Lambda triggers, limits and configuration
Lambda sits at the center of most developer-exam scenarios. You need to know how it is triggered, what limits apply and which setting fixes which symptom.
Invocation types
| Type | Examples | Behavior |
|---|---|---|
| Synchronous | API Gateway, ALB, SDK RequestResponse | Caller waits; errors go back to the caller |
| Asynchronous | S3, SNS, EventBridge | Lambda queues the event, retries twice, can send failures to a DLQ or on-failure destination |
| Poll-based (event source mapping) | SQS, Kinesis, DynamoDB Streams | Lambda polls and sends batches to the function |
For poll-based sources, the execution role needs read permissions on the source. For push sources (S3, SNS), the function’s resource-based policy must allow the service to invoke it.
Key limits and settings
- Timeout: up to 15 minutes. Default is 3 seconds.
- Memory: 128 MB to 10,240 MB. CPU grows with memory, so more memory can shorten runtime.
- Deployment package: 50 MB zipped (direct upload), 250 MB unzipped including layers; container images up to 10 GB.
- Environment variables: up to 4 KB in total.
- /tmp: 512 MB by default, configurable up to 10,240 MB.
Sharing code and data
A layer holds libraries or runtime files, is versioned, and a function can use up to five. Layers are read-only.
For data, /tmp is local to one execution environment and is not shared. If functions must share or append to files, mount Amazon EFS (this requires the function to be in a VPC).
Concurrency
- Reserved concurrency: guarantees capacity and limits the function to that number.
- Provisioned concurrency: pre-initialized environments that remove cold starts.
- Throttled synchronous calls return 429; throttled asynchronous events are retried.
Initialize SDK clients and database connections outside the handler so warm invocations reuse them.
SQS as a source
Set the queue’s visibility timeout to at least six times the function timeout. Failed messages return to the queue and can move to a dead-letter queue after maxReceiveCount. Use partial batch responses (ReportBatchItemFailures) so one bad message does not retry the whole batch.
Exam traps
- Cold start problem: the answer is provisioned concurrency, not reserved concurrency.
- Memory also controls CPU; there is no separate CPU setting.
- Layers are not writable and
/tmpis not shared between environments. - An S3 trigger failing is usually a missing resource policy, not a public bucket.
- Run time over 15 minutes means Step Functions, containers or batch, not a higher timeout.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. An S3 event notification must invoke a Lambda function, but nothing happens when files are uploaded. The notification is configured correctly. What is the most likely missing piece?
Show answer
Answer: B.S3 pushes events, so the function needs a resource-based policy that lets the S3 service principal invoke it.
2. Several Lambda functions need the same versioned set of third-party libraries with the least effort. What should a developer use?
Show answer
Answer: B.A layer is a versioned archive of libraries that many functions can reference.
3. Functions running in parallel must read and append to one shared file. Which storage works?
Show answer
Answer: B./tmp is private to each execution environment and layers are read-only. EFS is shared and writable.
4. A function reading from an SQS queue must not consume all the account concurrency and starve other functions. What should be configured?
Show answer
Answer: B.Reserved concurrency sets both a guaranteed amount and a cap for that function.