AWS Lambda

AWS LabsOfficialPublished by AWS Labs

Skill
Tool integration
Cloud and DevOps
Apache-2.0
Low risk

From the author

Design, build, deploy, test, and debug serverless applications with AWS Lambda. Triggers on phrases like: Lambda function, event source, serverless application, API Gateway, EventBridge, Step Functions, serverless API, event-driven architecture, Lambda trigger. For deploying non-serverless apps to AWS, use deploy-on-aws plugin instead.

— the description by AWS Labs

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides comprehensive support for developing serverless applications on AWS. It integrates with the AWS Serverless MCP Server to assist with project initialization, infrastructure-as-code (IaC) generation, deployment, and debugging. It covers event-driven architectures, web application deployment via Lambda Web Adapter, and performance optimization, while enforcing best practices for security, idempotency, and observability.

What it does

Initializes and builds serverless projects using SAM CLI or CDK.
Configures event source mappings for services like DynamoDB, SQS, and Kinesis.
Deploys full-stack web applications using the Lambda Web Adapter.
Implements event-driven architectures with EventBridge and schema management.
Provides troubleshooting guidance for common deployment and runtime errors.
Enforces security best practices including least-privilege IAM and secret management.

When to use it

When starting a new serverless project on AWS.
When configuring event-driven triggers for Lambda functions.
When deploying web APIs or full-stack applications to AWS Lambda.
When optimizing Lambda performance, cost, or cold-start times.
When debugging deployment failures or runtime errors in serverless stacks.

Advantages

Automated validation of IaC templates via SAM CLI integration.
Built-in support for AWS Lambda Powertools for logging and idempotency.
Clear guidance on choosing between choreography and orchestration patterns.
Comprehensive troubleshooting and limit references for rapid debugging.
Standardized project setup using industry-recognized frameworks.

Usage examples

“Create a new serverless API project using TypeScript and CDK.”: The agent will initialize a new project structure, generate the necessary CDK constructs for an API Gateway and Lambda function, and set up the project configuration.
“How do I configure my Lambda to process messages from an SQS queue?”: The agent will provide the configuration steps for an Event Source Mapping, including best practices for batch sizes and partial failure handling.
“My Lambda function is failing with a timeout error, how can I debug it?”: The agent will guide you through checking CloudWatch logs, reviewing memory settings, and potentially using X-Ray tracing to identify the bottleneck.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/awslabs/aws-lambda/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip aws-lambda.zip -d .agents/skills

Documentation by AWS Labs

AWS Lambda Serverless Development

Design, build, deploy, and debug serverless applications with AWS serverless services. This skill provides access to serverless development guidance through the AWS Serverless MCP Server, helping you to build production-ready serverless applications with best practices built-in.

Use SAM CLI for project initialization and deployment, Lambda Web Adapter for web applications, or Event Source Mappings for event-driven architectures. AWS handles infrastructure provisioning, scaling, and monitoring automatically.

Key capabilities:

SAM CLI Integration: Initialize, build, deploy, and test serverless applications
Web Application Deployment: Deploy full-stack applications with Lambda Web Adapter
Event Source Mappings: Configure Lambda triggers for DynamoDB, Kinesis, SQS, Kafka
Lambda durable functions: Resilient multi-step applications with checkpointing — see the durable-functions skill for guidance
Lambda Managed Instances: Run Lambda on dedicated EC2 instances with managed lifecycle — see the managed-instances skill for evaluation, configuration, and migration guidance
Schema Management: Type-safe EventBridge integration with schema registry
Observability: CloudWatch logs, metrics, and X-Ray tracing
Performance Optimization: Right-sizing, cost optimization, and troubleshooting

When to Load Reference Files

Load the appropriate reference file based on what the user is working on:

Getting started, what to build, project type decision, or working with existing projects -> see references/getting-started.md
SAM, CDK, deployment, IaC templates, CDK constructs, or CI/CD pipelines -> see the aws-serverless-deployment skill (separate skill in this plugin)
Web app deployment, Lambda Web Adapter, API endpoints, CORS, authentication, custom domains, or sam local start-api -> see references/web-app-deployment.md
Event sources, DynamoDB Streams, Kinesis, SQS, Kafka, S3 notifications, or SNS -> see references/event-sources.md
EventBridge, event bus, event patterns, event design, Pipes, or schema registry -> see references/event-driven-architecture.md
Durable functions, checkpointing, replay model, saga pattern, or long-running Lambda workflows -> see the durable-functions skill (separate skill in this plugin with full SDK reference, testing, and deployment guides)
Lambda Managed Instances, LMI, capacity providers, multi-concurrency, EC2-backed Lambda, cold start elimination, or Lambda cost optimization with Reserved Instances -> see the managed-instances skill (separate skill in this plugin for evaluation, configuration, and migration)
Orchestration, workflows, or Durable Functions vs Step Functions -> see references/orchestration-and-workflows.md
Step Functions, ASL, state machines, JSONata, Distributed Map, SDK integrations, TestState API, mocking service integrations, or state machine unit tests -> see the aws-step-functions skill for comprehensive guidance
Observability, logging, tracing, metrics, alarms, or dashboards -> see references/observability.md
Optimization, cold starts, memory tuning, cost, or streaming -> see references/optimization.md
Powertools, idempotency, feature flags, parameters, parser, batch processing, or data masking -> see references/powertools.md
Troubleshooting, errors, debugging, or deployment failures -> see references/troubleshooting.md

Best Practices

Project Setup

Do: Use sam_init or cdk init with an appropriate template for your use case
Do: Set global defaults for timeout, memory, runtime, and tracing (Globals in SAM, construct props in CDK)
Do: Use AWS Lambda Powertools for structured logging, tracing, metrics (EMF), idempotency, and batch processing — available for Python, TypeScript, Java, and .NET
Don't: Copy-paste templates from the internet without understanding the resource configuration
Don't: Use the same memory and timeout values for all functions regardless of workload

Security

Do: Follow least-privilege IAM policies scoped to specific resources and actions
Do: Use secure_esm_* tools to generate correct IAM policies for event source mappings
Do: Store secrets in AWS Secrets Manager or SSM Parameter Store, never in environment variables
Do: Use VPC endpoints instead of NAT Gateways for AWS service access when possible
Do: Enable Amazon GuardDuty Lambda Protection to monitor function network activity for threats (cryptocurrency mining, data exfiltration, C2 callbacks)
Don't: Use wildcard (*) resource ARNs or actions in IAM policies
Don't: Hardcode credentials or secrets in application code or templates
Don't: Store user data or sensitive information in module-level variables — execution environments can be reused across different callers

Idempotency

Do: Write idempotent function code — Lambda delivers events at least once, so duplicate invocations must be safe
Do: Use the AWS Lambda Powertools Idempotency utility (backed by DynamoDB) for critical operations
Do: Validate and deduplicate events at the start of the handler before performing side effects
Don't: Assume an event will only ever be processed once

For topic-specific best practices, see the dedicated guide files in the reference table above.

Lambda Limits Quick Reference

Limits that developers commonly hit:

Resource	Limit
Function timeout	900 seconds (15 minutes)
Memory	128 MB – 10,240 MB
1 vCPU equivalent	1,769 MB memory
Synchronous payload (request + response)	6 MB each
Async invocation payload	1 MB
Streamed response	200 MB
Deployment package (.zip, uncompressed)	250 MB
Deployment package (.zip upload, compressed)	50 MB
Container image	10 GB
Layers per function	5
Environment variables (aggregate)	4 KB
`/tmp` ephemeral storage	512 MB – 10,240 MB
Account concurrent executions (default)	1,000 (requestable increase)
Burst scaling rate	1,000 new executions per 10 seconds

Check Service Quotas for your account limits: aws lambda get-account-settings

Troubleshooting Quick Reference

Error	Cause	Solution
`Build Failed`	Missing dependencies	Run `sam_build` with `use_container: true`
`Stack is in ROLLBACK_COMPLETE`	Previous deploy failed	Delete stack with `aws cloudformation delete-stack`, redeploy
`IteratorAge` increasing	Stream consumer falling behind	Increase `ParallelizationFactor` and `BatchSize`. Use `esm_optimize`
EventBridge events silently dropped	No DLQ, retries exhausted	Add `RetryPolicy` + `DeadLetterConfig` to rule target
Step Functions failing silently	No retry on Task state	Add `Retry` with `Lambda.ServiceException`, `Lambda.AWSLambdaException`
Durable Function not resuming	Missing IAM permissions	Add `lambda:CheckpointDurableExecution` and `lambda:GetDurableExecutionState` — see durable-functions skill

For detailed troubleshooting, see references/troubleshooting.md.

Configuration

AWS CLI Setup

This skill requires that AWS credentials are configured on the host machine:

Verify access: Run aws sts get-caller-identity to confirm credentials are valid

SAM CLI Setup

Install SAM CLI: Follow the SAM CLI installation guide
Verify: Run sam --version

Container Runtime Setup

Install a Docker compatible container runtime: Required for sam_local_invoke and container-based builds
Verify: Use an appropriate command such as docker --version or finch --version

MCP Server Configuration

Write access is enabled by default. The plugin ships with --allow-write in .mcp.json, so the MCP server can create projects, generate IaC, and deploy on behalf of the user.

Access to sensitive data (like Lambda and API Gateway logs) is not enabled by default. To grant it, add --allow-sensitive-data-access to .mcp.json.

SAM Template Validation Hook

This plugin includes a PostToolUse hook that runs sam validate automatically after any edit to template.yaml or template.yml. If validation fails, the error is returned as a system message so you can fix it immediately. The hook requires SAM CLI and jq to be installed; if either is missing, validation is skipped with a system message. Users can disable it via /hooks.

Verify: Run jq --version

Language selection

Default: TypeScript

Override syntax:

"use Python" → Generate Python code
"use JavaScript" → Generate JavaScript code

When not specified, ALWAYS use TypeScript

IaC framework selection

Default: CDK

Override syntax:

"use CloudFormation" → Generate YAML templates
"use SAM" → Generate YAML templates

When not specified, ALWAYS use CDK

Serverless MCP Server Unavailable

Inform user: "AWS Serverless MCP not responding"
Ask: "Proceed without MCP support?"
DO NOT continue without user confirmation

Resources

Files

ATTRIBUTION.mdAdded by AutoGineer906 B
LICENSELicence file added by AutoGineer9.9 KiB
NOTICELicence file added by AutoGineer89 B
SKILL.md12.1 KiB
references/event-driven-architecture.md15.6 KiB
references/event-sources.md16.3 KiB
references/getting-started.md6.0 KiB
references/observability.md22.7 KiB
references/optimization.md14.5 KiB
references/orchestration-and-workflows.md6.2 KiB
references/powertools.md10.2 KiB
references/troubleshooting.md11.3 KiB
references/web-app-deployment.md10.6 KiB

references/powertools.md

AWS Lambda Powertools

Lambda Powertools is the recommended library for implementing observability and reliability patterns with minimal boilerplate. It is available for Python, TypeScript, Java, and .NET.

Install:

Runtime	Command
Python	`pip install aws-lambda-powertools`
TypeScript	`npm i @aws-lambda-powertools/logger @aws-lambda-powertools/tracer @aws-lambda-powertools/metrics`
Java	Add `software.amazon.lambda:powertools-tracing`, `powertools-logging`, `powertools-metrics` to Maven/Gradle
.NET	`dotnet add package AWS.Lambda.Powertools.Logging` (plus `.Tracing`, `.Metrics`)

SAM init templates:

Python: sam init --app-template hello-world-powertools-python
TypeScript: sam init --app-template hello-world-powertools-typescript

Core utilities:

Utility	What it does
Logger	Structured JSON logging with Lambda context automatically injected
Tracer	X-Ray tracing with decorators; traces handler + downstream calls
Metrics	Custom CloudWatch metrics via Embedded Metric Format (EMF) — async, no API call overhead
Idempotency	Prevent duplicate execution using DynamoDB as idempotency store
Batch	Partial batch failure handling for SQS, Kinesis, DynamoDB Streams
Parameters	Cached retrieval from SSM Parameter Store, Secrets Manager, AppConfig
Parser	Event validation with typed models — Python uses Pydantic, TypeScript uses Zod
Feature Flags	Rule-based feature toggles backed by AppConfig
Event Handler	Route REST/HTTP API, GraphQL, and Bedrock Agent events with decorators (Python, TS, Java, .NET)
Kafka Consumer	Deserialize Kafka events (Avro, Protobuf, JSON Schema) for MSK and self-managed Kafka (Python, TS, Java, .NET)
Data Masking	Redact or encrypt sensitive fields for compliance (Python, TS)
Event Source Data Classes	Typed data classes for all Lambda event sources (Python)

Use Embedded Metric Format (EMF) for custom metrics — zero latency overhead and no extra API cost. See observability.md for setup and code examples.

Parameters caching reduces cold start impact from secrets retrieval. The Parameters utility caches values for a configurable TTL (default 5 seconds), avoiding an API call on every invocation.

Key environment variables:

Variable	Purpose
`POWERTOOLS_PARAMETERS_MAX_AGE`	Cache TTL in seconds for Parameters utility (default: 5)

For observability environment variables (POWERTOOLS_SERVICE_NAME, POWERTOOLS_LOG_LEVEL, POWERTOOLS_METRICS_NAMESPACE, POWERTOOLS_DEV), see observability.md.

Parser validation: Python uses Pydantic models; TypeScript uses Zod schemas. Both provide compile-time type safety and runtime validation for Lambda event payloads.

Structured Logging

For structured logging best practices, Logger setup (Python and TypeScript), log level strategy, and Logs Insights queries, see observability.md.

Deep Dives

Feature Flags

Use Feature Flags for runtime configuration changes without redeployment — percentage rollouts, user-targeted flags, and kill switches. The backend is AWS AppConfig, which supports deployment strategies (linear, canary, all-at-once) with automatic rollback.

Python:

from aws_lambda_powertools.utilities.feature_flags import AppConfigStore, FeatureFlags

app_config = AppConfigStore(environment="prod", application="my-app", name="features")
feature_flags = FeatureFlags(store=app_config)

def handler(event, context):
    # Boolean flag with default
    dark_mode = feature_flags.evaluate(name="dark_mode", default=False)

    # Rules-based flag (percentage rollout, user targeting)
    new_checkout = feature_flags.evaluate(
        name="new_checkout",
        context={"username": event["requestContext"]["authorizer"]["claims"]["sub"]},
        default=False,
    )

TypeScript:

import { AppConfigProvider } from '@aws-lambda-powertools/parameters/appconfig';
import { FeatureFlags } from '@aws-lambda-powertools/parameters/feature-flags';

const provider = new AppConfigProvider({
  environment: 'prod',
  application: 'my-app',
  name: 'features',
});
const featureFlags = new FeatureFlags({ provider });

export const handler = async (event: any) => {
  const darkMode = await featureFlags.evaluate('dark_mode', false);
  const newCheckout = await featureFlags.evaluate('new_checkout', false, {
    username: event.requestContext.authorizer.claims.sub,
  });
};

Parameters

The Parameters utility provides cached retrieval from SSM Parameter Store, Secrets Manager, and AppConfig with a configurable TTL.

Default TTL: 5 seconds. Override globally with the POWERTOOLS_PARAMETERS_MAX_AGE environment variable (in seconds) or per-call with max_age.

Python:

from aws_lambda_powertools.utilities.parameters import get_parameter, get_secret

# Cached for 300 seconds
db_host = get_parameter("/my-app/prod/db-host", max_age=300)

# Secrets Manager — decrypted and cached
db_password = get_secret("my-app/prod/db-password", max_age=300)

TypeScript:

import { getParameter } from '@aws-lambda-powertools/parameters/ssm';
import { getSecret } from '@aws-lambda-powertools/parameters/secrets';

const dbHost = await getParameter('/my-app/prod/db-host', { maxAge: 300 });
const dbPassword = await getSecret('my-app/prod/db-password', { maxAge: 300 });

Parser (Input Validation)

Validate event payloads at the system boundary using typed schemas. Catches malformed input before your business logic runs.

Python (Pydantic):

from pydantic import BaseModel, field_validator
from aws_lambda_powertools.utilities.parser import event_parser
from aws_lambda_powertools.utilities.parser.envelopes import ApiGatewayEnvelope

class OrderRequest(BaseModel):
    order_id: str
    amount: float
    currency: str = "USD"

    @field_validator("amount")
    def amount_must_be_positive(cls, v):
        if v <= 0:
            raise ValueError("amount must be positive")
        return v

@event_parser(model=OrderRequest, envelope=ApiGatewayEnvelope)
def handler(event: OrderRequest, context):
    # event is already validated and typed
    return {"statusCode": 200, "body": f"Order {event.order_id}: {event.amount} {event.currency}"}

TypeScript (Zod):

import { z } from 'zod';
import { APIGatewayProxyEvent, APIGatewayProxyResult, Context } from 'aws-lambda';

const OrderRequest = z.object({
  orderId: z.string(),
  amount: z.number().positive(),
  currency: z.string().default('USD'),
});

type OrderRequest = z.infer<typeof OrderRequest>;

export const handler = async (event: APIGatewayProxyEvent): Promise<APIGatewayProxyResult> => {
  const parsed = OrderRequest.safeParse(JSON.parse(event.body ?? '{}'));
  if (!parsed.success) {
    return { statusCode: 400, body: JSON.stringify({ errors: parsed.error.issues }) };
  }
  const order = parsed.data;
  return { statusCode: 200, body: JSON.stringify({ orderId: order.orderId }) };
};

Environment Variable Validation

Validate required environment variables at module load time (outside the handler) so misconfigured functions fail immediately on cold start rather than producing cryptic errors mid-invocation.

Python (Pydantic):

import os
from pydantic import BaseModel

class Config(BaseModel):
    table_name: str
    event_bus_arn: str
    log_level: str = "INFO"

# Validated once at module load — fails fast if TABLE_NAME or EVENT_BUS_ARN is missing
config = Config(
    table_name=os.environ["TABLE_NAME"],
    event_bus_arn=os.environ["EVENT_BUS_ARN"],
    log_level=os.environ.get("LOG_LEVEL", "INFO"),
)

TypeScript (Zod):

import { z } from 'zod';

const Config = z.object({
  TABLE_NAME: z.string(),
  EVENT_BUS_ARN: z.string(),
  LOG_LEVEL: z.string().default('INFO'),
});

// Validated once at module load
const config = Config.parse(process.env);

This pattern catches missing or malformed configuration at deploy time (via smoke tests) or immediately on first invocation, rather than on the specific code path that uses the variable.

Streaming (Python)

For processing S3 objects larger than available Lambda memory, use the Powertools Streaming utility. It provides a stream-like interface that reads data in chunks without loading the entire object into memory.

from aws_lambda_powertools.utilities.streaming import S3Object

def handler(event, context):
    bucket = event["Records"][0]["s3"]["bucket"]["name"]
    key = event["Records"][0]["s3"]["object"]["key"]

    s3_object = S3Object(bucket=bucket, key=key)
    for line in s3_object:
        process_line(line)

This is particularly useful for CSV/JSON-lines processing, log analysis, and any workload where the input file exceeds the function's memory allocation.

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter, Needs an MCP server

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

AWS Labs

Publisher

AWS Labs (Official)

Source

awslabs/agent-plugins · plugins/aws-serverless/skills/aws-lambda · commit fbefb37

Licence

Apache License 2.0 (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
NOTICE (added by AutoGineer from NOTICE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by AWS Labs or AWS Labs.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-lambda.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by AWS Labs

AWS Lambda Serverless Development

When to Load Reference Files

Best Practices

Project Setup

Security

Idempotency

Lambda Limits Quick Reference

Troubleshooting Quick Reference

Configuration

AWS CLI Setup

SAM CLI Setup

Container Runtime Setup

MCP Server Configuration

SAM Template Validation Hook

Language selection

IaC framework selection

Serverless MCP Server Unavailable

Resources

Files

references/powertools.md

AWS Lambda Powertools

Structured Logging

Deep Dives

Feature Flags

Parameters

Parser (Input Validation)

Environment Variable Validation

Streaming (Python)

Requirements and compatibility

Security

Attribution and licence

Related skills

Modal

Cloud Infrastructure Network Engineer

Deployment Validation Cloud Architect

Airflow Dag Patterns

Cost Optimization

Hybrid Cloud Networking

Download ZIP