Lambda, API Gateway and serverless request handling

Why and what

Lambda runs event-driven code without you managing an EC2 operating system. You still manage code, dependencies, timeouts, memory, IAM and data. API Gateway exposes API routes and invokes integrations. Serverless does not mean no servers, no cost or unlimited execution.

Guided console lab

1. Create a function using a currently supported Python runtime and a least-privilege execution role allowing its logs.
2. Replace the handler with the example below and test an event in the console.
3. Create an HTTP API in API Gateway, add a GET /hello route and integrate the Lambda function.
4. Verify the function resource permission allows the intended API invocation. Configure a stage and deploy if your stage does not auto-deploy.
5. Invoke the API endpoint and inspect Lambda logs and duration metrics.

import json

def lambda_handler(event, context):
    return {
        'statusCode': 200,
        'headers': {'Content-Type': 'application/json'},
        'body': json.dumps({'message': 'Hello from the cloud academy'})
    }

Deeper concepts

The execution role governs AWS calls made by the function. A resource-based permission governs who may invoke it. Synchronous errors are returned to callers; asynchronous/event-source retries depend on the integration. Reused execution environments can retain globals, but do not depend on them as durable storage. Temporary filesystem capacity, execution duration and concurrency have limits; check the selected runtime/service settings. VPC attachment lets a function reach private resources, but does not automatically provide internet egress. Avoid attaching to a VPC without a connectivity reason. Use reserved concurrency and downstream limits to prevent a burst of invocations overwhelming a database.

Verification and troubleshooting

A 403 can be authorization/routing; 502 can be an integration/response issue; a timeout can be dependency or network delay. Compare API logs, Lambda errors and request IDs. Do not expose a write API publicly without authentication and validation merely because the hello lab is public.

Assignment and cleanup

Add a query-string greeting with safe JSON serialization, then return 400 for an invalid/missing required input. Remove the API, function, unused role and retained log group when the lab is finished.

Official references

Lambda with API Gateway Lambda best practices

Interview and revision check

Why can a VPC-attached Lambda lose internet access?

VPC placement does not automatically provide egress. Required routes, NAT or service endpoints must exist for its dependencies.