AWS CloudFormation Lambda - Reference

AWS CloudFormation Lambda - Reference

This reference guide contains detailed information about AWS CloudFormation resources, intrinsic functions, and configurations for Lambda serverless infrastructure.

AWS::Lambda::Function

Creates a Lambda function.

Properties

Code Structure

Code:
  S3Bucket: !Ref CodeBucket
  S3Key: lambda/function.zip
  S3ObjectVersion: version-id

# Or for inline code
ZipFile: |
  def handler(event, context):
      return {"statusCode": 200, "body": "Hello"}

Example

Resources:
  MyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-processor"
      Runtime: python3.11
      Handler: index.handler
      Code:
        S3Bucket: !Ref CodeBucket
        S3Key: lambda/function.zip
      MemorySize: 256
      Timeout: 60
      Role: !GetAtt LambdaExecutionRole.Arn
      Environment:
        Variables:
          ENVIRONMENT: !Ref Environment
          LOG_LEVEL: INFO
      Tags:
        - Key: Environment
          Value: !Ref Environment

Attributes

AWS::Lambda::LayerVersion

Creates a Lambda layer.

Properties

Example

Resources:
  CommonLibraryLayer:
    Type: AWS::Lambda::LayerVersion
    Properties:
      LayerName: !Sub "${AWS::StackName}-common-lib"
      Description: Common utilities for Lambda functions
      Content:
        S3Bucket: !Ref LayersBucket
        S3Key: layers/common-lib.zip
      CompatibleRuntimes:
        - python3.9
        - python3.10
        - python3.11
      CompatibleArchitectures:
        - x86_64
        - arm64

Attributes

AWS::Lambda::EventSourceMapping

Creates an event source mapping between an event source and a Lambda function.

Properties

Example

Resources:
  EventSourceMapping:
    Type: AWS::Lambda::EventSourceMapping
    Properties:
      FunctionName: !Ref MyLambdaFunction
      EventSourceArn: !GetAtt Queue.Arn
      BatchSize: 10
      MaximumBatchingWindowInSeconds: 60
      MaximumRecordAgeInSeconds: 604800
      MaximumRetryAttempts: 3
      Enabled: true

AWS::Lambda::Permission

Grants an AWS service or another account permission to use a function.

Properties

Example

Resources:
  LambdaPermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref MyLambdaFunction
      Action: lambda:InvokeFunction
      Principal: apigateway.amazonaws.com
      SourceArn: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyLambdaFunction.Arn}/invocations"

AWS::Lambda::ProvisionedConcurrencyConfig

Configures provisioned concurrency for a Lambda function alias or version.

Properties

Example

Resources:
  ProvisionedConcurrencyConfig:
    Type: AWS::Lambda::ProvisionedConcurrencyConfig
    Properties:
      FunctionName: !Ref MyLambdaFunction
      ProvisionedConcurrentExecutions: 5
      Qualifier: $LATEST
      ProvisionedExecutionTarget:
        AllocationStrategy: PRICE_OPTIMIZED

AWS::Lambda::EventInvokeConfig

Configures options for asynchronous invocation on a Lambda function.

Properties

Example

Resources:
  EventInvokeConfig:
    Type: AWS::Lambda::EventInvokeConfig
    Properties:
      FunctionName: !Ref MyLambdaFunction
      MaximumEventAgeInSeconds: 3600
      MaximumRetryAttempts: 2
      DestinationConfig:
        OnSuccess:
          Destination: !Ref SuccessQueue
        OnFailure:
          Destination: !Ref DeadLetterQueue

AWS::Lambda::Url

Creates a function URL for a Lambda function.

Properties

Example

Resources:
  LambdaFunctionUrl:
    Type: AWS::Lambda::Url
    Properties:
      AuthType: AWS_IAM
      TargetFunctionArn: !GetAtt MyLambdaFunction.Arn
      Cors:
        AllowCredentials: true
        AllowHeaders:
          - "*"
        AllowMethods:
          - GET
          - POST
        AllowOrigins:
          - "*"
        MaxAge: 86400

Attributes

AWS::Serverless::Function

Creates a Lambda function with SAM simplifications.

Properties

Example

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub "${AWS::StackName}-api"
      CodeUri: lambda_function/
      Handler: app.handler
      Runtime: python3.11
      MemorySize: 512
      Timeout: 30
      Policies:
        - S3ReadPolicy:
            BucketName: !Ref DataBucket
        - DynamoDBReadPolicy:
            TableName: !Ref DataTable
      Environment:
        Variables:
          LOG_LEVEL: INFO
      Events:
        Api:
          Type: Api
          Properties:
            Path: /items
            Method: get
        SqsQueue:
          Type: SQS
          Properties:
            Queue: !GetAtt Queue.Arn
            BatchSize: 10
      AutoPublishAlias: !Ref Environment

AWS::Serverless::LayerVersion

Creates a Lambda layer with SAM simplifications.

Properties

Example

Resources:
  DependenciesLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: !Sub "${AWS::StackName}-dependencies"
      Description: Python dependencies
      ContentUri: layers/dependencies.zip
      CompatibleRuntimes:
        - python3.11
      RetentionPolicy: Retain

AWS::ApiGateway::RestApi

Creates a REST API in API Gateway.

Properties

Example

Resources:
  ApiGatewayRestApi:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub "${AWS::StackName}-api"
      Description: REST API for Lambda backend
      EndpointConfiguration:
        Types:
          - REGIONAL
      MinimumCompressionSize: 1024

AWS::ApiGatewayV2::Api

Creates an HTTP API in API Gateway V2.

Properties

Example

Resources:
  HttpApi:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: !Sub "${AWS::StackName}-http-api"
      ProtocolType: HTTP
      CorsConfiguration:
        AllowOrigins:
          - "*"
        AllowMethods:
          - GET
          - POST
          - PUT
          - DELETE

AWS::StepFunctions::StateMachine

Creates a Step Functions state machine.

Properties

State Types Reference

Example

Resources:
  ProcessingStateMachine:
    Type: AWS::StepFunctions::StateMachine
    Properties:
      StateMachineName: !Sub "${AWS::StackName}-processor"
      StateMachineType: STANDARD
      DefinitionString: !Sub |
        {
          "Comment": "Item processing workflow",
          "StartAt": "ValidateItem",
          "States": {
            "ValidateItem": {
              "Type": "Task",
              "Resource": "${ValidateItemFunction.Arn}",
              "Next": "ProcessItem"
            },
            "ProcessItem": {
              "Type": "Task",
              "Resource": "${ProcessItemFunction.Arn}",
              "End": true
            }
          }
        }
      RoleArn: !GetAtt StepFunctionsExecutionRole.Arn
      LoggingConfiguration:
        Level: ALL
        IncludeExecutionData: true

AWS::SQS::Queue

Creates an SQS queue.

Properties

Example

Resources:
  ProcessingQueue:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: !Sub "${AWS::StackName}-queue"
      VisibilityTimeout: 300
      MessageRetentionPeriod: 86400
      RedrivePolicy:
        deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn
        maxReceiveCount: 5

Attributes

AWS::SNS::Topic

Creates an SNS topic.

Properties

Example

Resources:
  NotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: !Sub "${AWS::StackName}-notifications"
      DisplayName: "Notifications"
      Subscription:
        - Endpoint: !GetAtt LambdaFunction.Arn
          Protocol: lambda

Attributes

AWS::Events::Rule

Creates an EventBridge rule.

Properties

Example

Resources:
  ScheduledRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub "${AWS::StackName}-scheduler"
      ScheduleExpression: "rate(5 minutes)"
      State: ENABLED
      Targets:
        - Id: LambdaFunction
          Arn: !GetAtt LambdaFunction.Arn

Attributes

AWS::CloudWatch::Alarm

Creates a CloudWatch alarm.

Properties

Lambda Metrics Reference

Example

Resources:
  HighErrorRateAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: !Sub "${AWS::StackName}-high-error-rate"
      AlarmDescription: Alert when error rate exceeds threshold
      MetricName: Errors
      Namespace: AWS/Lambda
      Dimensions:
        - Name: FunctionName
          Value: !Ref LambdaFunction
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 5
      Threshold: 10
      ComparisonOperator: GreaterThanThreshold
      AlarmActions:
        - !Ref AlertTopic

Intrinsic Functions Reference

!Ref

Returns the value of the specified parameter or resource.

# Reference a parameter
FunctionName: !Ref FunctionNameParam

# Reference a resource (returns the physical ID)
FunctionArn: !Ref MyLambdaFunction

!GetAtt

Returns the value of an attribute from a Lambda function.

# Get the function ARN
FunctionArn: !GetAtt MyLambdaFunction.Arn

# Get layer ARN
LayerArn: !GetAtt CommonLayer.Arn

# Get queue ARN
QueueArn: !GetAtt Queue.Arn

!Sub

Substitutes variables in an input string.

# With variable substitution
FunctionName: !Sub ${AWS::StackName}-function

# With multiple variables
RoleArn: !Sub arn:aws:iam::${AWS::AccountId}:role/${RoleName}

!ImportValue

Imports values exported by other stacks.

# Import from another stack
LambdaRoleArn: !ImportValue
  Fn::Sub: "${NetworkStackName}-LambdaRoleArn"

!FindInMap

Returns the value from a mapping.

# Find in mapping
RuntimeConfig: !FindInMap [RuntimeMap, !Ref Runtime, Config]

!If

Returns one value if condition is true, another if false.

# Conditional environment variable
MemorySize: !If [IsProduction, 512, 256]

IAM Policy Templates for Lambda

AWSLambdaBasicExecutionRole

Policies:
  - AWSLambdaBasicExecutionRole

AWSLambdaVPCAccessExecutionRole

Policies:
  - AWSLambdaVPCAccessExecutionRole

AWSLambdaSQSQueueExecutionRole

Policies:
  - AWSLambdaSQSQueueExecutionRole

Custom Policy Document

Policies:
  - PolicyName: LambdaPolicy
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Action:
            - s3:GetObject
            - s3:PutObject
          Resource: !Ref DataBucketArn
        - Effect: Allow
          Action:
            - dynamodb:Query
            - dynamodb:Scan
          Resource: !Ref DataTableArn

Lambda Runtime Versions

Limits and Quotas

Lambda Limits

API Gateway Limits

Step Functions Limits

Common Tags for Lambda

Resources:
  MyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: !Ref ProjectName
        - Key: Owner
          Value: team@example.com
        - Key: ManagedBy
          Value: CloudFormation
        - Key: CostCenter
          Value: "12345"
        - Key: Version
          Value: "1.0.0"