What it is
AWS Lambda runs code without servers to manage. You upload a function, choose a runtime such as Node.js or Python, and Lambda runs it when something calls it: an HTTP request, a schedule, a message or a file landing in S3. You pay for the requests and the time the code runs, and nothing when it is idle.
A function can be given its own HTTPS address with a function URL, stream its response as it is produced, and run on Arm-based Graviton processors for a lower price. Each function runs with an IAM role, so its permissions can be limited to exactly what that code needs, and its logs go to CloudWatch.
How I use it
- Five Node 22 functions on Graviton: the live visitor map, the agent, the build crew, the hands-on tools and the feature switches.
- Function URLs use IAM auth and answer only CloudFront, through an origin access control that signs every request.
- The agent and the build crew use response streaming, so every token and tool call reaches the page as it happens.
- An EventBridge rule runs the status probes every five minutes, and another pulls the AWS bill twice a day.
- A Lambda rewrites inbound mail for mervinc.ca so it passes SPF and DMARC, then forwards it to my inbox.
Lambda is the right tool when work comes in bursts or on a schedule and there is no reason to keep a server running between. That describes everything dynamic on mervinc.com, which is why the site has no EC2 and nothing to patch. For an always-on API with a database beside it, like Rental Pilot, I still use a server.
Questions
When is Lambda cheaper than a server?
When traffic is bursty or scheduled. The whole dynamic half of mervinc.com runs on five functions for a few dollars a month.
How do you stop people calling a Lambda function URL directly?
Set the URL to IAM auth and put CloudFront in front with an origin access control. CloudFront signs every request, so nothing else gets an answer.