Development with AWS Services · Topic 4 of 7

Lambda Configuration, VPC Access, and Error Handling

Set Lambda memory, timeout, concurrency, layers and variables, reach private VPC resources, and handle failures with destinations and dead letter queues.

5 min
Includes a diagram

In a nutshell

Memory runs 128 MB to 10,240 MB and CPU follows it; the maximum timeout is 900 seconds.
Environment variables total 4 KB. A function can use up to 5 layers.
Reserved concurrency guarantees and caps; provisioned concurrency removes cold starts.

What it is

A Lambda function runs your code in an execution environment that AWS creates from your configuration. Memory, timeout, runtime, handler and concurrency settings decide how it behaves and what it can do.

By default a function runs outside your VPC. To reach a private database or cache, you attach the function to subnets in your VPC.

How a failure is handled depends on how the function was invoked. You configure retries, dead letter queues and destinations to keep failed events.

How it works

Core settings

Setting	What to know
Memory	128 MB to 10,240 MB. CPU scales with memory, so more memory can also mean faster code
Timeout	Default is 3 seconds. The maximum is 900 seconds (15 minutes)
Runtime and handler	The runtime is the language version. The handler names the entry point, such as `app.lambda_handler`
Environment variables	Key value pairs, 4 KB in total, encrypted at rest. Good for table names, not for secrets
Layers	Up to 5 layers, extracted under `/opt`, for shared libraries or a custom runtime
Package size	250 MB unzipped including layers; a container image can be up to 10 GB
`/tmp` storage	512 MB by default, up to 10,240 MB

aws lambda update-function-configuration \
  --function-name orders \
  --memory-size 1024 --timeout 30 \
  --environment "Variables={TABLE_NAME=Orders}"

Extensions are companion processes that run next to your function, packaged as layers or in the container image. Monitoring and security tools use them to collect data without code changes.

Put expensive setup, such as SDK clients, outside the handler so warm invocations reuse it.

Concurrency

The account default is 1,000 concurrent executions per Region, shared by all functions.

Reserved concurrency sets aside a share for one function and also caps it. A value of zero stops the function.
Provisioned concurrency keeps execution environments initialized, which removes cold start delay for predictable traffic.

Reaching private resources in a VPC

Add a VPC configuration with subnet IDs and security group IDs. Lambda then creates network interfaces in those subnets.

The execution role needs permission to manage network interfaces. The managed policy AWSLambdaVPCAccessExecutionRole provides it.
The function's security group controls outbound traffic. The database security group must allow inbound traffic from the function's security group.
A VPC attached function loses default internet access. A function in a public subnet does not get a public IP, so it still cannot reach the internet.
To call the internet, place the function in private subnets with a route to a NAT gateway. To call S3, DynamoDB or other AWS services privately, use VPC endpoints: gateway endpoints for S3 and DynamoDB, interface endpoints for most others.

Handling errors and event lifecycles

Async error handling: the event waits in Lambda's queue (maximum event age default 6 hours), the function retries up to 2 times on error, then success goes to an on success destination and failure to an on failure destination with error details, or to a dead letter queue with the payload only. The invocation type decides what happens on failure.

Invocation	What happens on error
Synchronous	The error returns to the caller, who must retry
Asynchronous	Lambda retries twice by default (you can set 0 to 2) and drops events older than the maximum event age, which defaults to 6 hours
SQS mapping	The message returns to the queue after the visibility timeout, then moves to the queue's DLQ after the redrive limit
Stream mapping	The batch is retried until it succeeds or expires; an on failure destination keeps discarded records

For asynchronous invocations you can keep failed events in two ways.

A dead letter queue is an SQS standard queue or SNS standard topic set on the function. It receives only the event payload.
A destination is the newer option. You configure one for on success and one for on failure. Targets include SQS, SNS, another Lambda function, EventBridge and (on failure only) S3. The record also contains the error and response details.

Destinations do not apply to synchronous calls. The execution role needs permission to send to the target, such as sqs:SendMessage.

How the exam asks about this

"A function must query an RDS database in private subnets." -> Add a VPC configuration with subnets and a security group, and allow the function's group on the database.
"After joining a VPC, the function cannot reach DynamoDB." -> Add a gateway VPC endpoint, or private subnets with a NAT gateway.
"Failed asynchronous events must be kept with the error details." -> An on failure destination, such as SQS.

What to remember for the exam

Memory runs 128 MB to 10,240 MB and CPU follows it; the maximum timeout is 900 seconds.
Environment variables total 4 KB. A function can use up to 5 layers.
Reserved concurrency guarantees and caps; provisioned concurrency removes cold starts.
A VPC function needs subnets, security groups and the VPC access execution role.
Internet access from a VPC needs private subnets plus a NAT gateway; AWS services can use VPC endpoints.
Asynchronous invocation retries twice by default, then uses the DLQ or on failure destination.
Destinations are preferred over DLQs and carry more detail, but only cover asynchronous calls and stream mappings.

Watch out

For an SQS trigger, put the DLQ on the source queue, not on the function. A function level DLQ is used only for asynchronous invocations.

Common mistakes

Putting a function in a public subnet for internet access. Lambda network interfaces never get public IP addresses, so use a NAT gateway or endpoints.

Setting the timeout above what callers allow. A function timeout of 900 seconds does not help behind API Gateway, which times out at 29 seconds by default.

Expecting destinations on synchronous calls. The caller gets the error and must handle it.

Check yourself

How do you remove cold start delay for steady traffic?
Configure provisioned concurrency, which keeps execution environments initialized.
What does a VPC attached function need to call DynamoDB privately?
A gateway VPC endpoint for DynamoDB, with a route from the function's subnets.
How many times does Lambda retry a failed asynchronous invocation by default?
Twice, after which the event goes to the configured DLQ or on failure destination.

Topic 4 of 7 in Development with AWS Services

Test yourself on Development with AWS Services

The full AWS DVA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.

Get Full Access Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.