[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F3N6PS4SRZSPSM3D4EXXSB":3,"skill-same:01M6F3N6PS4SRZSPSM3D4EXXSB":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":36,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":6,"ownerHtmlUrl":64,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":65,"install":66,"resources":79},"01M6F3N6PS4SRZSPSM3D4EXXSB","aws-lambda",null,"Build and deploy serverless functions on AWS Lambda. Configure triggers, manage permissions, and optimize performance. Use when implementing serverless applications.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-aws-lambda\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"aws","lambda","aws lambda","community","2026","when","implementing","relevant","scripts","critical","os","platform","optimize","main","security","manage","only","configure","access","devops-security","applications","permissions","performance","2026-11-10 10:12:30",false,"---\nname: aws-lambda\ndescription: Build and deploy serverless functions on AWS Lambda. Configure triggers,\n  manage permissions, and optimize performance. Use when implementing serverless applications.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# AWS Lambda\n\nBuild serverless applications with AWS Lambda, covering function creation, event sources, layers, SAM templates, and cold start optimization.\n\n## When to Use This Skill\n\n- Building event-driven applications triggered by API Gateway, S3, SQS, or EventBridge\n- Running scheduled tasks (cron) without managing servers\n- Processing data streams from Kinesis or DynamoDB\n- Building lightweight APIs with API Gateway or function URLs\n- Implementing webhooks, Slack bots, or automation scripts\n- Reducing compute costs for intermittent or bursty workloads\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- Least-privilege IAM actions for the chosen resources; restrict `iam:PassRole` to the execution role. Wildcard service grants are not a prerequisite.\n- Python 3.11+, Node.js 20+, or another supported runtime installed locally\n- (Optional) AWS SAM CLI for local development and deployment\n\n## Create and Deploy a Function\n\n```bash\n# Create a deployment package\ncd my-function\nzip -r function.zip app.py\n\n# Create the Lambda function\naws lambda create-function \\\n  --function-name my-api-handler \\\n  --runtime python3.12 \\\n  --handler app.handler \\\n  --role arn:aws:iam::123456789012:role\u002FLambdaExecRole \\\n  --zip-file fileb:\u002F\u002Ffunction.zip \\\n  --memory-size 256 \\\n  --timeout 30 \\\n  --environment 'Variables={STAGE=production,LOG_LEVEL=INFO}' \\\n  --architectures arm64 \\\n  --tracing-config Mode=Active \\\n  --tags '{\"Team\":\"backend\",\"Environment\":\"production\"}'\n\n# Update function code\naws lambda update-function-code \\\n  --function-name my-api-handler \\\n  --zip-file fileb:\u002F\u002Ffunction.zip\n\n# Update function configuration\naws lambda update-function-configuration \\\n  --function-name my-api-handler \\\n  --memory-size 512 \\\n  --timeout 60 \\\n  --environment 'Variables={STAGE=production,LOG_LEVEL=WARNING}'\n\n# Publish a version (immutable snapshot)\naws lambda publish-version \\\n  --function-name my-api-handler \\\n  --description \"v1.2.0 - added rate limiting\"\n\n# Create an alias pointing to the version\naws lambda create-alias \\\n  --function-name my-api-handler \\\n  --name live \\\n  --function-version 3\n\n# Weighted alias for canary deployments (90% v3, 10% v4)\naws lambda update-alias \\\n  --function-name my-api-handler \\\n  --name live \\\n  --function-version 4 \\\n  --routing-config '{\"AdditionalVersionWeights\":{\"3\":0.9}}'\n```\n\n## Function Code Examples\n\n```python\n# app.py - API Gateway REST proxy (v1) sketch; not the function URL\u002Fv2 event shape\nimport json\nimport logging\nimport os\n\nlogger = logging.getLogger()\nlogger.setLevel(os.environ.get(\"LOG_LEVEL\", \"INFO\"))\n\ndef handler(event, context):\n    \"\"\"Handle API Gateway proxy event.\"\"\"\n    logger.info(\"Request: %s %s\", event[\"httpMethod\"], event[\"path\"])\n\n    try:\n        body = json.loads(event.get(\"body\") or \"{}\")\n        result = process_request(body)\n\n        return {\n            \"statusCode\": 200,\n            \"headers\": {\n                \"Content-Type\": \"application\u002Fjson\",\n                \"X-Request-Id\": context.aws_request_id\n            },\n            \"body\": json.dumps(result)\n        }\n    except ValueError as e:\n        logger.warning(\"Validation error: %s\", e)\n        return {\"statusCode\": 400, \"body\": json.dumps({\"error\": str(e)})}\n    except Exception as e:\n        logger.exception(\"Unhandled error\")\n        return {\"statusCode\": 500, \"body\": json.dumps({\"error\": \"Internal server error\"})}\n\ndef process_request(body):\n    return {\"message\": \"OK\", \"data\": body}\n```\n\n```python\n# sqs_processor.py - SQS batch processor with partial failure reporting\nimport json\nimport logging\n\nlogger = logging.getLogger()\nlogger.setLevel(\"INFO\")\n\ndef handler(event, context):\n    \"\"\"Process SQS messages with partial batch failure reporting.\"\"\"\n    failed_ids = []\n\n    for record in event[\"Records\"]:\n        try:\n            body = json.loads(record[\"body\"])\n            logger.info(\"Processing message: %s\", record[\"messageId\"])\n            process_message(body)\n        except Exception as e:\n            logger.error(\"Failed message %s: %s\", record[\"messageId\"], e)\n            failed_ids.append(record[\"messageId\"])\n\n    # Return failed items so only those get retried\n    return {\n        \"batchItemFailures\": [\n            {\"itemIdentifier\": msg_id} for msg_id in failed_ids\n        ]\n    }\n\ndef process_message(body):\n    pass  # your logic here\n```\n\n## Lambda Layers\n\n```bash\n# Build a layer for Python dependencies\nmkdir -p layer\u002Fpython\npip install requests boto3-stubs -t layer\u002Fpython\u002F\ncd layer\nzip -r ..\u002Fmy-layer.zip python\u002F\n\n# Publish the layer\naws lambda publish-layer-version \\\n  --layer-name common-deps \\\n  --description \"Shared Python dependencies\" \\\n  --zip-file fileb:\u002F\u002Fmy-layer.zip \\\n  --compatible-runtimes python3.11 python3.12 \\\n  --compatible-architectures arm64 x86_64\n\n# Attach layer to a function\naws lambda update-function-configuration \\\n  --function-name my-api-handler \\\n  --layers \"arn:aws:lambda:us-east-1:123456789012:layer:common-deps:1\"\n\n# List available layers\naws lambda list-layers --compatible-runtime python3.12\n```\n\n## Event Source Mappings\n\n```bash\n# SQS trigger with batch processing\naws lambda create-event-source-mapping \\\n  --function-name sqs-processor \\\n  --event-source-arn arn:aws:sqs:us-east-1:123456789012:my-queue \\\n  --batch-size 10 \\\n  --maximum-batching-window-in-seconds 5 \\\n  --function-response-types ReportBatchItemFailures\n\n# DynamoDB Streams trigger\naws lambda create-event-source-mapping \\\n  --function-name stream-processor \\\n  --event-source-arn arn:aws:dynamodb:us-east-1:123456789012:table\u002Fmy-table\u002Fstream\u002F2026-01-01T00:00:00.000 \\\n  --batch-size 100 \\\n  --starting-position LATEST \\\n  --maximum-retry-attempts 3 \\\n  --bisect-batch-on-function-error \\\n  --destination-config '{\"OnFailure\":{\"Destination\":\"arn:aws:sqs:us-east-1:123456789012:dlq\"}}'\n\n# S3 event notification (via Lambda permission + S3 config)\naws lambda add-permission \\\n  --function-name image-processor \\\n  --statement-id s3-trigger \\\n  --action lambda:InvokeFunction \\\n  --principal s3.amazonaws.com \\\n  --source-arn arn:aws:s3:::my-uploads-bucket \\\n  --source-account 123456789012\n\naws s3api put-bucket-notification-configuration \\\n  --bucket my-uploads-bucket \\\n  --notification-configuration '{\n    \"LambdaFunctionConfigurations\": [{\n      \"LambdaFunctionArn\": \"arn:aws:lambda:us-east-1:123456789012:function:image-processor\",\n      \"Events\": [\"s3:ObjectCreated:*\"],\n      \"Filter\": {\"Key\": {\"FilterRules\": [{\"Name\": \"suffix\", \"Value\": \".jpg\"}]}}\n    }]\n  }'\n\n# Schedule with EventBridge (cron)\naws events put-rule \\\n  --name daily-cleanup \\\n  --schedule-expression \"cron(0 2 * * ? *)\" \\\n  --state ENABLED\n\naws lambda add-permission \\\n  --function-name daily-cleanup \\\n  --statement-id eventbridge \\\n  --action lambda:InvokeFunction \\\n  --principal events.amazonaws.com \\\n  --source-arn arn:aws:events:us-east-1:123456789012:rule\u002Fdaily-cleanup\n\naws events put-targets \\\n  --rule daily-cleanup \\\n  --targets '[{\"Id\":\"1\",\"Arn\":\"arn:aws:lambda:us-east-1:123456789012:function:daily-cleanup\"}]'\n```\n\n## Function URLs (No API Gateway Needed)\n\n```bash\n# Public access requires explicit authorization; CORS is not authentication.\n# Prefer AWS_IAM for private endpoints. Create public URL only when requested.\naws lambda create-function-url-config \\\n  --function-name my-api-handler \\\n  --auth-type NONE \\\n  --cors '{\n    \"AllowOrigins\": [\"https:\u002F\u002Fmyapp.com\"],\n    \"AllowMethods\": [\"GET\", \"POST\"],\n    \"AllowHeaders\": [\"Content-Type\"],\n    \"MaxAge\": 86400\n  }'\n\n# Grant public invoke for function URL\naws lambda add-permission \\\n  --function-name my-api-handler \\\n  --statement-id function-url-public \\\n  --action lambda:InvokeFunctionUrl \\\n  --principal \"*\" \\\n  --function-url-auth-type NONE\n\naws lambda add-permission \\\n  --function-name my-api-handler \\\n  --statement-id function-url-public-invoke \\\n  --action lambda:InvokeFunction \\\n  --principal \"*\" \\\n  --invoked-via-function-url\n```\n\n## Cold Start Optimization\n\n```bash\n# Provision capacity to reduce cold starts within provisioned concurrency; spillover may initialize\naws lambda put-provisioned-concurrency-config \\\n  --function-name my-api-handler \\\n  --qualifier live \\\n  --provisioned-concurrent-executions 10\n\n# Set reserved concurrency (throttle limit)\naws lambda put-function-concurrency \\\n  --function-name my-api-handler \\\n  --reserved-concurrent-executions 100\n\n# Enable SnapStart for Java functions (near-zero cold starts)\naws lambda update-function-configuration \\\n  --function-name my-java-handler \\\n  --snap-start '{\"ApplyOn\": \"PublishedVersions\"}'\naws lambda publish-version --function-name my-java-handler\n```\n\nCold start reduction tips:\n- Benchmark supported architectures; verify native dependency compatibility and regional pricing\n- Minimize deployment package size; use layers for large dependencies\n- Initialize SDK clients outside the handler function\n- Avoid VPC unless required (VPC cold starts are longer)\n- Use provisioned concurrency for latency-sensitive paths\n\n## SAM Template\n\n```yaml\n# template.yaml - AWS SAM application\nAWSTemplateFormatVersion: '2010-09-09'\nTransform: AWS::Serverless-2016-10-31\nDescription: My serverless API\n\nGlobals:\n  Function:\n    Runtime: python3.12\n    Architectures: [arm64]\n    MemorySize: 256\n    Timeout: 30\n    Tracing: Active\n    Environment:\n      Variables:\n        STAGE: !Ref Stage\n        LOG_LEVEL: INFO\n\nParameters:\n  Stage:\n    Type: String\n    Default: dev\n    AllowedValues: [dev, staging, prod]\n\nResources:\n  ApiFunction:\n    Type: AWS::Serverless::Function\n    Properties:\n      FunctionName: !Sub \"${Stage}-api-handler\"\n      Handler: app.handler\n      CodeUri: src\u002F\n      Layers:\n        - !Ref DepsLayer\n      Events:\n        GetItems:\n          Type: Api\n          Properties:\n            Path: \u002Fitems\n            Method: get\n        PostItem:\n          Type: Api\n          Properties:\n            Path: \u002Fitems\n            Method: post\n      Policies:\n        - DynamoDBCrudPolicy:\n            TableName: !Ref ItemsTable\n\n  QueueProcessor:\n    Type: AWS::Serverless::Function\n    Properties:\n      FunctionName: !Sub \"${Stage}-queue-processor\"\n      Handler: sqs_processor.handler\n      CodeUri: src\u002F\n      Events:\n        SQSEvent:\n          Type: SQS\n          Properties:\n            Queue: !GetAtt ProcessingQueue.Arn\n            BatchSize: 10\n            FunctionResponseTypes:\n              - ReportBatchItemFailures\n\n  DepsLayer:\n    Type: AWS::Serverless::LayerVersion\n    Properties:\n      LayerName: common-deps\n      ContentUri: layer\u002F\n      CompatibleRuntimes:\n        - python3.12\n\n  ItemsTable:\n    Type: AWS::DynamoDB::Table\n    Properties:\n      TableName: !Sub \"${Stage}-items\"\n      BillingMode: PAY_PER_REQUEST\n      AttributeDefinitions:\n        - AttributeName: id\n          AttributeType: S\n      KeySchema:\n        - AttributeName: id\n          KeyType: HASH\n\n  ProcessingQueue:\n    Type: AWS::SQS::Queue\n    Properties:\n      QueueName: !Sub \"${Stage}-processing\"\n      VisibilityTimeout: 360\n\nOutputs:\n  ApiEndpoint:\n    Value: !Sub \"https:\u002F\u002F${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com\u002FProd\"\n```\n\n```bash\n# SAM CLI commands\nsam build\nsam local invoke ApiFunction --event events\u002Fget-items.json\nsam local start-api --port 3000\nsam deploy --guided\nsam logs --name ApiFunction --stack-name my-stack --tail\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| Function times out | Timeout too low or downstream slow | Increase timeout; check VPC\u002FNAT config |\n| Out of memory | Memory limit too small | Increase `--memory-size`; profile with CloudWatch Insights |\n| Permission denied on AWS API | Execution role missing policy | Attach required policy to the execution role |\n| Cold starts > 5s | Large package or VPC overhead | Use layers, arm64, provisioned concurrency; remove VPC if not needed |\n| SQS messages reprocessed | Visibility timeout \u003C function timeout | Use at least six times the function timeout plus batching window; also implement idempotency |\n| Event source mapping disabled | Too many consecutive errors | Fix the function error; re-enable the mapping |\n| Layer not found | Wrong region or deleted version | Verify layer ARN region matches function region |\n| Canary deployment not shifting | Alias routing config wrong | Verify version numbers in routing config |\n| Cannot invoke function URL | Missing resource-based policy | Check both URL and function invoke permissions |\n\n## Related Skills\n\n- aws-iam (`aws-iam`) - Execution roles and permissions\n- terraform-aws (`terraform-aws`) - IaC deployment for Lambda\n- aws-s3 (`aws-s3`) - S3 event triggers\n- aws-vpc (`aws-vpc`) - VPC configuration for Lambda\n- aws-cost-optimization (`aws-cost-optimization`) - Optimizing Lambda spend\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n\nEnvironment, layer and S3 notification configuration commands replace the corresponding full configuration; read and merge existing settings first. Build native dependencies for the selected Linux runtime and architecture. The SQS example assumes a standard queue; FIFO partial failures must stop at the first failure and include unprocessed records to preserve order. All retryable handlers need idempotent side effects. Provisioned concurrency and public invocation incur costs. [Function URL authorization](https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Furls-auth.html) requires both invoke permissions for new URLs since October 2025.\n","# AWS Lambda\n\nBuild serverless applications with AWS Lambda, covering function creation, event sources, layers, SAM templates, and cold start optimization.\n\n## When to Use This Skill\n\n- Building event-driven applications triggered by API Gateway, S3, SQS, or EventBridge\n- Running scheduled tasks (cron) without managing servers\n- Processing data streams from Kinesis or DynamoDB\n- Building lightweight APIs with API Gateway or function URLs\n- Implementing webhooks, Slack bots, or automation scripts\n- Reducing compute costs for intermittent or bursty workloads\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- Least-privilege IAM actions for the chosen resources; restrict `iam:PassRole` to the execution role. Wildcard service grants are not a prerequisite.\n- Python 3.11+, Node.js 20+, or another supported runtime installed locally\n- (Optional) AWS SAM CLI for local development and deployment\n\n## Create and Deploy a Function\n\n```bash\n# Create a deployment package\ncd my-function\nzip -r function.zip app.py\n\n# Create the Lambda function\naws lambda create-function \\\n  --function-name my-api-handler \\\n  --runtime python3.12 \\\n  --handler app.handler \\\n  --role arn:aws:iam::123456789012:role\u002FLambdaExecRole \\\n  --zip-file fileb:\u002F\u002Ffunction.zip \\\n  --memory-size 256 \\\n  --timeout 30 \\\n  --environment 'Variables={STAGE=production,LOG_LEVEL=INFO}' \\\n  --architectures arm64 \\\n  --tracing-config Mode=Active \\\n  --tags '{\"Team\":\"backend\",\"Environment\":\"production\"}'\n\n# Update function code\naws lambda update-function-code \\\n  --function-name my-api-handler \\\n  --zip-file fileb:\u002F\u002Ffunction.zip\n\n# Update function configuration\naws lambda update-function-configuration \\\n  --function-name my-api-handler \\\n  --memory-size 512 \\\n  --timeout 60 \\\n  --environment 'Variables={STAGE=production,LOG_LEVEL=WARNING}'\n\n# Publish a version (immutable snapshot)\naws lambda publish-version \\\n  --function-name my-api-handler \\\n  --description \"v1.2.0 - added rate limiting\"\n\n# Create an alias pointing to the version\naws lambda create-alias \\\n  --function-name my-api-handler \\\n  --name live \\\n  --function-version 3\n\n# Weighted alias for canary deployments (90% v3, 10% v4)\naws lambda update-alias \\\n  --function-name my-api-handler \\\n  --name live \\\n  --function-version 4 \\\n  --routing-config '{\"AdditionalVersionWeights\":{\"3\":0.9}}'\n```\n\n## Function Code Examples\n\n```python\n# app.py - API Gateway REST proxy (v1) sketch; not the function URL\u002Fv2 event shape\nimport json\nimport logging\nimport os\n\nlogger = logging.getLogger()\nlogger.setLevel(os.environ.get(\"LOG_LEVEL\", \"INFO\"))\n\ndef handler(event, context):\n    \"\"\"Handle API Gateway proxy event.\"\"\"\n    logger.info(\"Request: %s %s\", event[\"httpMethod\"], event[\"path\"])\n\n    try:\n        body = json.loads(event.get(\"body\") or \"{}\")\n        result = process_request(body)\n\n        return {\n            \"statusCode\": 200,\n            \"headers\": {\n                \"Content-Type\": \"application\u002Fjson\",\n                \"X-Request-Id\": context.aws_request_id\n            },\n            \"body\": json.dumps(result)\n        }\n    except ValueError as e:\n        logger.warning(\"Validation error: %s\", e)\n        return {\"statusCode\": 400, \"body\": json.dumps({\"error\": str(e)})}\n    except Exception as e:\n        logger.exception(\"Unhandled error\")\n        return {\"statusCode\": 500, \"body\": json.dumps({\"error\": \"Internal server error\"})}\n\ndef process_request(body):\n    return {\"message\": \"OK\", \"data\": body}\n```\n\n```python\n# sqs_processor.py - SQS batch processor with partial failure reporting\nimport json\nimport logging\n\nlogger = logging.getLogger()\nlogger.setLevel(\"INFO\")\n\ndef handler(event, context):\n    \"\"\"Process SQS messages with partial batch failure reporting.\"\"\"\n    failed_ids = []\n\n    for record in event[\"Records\"]:\n        try:\n            body = json.loads(record[\"body\"])\n            logger.info(\"Processing message: %s\", record[\"messageId\"])\n            process_message(body)\n        except Exception as e:\n            logger.error(\"Failed message %s: %s\", record[\"messageId\"], e)\n            failed_ids.append(record[\"messageId\"])\n\n    # Return failed items so only those get retried\n    return {\n        \"batchItemFailures\": [\n            {\"itemIdentifier\": msg_id} for msg_id in failed_ids\n        ]\n    }\n\ndef process_message(body):\n    pass  # your logic here\n```\n\n## Lambda Layers\n\n```bash\n# Build a layer for Python dependencies\nmkdir -p layer\u002Fpython\npip install requests boto3-stubs -t layer\u002Fpython\u002F\ncd layer\nzip -r ..\u002Fmy-layer.zip python\u002F\n\n# Publish the layer\naws lambda publish-layer-version \\\n  --layer-name common-deps \\\n  --description \"Shared Python dependencies\" \\\n  --zip-file fileb:\u002F\u002Fmy-layer.zip \\\n  --compatible-runtimes python3.11 python3.12 \\\n  --compatible-architectures arm64 x86_64\n\n# Attach layer to a function\naws lambda update-function-configuration \\\n  --function-name my-api-handler \\\n  --layers \"arn:aws:lambda:us-east-1:123456789012:layer:common-deps:1\"\n\n# List available layers\naws lambda list-layers --compatible-runtime python3.12\n```\n\n## Event Source Mappings\n\n```bash\n# SQS trigger with batch processing\naws lambda create-event-source-mapping \\\n  --function-name sqs-processor \\\n  --event-source-arn arn:aws:sqs:us-east-1:123456789012:my-queue \\\n  --batch-size 10 \\\n  --maximum-batching-window-in-seconds 5 \\\n  --function-response-types ReportBatchItemFailures\n\n# DynamoDB Streams trigger\naws lambda create-event-source-mapping \\\n  --function-name stream-processor \\\n  --event-source-arn arn:aws:dynamodb:us-east-1:123456789012:table\u002Fmy-table\u002Fstream\u002F2026-01-01T00:00:00.000 \\\n  --batch-size 100 \\\n  --starting-position LATEST \\\n  --maximum-retry-attempts 3 \\\n  --bisect-batch-on-function-error \\\n  --destination-config '{\"OnFailure\":{\"Destination\":\"arn:aws:sqs:us-east-1:123456789012:dlq\"}}'\n\n# S3 event notification (via Lambda permission + S3 config)\naws lambda add-permission \\\n  --function-name image-processor \\\n  --statement-id s3-trigger \\\n  --action lambda:InvokeFunction \\\n  --principal s3.amazonaws.com \\\n  --source-arn arn:aws:s3:::my-uploads-bucket \\\n  --source-account 123456789012\n\naws s3api put-bucket-notification-configuration \\\n  --bucket my-uploads-bucket \\\n  --notification-configuration '{\n    \"LambdaFunctionConfigurations\": [{\n      \"LambdaFunctionArn\": \"arn:aws:lambda:us-east-1:123456789012:function:image-processor\",\n      \"Events\": [\"s3:ObjectCreated:*\"],\n      \"Filter\": {\"Key\": {\"FilterRules\": [{\"Name\": \"suffix\", \"Value\": \".jpg\"}]}}\n    }]\n  }'\n\n# Schedule with EventBridge (cron)\naws events put-rule \\\n  --name daily-cleanup \\\n  --schedule-expression \"cron(0 2 * * ? *)\" \\\n  --state ENABLED\n\naws lambda add-permission \\\n  --function-name daily-cleanup \\\n  --statement-id eventbridge \\\n  --action lambda:InvokeFunction \\\n  --principal events.amazonaws.com \\\n  --source-arn arn:aws:events:us-east-1:123456789012:rule\u002Fdaily-cleanup\n\naws events put-targets \\\n  --rule daily-cleanup \\\n  --targets '[{\"Id\":\"1\",\"Arn\":\"arn:aws:lambda:us-east-1:123456789012:function:daily-cleanup\"}]'\n```\n\n## Function URLs (No API Gateway Needed)\n\n```bash\n# Public access requires explicit authorization; CORS is not authentication.\n# Prefer AWS_IAM for private endpoints. Create public URL only when requested.\naws lambda create-function-url-config \\\n  --function-name my-api-handler \\\n  --auth-type NONE \\\n  --cors '{\n    \"AllowOrigins\": [\"https:\u002F\u002Fmyapp.com\"],\n    \"AllowMethods\": [\"GET\", \"POST\"],\n    \"AllowHeaders\": [\"Content-Type\"],\n    \"MaxAge\": 86400\n  }'\n\n# Grant public invoke for function URL\naws lambda add-permission \\\n  --function-name my-api-handler \\\n  --statement-id function-url-public \\\n  --action lambda:InvokeFunctionUrl \\\n  --principal \"*\" \\\n  --function-url-auth-type NONE\n\naws lambda add-permission \\\n  --function-name my-api-handler \\\n  --statement-id function-url-public-invoke \\\n  --action lambda:InvokeFunction \\\n  --principal \"*\" \\\n  --invoked-via-function-url\n```\n\n## Cold Start Optimization\n\n```bash\n# Provision capacity to reduce cold starts within provisioned concurrency; spillover may initialize\naws lambda put-provisioned-concurrency-config \\\n  --function-name my-api-handler \\\n  --qualifier live \\\n  --provisioned-concurrent-executions 10\n\n# Set reserved concurrency (throttle limit)\naws lambda put-function-concurrency \\\n  --function-name my-api-handler \\\n  --reserved-concurrent-executions 100\n\n# Enable SnapStart for Java functions (near-zero cold starts)\naws lambda update-function-configuration \\\n  --function-name my-java-handler \\\n  --snap-start '{\"ApplyOn\": \"PublishedVersions\"}'\naws lambda publish-version --function-name my-java-handler\n```\n\nCold start reduction tips:\n- Benchmark supported architectures; verify native dependency compatibility and regional pricing\n- Minimize deployment package size; use layers for large dependencies\n- Initialize SDK clients outside the handler function\n- Avoid VPC unless required (VPC cold starts are longer)\n- Use provisioned concurrency for latency-sensitive paths\n\n## SAM Template\n\n```yaml\n# template.yaml - AWS SAM application\nAWSTemplateFormatVersion: '2010-09-09'\nTransform: AWS::Serverless-2016-10-31\nDescription: My serverless API\n\nGlobals:\n  Function:\n    Runtime: python3.12\n    Architectures: [arm64]\n    MemorySize: 256\n    Timeout: 30\n    Tracing: Active\n    Environment:\n      Variables:\n        STAGE: !Ref Stage\n        LOG_LEVEL: INFO\n\nParameters:\n  Stage:\n    Type: String\n    Default: dev\n    AllowedValues: [dev, staging, prod]\n\nResources:\n  ApiFunction:\n    Type: AWS::Serverless::Function\n    Properties:\n      FunctionName: !Sub \"${Stage}-api-handler\"\n      Handler: app.handler\n      CodeUri: src\u002F\n      Layers:\n        - !Ref DepsLayer\n      Events:\n        GetItems:\n          Type: Api\n          Properties:\n            Path: \u002Fitems\n            Method: get\n        PostItem:\n          Type: Api\n          Properties:\n            Path: \u002Fitems\n            Method: post\n      Policies:\n        - DynamoDBCrudPolicy:\n            TableName: !Ref ItemsTable\n\n  QueueProcessor:\n    Type: AWS::Serverless::Function\n    Properties:\n      FunctionName: !Sub \"${Stage}-queue-processor\"\n      Handler: sqs_processor.handler\n      CodeUri: src\u002F\n      Events:\n        SQSEvent:\n          Type: SQS\n          Properties:\n            Queue: !GetAtt ProcessingQueue.Arn\n            BatchSize: 10\n            FunctionResponseTypes:\n              - ReportBatchItemFailures\n\n  DepsLayer:\n    Type: AWS::Serverless::LayerVersion\n    Properties:\n      LayerName: common-deps\n      ContentUri: layer\u002F\n      CompatibleRuntimes:\n        - python3.12\n\n  ItemsTable:\n    Type: AWS::DynamoDB::Table\n    Properties:\n      TableName: !Sub \"${Stage}-items\"\n      BillingMode: PAY_PER_REQUEST\n      AttributeDefinitions:\n        - AttributeName: id\n          AttributeType: S\n      KeySchema:\n        - AttributeName: id\n          KeyType: HASH\n\n  ProcessingQueue:\n    Type: AWS::SQS::Queue\n    Properties:\n      QueueName: !Sub \"${Stage}-processing\"\n      VisibilityTimeout: 360\n\nOutputs:\n  ApiEndpoint:\n    Value: !Sub \"https:\u002F\u002F${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com\u002FProd\"\n```\n\n```bash\n# SAM CLI commands\nsam build\nsam local invoke ApiFunction --event events\u002Fget-items.json\nsam local start-api --port 3000\nsam deploy --guided\nsam logs --name ApiFunction --stack-name my-stack --tail\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| Function times out | Timeout too low or downstream slow | Increase timeout; check VPC\u002FNAT config |\n| Out of memory | Memory limit too small | Increase `--memory-size`; profile with CloudWatch Insights |\n| Permission denied on AWS API | Execution role missing policy | Attach required policy to the execution role |\n| Cold starts > 5s | Large package or VPC overhead | Use layers, arm64, provisioned concurrency; remove VPC if not needed |\n| SQS messages reprocessed | Visibility timeout \u003C function timeout | Use at least six times the function timeout plus batching window; also implement idempotency |\n| Event source mapping disabled | Too many consecutive errors | Fix the function error; re-enable the mapping |\n| Layer not found | Wrong region or deleted version | Verify layer ARN region matches function region |\n| Canary deployment not shifting | Alias routing config wrong | Verify version numbers in routing config |\n| Cannot invoke function URL | Missing resource-based policy | Check both URL and function invoke permissions |\n\n## Related Skills\n\n- aws-iam (`aws-iam`) - Execution roles and permissions\n- terraform-aws (`terraform-aws`) - IaC deployment for Lambda\n- aws-s3 (`aws-s3`) - S3 event triggers\n- aws-vpc (`aws-vpc`) - VPC configuration for Lambda\n- aws-cost-optimization (`aws-cost-optimization`) - Optimizing Lambda spend\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n\nEnvironment, layer and S3 notification configuration commands replace the corresponding full configuration; read and merge existing settings first. Build native dependencies for the selected Linux runtime and architecture. The SQS example assumes a standard queue; FIFO partial failures must stop at the first failure and include unprocessed records to preserve order. All retryable handlers need idempotent side effects. Provisioned concurrency and public invocation incur costs. [Function URL authorization](https:\u002F\u002Fdocs.aws.amazon.com\u002Flambda\u002Flatest\u002Fdg\u002Furls-auth.html) requires both invoke permissions for new URLs since October 2025.\n",{"name":5,"risk":32,"source":51,"license":14,"category":52,"metadata":53,"date_added":56,"description":7,"source_repo":57,"source_type":26,"compatibility":58,"license_source":59},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":54,"version":55},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-aws-lambda",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-12 14:21:24",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add boisenoise\u002Fskills-collections --skill aws-lambda",{"tool":72,"command":73},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill aws-lambda",{"tool":75,"command":76},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill aws-lambda","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-aws-lambda\u002FSKILL.md",true,[],[81,105,131,157,176,199],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":86,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":46},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[90,41,91,92,93,94,95,96,97,98,99,39,100,101,34,32,102,103,104,28,27],"web","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","free","cover","normal",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":115,"publishedAt":46},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[112],{"categoryNo":113,"categoryName":114,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",[107,116,117,118,92,93,119,97,120,121,122,123,124,125,126,32,127,128,129,130,27],"MCP","cli","github","license","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":135,"sourceHtmlUrl":136,"categories":137,"keywords":143,"publishedAt":46},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[138],{"categoryNo":139,"categoryName":140,"taxonomyType":141,"taxonomyTypeDesc":142},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[133,118,92,119,144,145,146,147,148,149,32,150,151,152,128,153,154,155,156,130,107,27],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":161,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":46},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[165,166,167,118,92,119,168,169,144,170,120,171,172,173,148,32,174,175,130,107,27],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":180,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":46},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[184,185,118,186,92,187,119,188,189,190,191,192,32,193,194,195,196,197,198,130],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":200,"name":201,"nameZh":6,"description":202,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":85,"licenseFileUrl":203,"sourceHtmlUrl":204,"categories":205,"keywords":206,"publishedAt":46},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[207,208,209,118,92,119,210,211,147,212,213,32,214,215,216,217,218,219,220,130],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]