
  --function-name my-func \
  --reserved-concurrent-executions 100

# Provisioned concurrency (pre-warm for consistent cold starts)
aws lambda put-provisioned-concurrency-config \
  --function-name my-func \
  --qualifier prod \
  --provisioned-concurrent-executions 10

# Remove reserved concurrency
aws lambda delete-function-concurrency --function-name my-func

# Allow API Gateway to invoke
aws lambda add-permission \
  --function-name my-func \
  --statement-id apigw-invoke \
  --action lambda:InvokeFunction \
  --principal apigateway.amazonaws.com \
  --source-arn arn:aws:execute-api:us-east-1:123:abc123/*/GET/hello

# Allow another account
aws lambda add-permission \
  --function-name my-func \
  --statement-id cross-acct \
  --action lambda:InvokeFunction \
  --principal 987654321098

aws lambda remove-permission --function-name my-func --statement-id apigw-invoke

# Set environment variables
aws lambda update-function-configuration \
  --function-name my-func \
  --environment "Variables={STAGE=prod,DB_URL=postgres://...}"

# Encrypt with specific KMS key
aws lambda update-function-configuration \
  --function-name my-func \
  --kms-key-arn arn:aws:kms:us-east-1:123:key/abc

# VPC config (for RDS/ElastiCache access)
aws lambda update-function-configuration \
  --function-name my-func \
  --vpc-config SubnetIds=subnet-a,subnet-b,SecurityGroupIds=sg-0abc

# Tail logs in real time (AWS CLI v2)
aws logs tail /aws/lambda/my-func --follow

# Last 30 minutes
aws logs tail /aws/lambda/my-func --since 30m

# Filter for errors
aws logs filter-log-events \
  --log-group-name /aws/lambda/my-func \
  --filter-pattern "ERROR"

aws lambda delete-function --function-name my-func
# Delete a specific version
aws lambda delete-function --function-name my-func --qualifier 3