Aws/lambda

@swamp/aws/lambdav2026.09.11.1· 1d agoMODELS

01README

AWS LAMBDA infrastructure models

02Models14

alias.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
FunctionName	string	yes	The name of the Lambda function.
ProvisionedConcurrencyConfig?	object	no	The amount of provisioned concurrency to allocate for the alias.
Description?	string	no	A description of the alias.
FunctionVersion	string	yes	The function version that the alias invokes.
RoutingConfig?	object	no	The second version, and the percentage of traffic that's routed to it.
Name	string	yes	The name of the alias.

fn create()

Create a Lambda Alias

fn get(identifier: string)

Get a Lambda Alias

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Alias

fn update()

Update a Lambda Alias

fn delete(identifier: string)

Delete a Lambda Alias

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Alias

fn sync()

Sync Lambda Alias state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda Alias resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

capacity_provider.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CapacityProviderName?	string	no
CapacityProviderScalingConfig?	object	no	The maximum number of vCPUs that the capacity provider can provision across all compute instances.
InstanceRequirements?	object	no	A list of supported CPU architectures for compute instances. Valid values include x86_64 and arm64.
KmsKeyArn?	string	no	The ARN of the KMS key used to encrypt the capacity provider's resources.
PermissionsConfig	object	yes	The ARN of the IAM role that the capacity provider uses to manage compute instances and other AWS resources.
Tags?	array	no	A key-value pair that provides metadata for the capacity provider.
VpcConfig	object	yes	A list of subnet IDs where the capacity provider launches compute instances.
PropagateTags?	object	no	The mode for tag propagation. Use Explicit to propagate specific tags, or None to disable propagation.
TelemetryConfig?	object	no	The capacity provider's Amazon CloudWatch Logs configuration settings.

fn create()

Create a Lambda CapacityProvider

fn get(identifier: string)

Get a Lambda CapacityProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda CapacityProvider

fn update()

Update a Lambda CapacityProvider

fn delete(identifier: string)

Delete a Lambda CapacityProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda CapacityProvider

fn sync()

Sync Lambda CapacityProvider state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda CapacityProvider resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

code_signing_config.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Description?	string	no	A description of the CodeSigningConfig
AllowedPublishers	object	yes	List of Signing profile version Arns
CodeSigningPolicies?	object	no	Indicates how Lambda operations involve updating the code artifact will operate. Default to Warn if not provided
Tags?	array	no	A list of tags to apply to CodeSigningConfig resource

fn create()

Create a Lambda CodeSigningConfig

fn get(identifier: string)

Get a Lambda CodeSigningConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda CodeSigningConfig

fn update()

Update a Lambda CodeSigningConfig

fn delete(identifier: string)

Delete a Lambda CodeSigningConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda CodeSigningConfig

fn sync()

Sync Lambda CodeSigningConfig state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda CodeSigningConfig resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

event_invoke_config.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DestinationConfig?	object	no	The destination configuration for failed invocations.
FunctionName	string	yes	The name of the Lambda function.
MaximumEventAgeInSeconds?	number	no	The maximum age of a request that Lambda sends to a function for processing.
MaximumRetryAttempts?	number	no	The maximum number of times to retry when the function returns an error.
Qualifier	string	yes	The identifier of a version or alias.

fn create()

Create a Lambda EventInvokeConfig

fn get(identifier: string)

Get a Lambda EventInvokeConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda EventInvokeConfig

fn update()

Update a Lambda EventInvokeConfig

fn delete(identifier: string)

Delete a Lambda EventInvokeConfig

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda EventInvokeConfig

fn sync()

Sync Lambda EventInvokeConfig state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda EventInvokeConfig resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

event_source_mapping.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
StartingPosition?	string	no	The position in a stream from which to start reading. Required for Amazon Kinesis and Amazon DynamoDB. LATEST - Read only new records. TRIM_HORIZON - Process all available records. AT_TIMESTAMP - Specify a time from which to start reading records.
SelfManagedEventSource?	object	no	The list of bootstrap servers for your Kafka brokers in the following format: "KafkaBootstrapServers": ["abc.xyz.com:xxxx","abc2.xyz.com:xxxx"].
ParallelizationFactor?	number	no	(Kinesis and DynamoDB Streams only) The number of batches to process concurrently from each shard. The default value is 1.
FilterCriteria?	object	no	A list of filters.
ProvisionedPollerConfig?	object	no	(Amazon MSK and self-managed Apache Kafka) The name of the provisioned poller group. Use this option to group multiple ESMs within the event source's VPC to share Event Poller Unit (EPU) capacity. You can use this option to optimize Provisioned mode costs for your ESMs. You can group up to 100 ESMs per poller group and aggregate maximum pollers across all ESMs in a group cannot exceed 2000.
MetricsConfig?	object	no	The metrics you want your event source mapping to produce, including EventCount, ErrorCount, KafkaMetrics. EventCount to receive metrics related to the number of events processed by your event source mapping. ErrorCount (Amazon MSK and self-managed Apache Kafka) to receive metrics related to the number of errors in your event source mapping processing. KafkaMetrics (Amazon MSK and self-managed Apache Kafka) to receive metrics related to the Kafka consumers from your event source mapping. For more information about these metrics, see [Event source mapping metrics](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-metrics-types.html#event-source-mapping-metrics).
FunctionName	string	yes	The name or ARN of the Lambda function. Name formats Function name – MyFunction. Function ARN – arn:aws:lambda:us-west-2:123456789012:function:MyFunction. Version or Alias ARN – arn:aws:lambda:us-west-2:123456789012:function:MyFunction:PROD. Partial ARN – 123456789012:function:MyFunction. The length constraint applies only to the full ARN. If you specify only the function name, it's limited to 64 characters in length.
DestinationConfig?	object	no	The destination configuration for failed invocations.
KmsKeyArn?	string	no	The ARN of the KMSlong (KMS) customer managed key that Lambda uses to encrypt your function's [filter criteria](https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventfiltering.html#filtering-basics).
AmazonManagedKafkaEventSourceConfig?	object	no	The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see [Customizable consumer group ID](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#services-msk-consumer-group-id).
SourceAccessConfigurations?	array	no	An array of the authentication protocol, VPC components, or virtual host to secure and define your event source.
Tags?	array	no	A list of tags to add to the event source mapping. You must have the lambda:TagResource, lambda:UntagResource, and lambda:ListTags permissions for your [principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html) to manage the CFN stack. If you don't have these permissions, there might be unexpected behavior with stack-level tags propagating to the resource during resource creation and update.
MaximumBatchingWindowInSeconds?	number	no	The maximum amount of time, in seconds, that Lambda spends gathering records before invoking the function. Default (,, event sources): 0 Default (, Kafka,, event sources): 500 ms Related setting: For SQS event sources, when you set BatchSize to a value greater than 10, you must set MaximumBatchingWindowInSeconds to at least 1.
BatchSize?	number	no	The maximum number of records in each batch that Lambda pulls from your stream or queue and sends to your function. Lambda passes all of the records in the batch to the function in a single call, up to the payload limit for synchronous invocation (6 MB). Amazon Kinesis – Default 100. Max 10,000. Amazon DynamoDB Streams – Default 100. Max 10,000. Amazon Simple Queue Service – Default 10. For standard queues the max is 10,000. For FIFO queues the max is 10. Amazon Managed Streaming for Apache Kafka – Default 100. Max 10,000. Self-managed Apache Kafka – Default 100. Max 10,000. Amazon MQ (ActiveMQ and RabbitMQ) – Default 100. Max 10,000. DocumentDB – Default 100. Max 10,000.
MaximumRetryAttempts?	number	no	(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka) Discard records after the specified number of retries. The default value is -1, which sets the maximum number of retries to infinite. When MaximumRetryAttempts is infinite, Lambda retries failed records until the record expires in the event source.
Topics?	array	no	The name of the Kafka topic.
ScalingConfig?	object	no	Limits the number of concurrent instances that the SQS event source can invoke.
Enabled?	boolean	no	When true, the event source mapping is active. When false, Lambda pauses polling and invocation. Default: True
EventSourceArn?	string	no	The Amazon Resource Name (ARN) of the event source. Amazon Kinesis – The ARN of the data stream or a stream consumer. Amazon DynamoDB Streams – The ARN of the stream. Amazon Simple Queue Service – The ARN of the queue. Amazon Managed Streaming for Apache Kafka – The ARN of the cluster or the ARN of the VPC connection (for [cross-account event source mappings](https://docs.aws.amazon.com/lambda/latest/dg/with-msk.html#msk-multi-vpc)). Amazon MQ – The ARN of the broker. Amazon DocumentDB – The ARN of the DocumentDB change stream.
SelfManagedKafkaEventSourceConfig?	object	no	The identifier for the Kafka consumer group to join. The consumer group ID must be unique among all your Kafka event sources. After creating a Kafka event source mapping with the consumer group ID specified, you cannot update this value. For more information, see [Customizable consumer group ID](https://docs.aws.amazon.com/lambda/latest/dg/with-kafka-process.html#services-smaa-topic-add).
DocumentDBEventSourceConfig?	object	no	Determines what DocumentDB sends to your event stream during document update operations. If set to UpdateLookup, DocumentDB sends a delta describing the changes, along with a copy of the entire document. Otherwise, DocumentDB sends only a partial document that contains the changes.
TumblingWindowInSeconds?	number	no	(Kinesis and DynamoDB Streams only) The duration in seconds of a processing window for DynamoDB and Kinesis Streams event sources. A value of 0 seconds indicates no tumbling window.
BisectBatchOnFunctionError?	boolean	no	(Kinesis and DynamoDB Streams only) If the function returns an error, split the batch in two and retry. The default value is false. When using BisectBatchOnFunctionError, check the BatchSize parameter in the OnFailure destination message's metadata. The BatchSize could be greater than 1 since LAM consolidates failed messages metadata when writing to the OnFailure destination.
MaximumRecordAgeInSeconds?	number	no	(Kinesis, DynamoDB Streams, Amazon MSK, and self-managed Apache Kafka) Discard records older than the specified age. The default value is -1, which sets the maximum age to infinite. When the value is set to infinite, Lambda never discards old records. The minimum valid value for maximum record age is 60s. Although values less than 60 and greater than -1 fall within the parameter's absolute range, they are not allowed
StartingPositionTimestamp?	number	no	With StartingPosition set to AT_TIMESTAMP, the time from which to start reading, in Unix time seconds. StartingPositionTimestamp cannot be in the future.
LoggingConfig?	object	no	Set this property to filter the system logs for your function that Lambda sends to CloudWatch. Lambda only sends system logs at the selected level of detail and lower, where DEBUG is the highest level and WARN is the lowest.
Queues?	array	no	(Amazon MQ) The name of the Amazon MQ broker destination queue to consume.
FunctionResponseTypes?	array	no	(Kinesis, DynamoDB Streams, and SQS) A list of current response type enums applied to the event source mapping. Valid Values: ReportBatchItemFailures

fn create()

Create a Lambda EventSourceMapping

fn get(identifier: string)

Get a Lambda EventSourceMapping

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda EventSourceMapping

fn update()

Update a Lambda EventSourceMapping

fn delete(identifier: string)

Delete a Lambda EventSourceMapping

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda EventSourceMapping

fn sync()

Sync Lambda EventSourceMapping state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda EventSourceMapping resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

function.tsv2026.09.03.1

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
FunctionScalingConfig?	object	no	The minimum number of execution environments to maintain for the function.
Description?	string	no	A description of the function.
TracingConfig?	object	no	The tracing mode.
VpcConfig?	object	no	Allows outbound IPv6 traffic on VPC functions that are connected to dual-stack subnets.
RuntimeManagementConfig?	object	no	Specify the runtime update mode. Auto (default) - Automatically update to the most recent and secure runtime version using a [Two-phase runtime version rollout](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-two-phase). This is the best choice for most customers to ensure they always benefit from runtime updates. FunctionUpdate - LAM updates the runtime of you function to the most recent and secure runtime version when you update your function. This approach synchronizes runtime updates with function deployments, giving you control over when runtime updates are applied and allowing you to detect and mitigate rare runtime update incompatibilities early. When using this setting, you need to regularly update your functions to keep their runtime up-to-date. Manual - You specify a runtime version in your function configuration. The function will use this runtime version indefinitely. In the rare case where a new runtime version is incompatible with an existing function, this allows you to roll back your function to an earlier runtime version. For more information, see [Roll back a runtime version](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-update.html#runtime-management-rollback). Valid Values: Auto \| FunctionUpdate \| Manual
DurableConfig?	object	no	The ARN of the KMSlong (KMS) customer managed key that is used to encrypt your durable execution's payload data, including input, output, and error payloads.
ReservedConcurrentExecutions?	number	no	The number of simultaneous executions to reserve for the function.
FileSystemConfigs?	array	no	Connection settings for an Amazon EFS or Amazon S3 Files file system. To connect a function to a file system, a mount target must be available in every Availability Zone that your function connects to. If your template contains an [AWS::EFS::MountTarget](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-mounttarget.html) or [AWS::S3Files::MountTarget](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-s3files-mounttarget.html) resource, you must also specify a DependsOn attribute to ensure that the mount target is created or updated before the function. For more information about using the DependsOn attribute, see [DependsOn Attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html).
FunctionName?	string	no	The name of the Lambda function, up to 64 characters in length. If you don't specify a name, CFN generates one. If you specify a name, you cannot perform updates that require replacement of this resource. You can perform updates that require no or some interruption. If you must replace the resource, specify a new name.
Runtime?	string	no	The identifier of the function's [runtime](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html). Runtime is required if the deployment package is a.zip file archive. Specifying a runtime results in an error if you're deploying a function using a container image. The following list includes deprecated runtimes. Lambda blocks creating new functions and updating existing functions shortly after each runtime is deprecated. For more information, see [Runtime use after deprecation](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtime-deprecation-levels). For a list of all currently supported runtimes, see [Supported runtimes](https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html#runtimes-supported).
KmsKeyArn?	string	no	The ARN of the KMSlong (KMS) customer managed key that's used to encrypt the following resources: The function's [environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html#configuration-envvars-encryption). The function's [Lambda SnapStart](https://docs.aws.amazon.com/lambda/latest/dg/snapstart-security.html) snapshots. When used with SourceKMSKeyArn, the unzipped version of the.zip deployment package that's used for function invocations. For more information, see [Specifying a customer managed key for Lambda](https://docs.aws.amazon.com/lambda/latest/dg/encrypt-zip-package.html#enable-zip-custom-encryption). The optimized version of the container image that's used for function invocations. Note that this is not the same key that's used to protect your container image in the Amazon Elastic Container Registry (Amazon ECR). For more information, see [Function lifecycle](https://docs.aws.amazon.com/lambda/latest/dg/images-create.html#images-lifecycle). If you don't provide a customer managed key, Lambda uses an [owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk) or an [](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-managed-cmk).
PublishToLatestPublished?	boolean	no
PackageType?	enum	no	The type of deployment package. Set to Image for container image and set Zip for.zip file archive.
CodeSigningConfigArn?	string	no	To enable code signing for this function, specify the ARN of a code-signing configuration. A code-signing configuration includes a set of signing profiles, which define the trusted publishers for this function.
Layers?	array	no	A list of [function layers](https://docs.aws.amazon.com/lambda/latest/dg/configuration-layers.html) to add to the function's execution environment. Specify each layer by its ARN, including the version.
TenancyConfig?	object	no	Tenant isolation mode allows for invocation to be sent to a corresponding execution environment dedicated to a specific tenant ID.
Tags?	array	no	A list of [tags](https://docs.aws.amazon.com/lambda/latest/dg/tagging.html) to apply to the function. You must have the lambda:TagResource, lambda:UntagResource, and lambda:ListTags permissions for your [principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html) to manage the CFN stack. If you don't have these permissions, there might be unexpected behavior with stack-level tags propagating to the resource during resource creation and update.
ImageConfig?	object	no	Specifies the working directory. The length of the directory string cannot exceed 1,000 characters.
MemorySize?	number	no	The amount of [memory available to the function](https://docs.aws.amazon.com/lambda/latest/dg/configuration-function-common.html#configuration-memory-console) at runtime. Increasing the function memory also increases its CPU allocation. The default value is 128 MB. The value can be any multiple of 1 MB. Note that new AWS accounts have reduced concurrency and memory quotas. AWS raises these quotas automatically based on your usage. You can also request a quota increase.
DeadLetterConfig?	object	no	The Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic.
Timeout?	number	no	The amount of time (in seconds) that Lambda allows a function to run before stopping it. The default is 3 seconds. The maximum allowed value is 900 seconds. For more information, see [Lambda execution environment](https://docs.aws.amazon.com/lambda/latest/dg/runtimes-context.html).
CapacityProviderConfig?	object	no	Configuration for Lambda-managed instances used by the capacity provider.
Handler?	string	no	The name of the method within your code that Lambda calls to run your function. Handler is required if the deployment package is a.zip file archive. The format includes the file name. It can also include namespaces and other qualifiers, depending on the runtime. For more information, see [Lambda programming model](https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html).
Code?	object	no	The ARN of the KMSlong (KMS) customer managed key that's used to encrypt your function's.zip deployment package. If you don't provide a customer managed key, Lambda uses an [owned key](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#aws-owned-cmk).
Role	string	yes	The Amazon Resource Name (ARN) of the function's execution role.
LoggingConfig?	object	no	The format in which Lambda sends your function's application and system logs to CloudWatch. Select between plain text and structured JSON.
RecursiveLoop?	enum	no	The status of your function's recursive loop detection configuration. When this value is set to Allow and Lambda detects your function being invoked as part of a recursive loop, it doesn't take any action. When this value is set to Terminate and Lambda detects your function being invoked as part of a recursive loop, it stops your function being invoked and notifies you.
Environment?	object	no	Environment variable key-value pairs. For more information, see [Using Lambda environment variables](https://docs.aws.amazon.com/lambda/latest/dg/configuration-envvars.html). If the value of the environment variable is a time or a duration, enclose the value in quotes.
EphemeralStorage?	object	no	The size of the function's /tmp directory.
Architectures?	array	no	The instruction set architecture that the function supports. Enter a string array with one of the valid values (arm64 or x86_64). The default value is x86_64.

fn create()

Create a Lambda Function

fn get(identifier: string)

Get a Lambda Function

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Function

fn update()

Update a Lambda Function

fn delete(identifier: string)

Delete a Lambda Function

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Function

fn sync()

Sync Lambda Function state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda Function resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

layer_version.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CompatibleRuntimes?	array	no	A list of compatible function runtimes. Used for filtering with ListLayers and ListLayerVersions.
LicenseInfo?	string	no	The layer's software license.
Description?	string	no	The description of the version.
LayerName?	string	no	The name or Amazon Resource Name (ARN) of the layer.
Content?	object	no	For versioned objects, the version of the layer archive object to use.
CompatibleArchitectures?	array	no	A list of compatible instruction set architectures.

fn create()

Create a Lambda LayerVersion

fn get(identifier: string)

Get a Lambda LayerVersion

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda LayerVersion

fn delete(identifier: string)

Delete a Lambda LayerVersion

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda LayerVersion

fn sync()

Sync Lambda LayerVersion state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda LayerVersion resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

layer_version_permission.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Action	string	yes	The API action that grants access to the layer.
LayerVersionArn	string	yes	The name or Amazon Resource Name (ARN) of the layer.
OrganizationId?	string	no	With the principal set to *, grant permission to all accounts in the specified organization.
Principal	string	yes	An account ID, or * to grant layer usage permission to all accounts in an organization, or all AWS accounts (if organizationId is not specified).

fn create()

Create a Lambda LayerVersionPermission

fn get(identifier: string)

Get a Lambda LayerVersionPermission

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda LayerVersionPermission

fn delete(identifier: string)

Delete a Lambda LayerVersionPermission

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda LayerVersionPermission

fn sync()

Sync Lambda LayerVersionPermission state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda LayerVersionPermission resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

microvm_image.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name	string	yes	Unique name for the MicroVM image within the account.
BaseImageArn	string	yes	ARN of the base MicroVM image.
BaseImageVersion	string	yes	Specific version of the base MicroVM image to use.
BuildRoleArn	string	yes	ARN of the IAM build role.
Description	string	yes	Human-readable description of the MicroVM image and its purpose.
CodeArtifact	object	yes	Code artifact for the active MicroVM image.
Logging?	object	no	Configuration for MicroVM image logging.
EgressNetworkConnectors	array	yes
CpuConfigurations	array	yes
Resources	array	yes
AdditionalOsCapabilities	array	yes
Hooks?	object	no
EnvironmentVariables	array	yes	Environment variables to set in the container during the snapshot build.
Tags?	array	no	Key-value pairs to associate with the MicroVM image for organization and management.

fn create()

Create a Lambda MicrovmImage

fn get(identifier: string)

Get a Lambda MicrovmImage

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda MicrovmImage

fn update()

Update a Lambda MicrovmImage

fn delete(identifier: string)

Delete a Lambda MicrovmImage

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda MicrovmImage

fn sync()

Sync Lambda MicrovmImage state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda MicrovmImage resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

network_connector.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Name?	string	no	A unique name for the network connector within your account and Region. Must be 1 to 64 alphanumeric characters, hyphens, or underscores.
Configuration	object	yes	The VPC egress configuration for the network connector. Specifies the subnets, security groups, and network protocol for routing outbound traffic through your VPC.
OperatorRole?	string	no	The ARN of the IAM role that Lambda assumes to manage elastic network interfaces in your VPC. This role must have permissions for ec2:CreateNetworkInterface and related describe operations.
Tags?	array	no	A list of tags to apply to the network connector. Use tags to categorize network connectors for cost allocation, access control, or operational management.

fn create()

Create a Lambda NetworkConnector

fn get(identifier: string)

Get a Lambda NetworkConnector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda NetworkConnector

fn update()

Update a Lambda NetworkConnector

fn delete(identifier: string)

Delete a Lambda NetworkConnector

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda NetworkConnector

fn sync()

Sync Lambda NetworkConnector state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda NetworkConnector resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

permission.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Action	string	yes	The action that the principal can use on the function. For example, lambda:InvokeFunction or lambda:GetFunction.
EventSourceToken?	string	no	For Alexa Smart Home functions, a token that the invoker must supply.
FunctionName	string	yes	The name or ARN of the Lambda function, version, or alias. Name formats Function name – my-function (name-only), my-function:v1 (with alias). Function ARN – arn:aws:lambda:us-west-2:123456789012:function:my-function. Partial ARN – 123456789012:function:my-function. You can append a version number or alias to any of the formats. The length constraint applies only to the full ARN. If you specify only the function name, it is limited to 64 characters in length.
FunctionUrlAuthType?	enum	no	The type of authentication that your function URL uses. Set to AWS_IAM if you want to restrict access to authenticated users only. Set to NONE if you want to bypass IAM authentication to create a public endpoint. For more information, see [Control access to Lambda function URLs](https://docs.aws.amazon.com/lambda/latest/dg/urls-auth.html).
InvokedViaFunctionUrl?	boolean	no	Indicates whether the permission applies when the function is invoked through a function URL.
Principal	string	yes	The AWS-service, AWS-account, IAM user, or IAM role that invokes the function. If you specify a service, use SourceArn or SourceAccount to limit who can invoke the function through that service.
PrincipalOrgID?	string	no	The identifier for your organization in AOlong. Use this to grant permissions to all the AWS-accounts under this organization.
SourceAccount?	string	no	For AWS-service, the ID of the AWS-account that owns the resource. Use this together with SourceArn to ensure that the specified account owns the resource. It is possible for an Amazon S3 bucket to be deleted by its owner and recreated by another account.
SourceArn?	string	no	For AWS-services, the ARN of the AWS resource that invokes the function. For example, an Amazon S3 bucket or Amazon SNS topic. Note that Lambda configures the comparison using the StringLike operator.

fn create()

Create a Lambda Permission

fn get(identifier: string)

Get a Lambda Permission

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Permission

fn delete(identifier: string)

Delete a Lambda Permission

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Permission

fn sync()

Sync Lambda Permission state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda Permission resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

resource_policy.tsv2026.09.10.1

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ResourceArn	string	yes	The Amazon Resource Name (ARN) of the LAM resource you want to add the policy to. For a function, you can use a qualified or an unqualified ARN. The value must be a complete ARN, and the operation does not accept wildcard characters.
PolicyDocument	record	yes	The policy document you want to add to your LAM resource. This is formatted as a JSON string. For more information, see [Working with resource-based policies in](https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html) in the Developer Guide.

fn create()

Create a Lambda ResourcePolicy

fn get(identifier: string)

Get a Lambda ResourcePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda ResourcePolicy

fn update()

Update a Lambda ResourcePolicy

fn delete(identifier: string)

Delete a Lambda ResourcePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda ResourcePolicy

fn sync()

Sync Lambda ResourcePolicy state from AWS

url.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
TargetFunctionArn	string	yes	The Amazon Resource Name (ARN) of the function associated with the Function URL.
Qualifier?	string	no	The alias qualifier for the target function. If TargetFunctionArn is unqualified then Qualifier must be passed.
AuthType	enum	yes	Can be either AWS_IAM if the requests are authorized via IAM, or NONE if no authorization is configured on the Function URL.
InvokeMode?	enum	no	The invocation mode for the function's URL. Set to BUFFERED if you want to buffer responses before returning them to the client. Set to RESPONSE_STREAM if you want to stream responses, allowing faster time to first byte and larger response payload sizes. If not set, defaults to BUFFERED.
Cors?	object	no	Specifies whether credentials are included in the CORS request.

fn create()

Create a Lambda Url

fn get(identifier: string)

Get a Lambda Url

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Url

fn update()

Update a Lambda Url

fn delete(identifier: string)

Delete a Lambda Url

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Url

fn sync()

Sync Lambda Url state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda Url resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

version.tsv2026.08.17.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
CodeSha256?	string	no	Only publish a version if the hash value matches the value that's specified. Use this option to avoid publishing a version if the function code has changed since you last updated it. Updates are not supported for this property.
Description?	string	no	A description for the version to override the description in the function configuration. Updates are not supported for this property.
FunctionName	string	yes	The name of the Lambda function.
ProvisionedConcurrencyConfig?	object	no	The amount of provisioned concurrency to allocate for the version.
RuntimePolicy?	object	no	The ARN of the runtime the function is configured to use. If the runtime update mode is manual, the ARN is returned, otherwise null is returned.
FunctionScalingConfig?	object	no	The minimum number of execution environments to maintain for the function.

fn create()

Create a Lambda Version

fn get(identifier: string)

Get a Lambda Version

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Version

fn update()

Update a Lambda Version

fn delete(identifier: string)

Delete a Lambda Version

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the Lambda Version

fn sync()

Sync Lambda Version state from AWS

fn list(maxPages?: number, resourceModel?: string)

List Lambda Version resources

Argument	Type	Required	Description
maxPages?	number	no	Maximum number of pages to fetch (default: 10)
resourceModel?	string	no	JSON resource model for parent-scoped listing (e.g. parent identifier)

03Previous Versions19

2026.09.10.1Sep 10, 2026

Updated: resource_policy

2026.09.09.1Sep 9, 2026

2026.09.08.1Sep 8, 2026

2026.09.07.1Sep 7, 2026

2026.09.06.3Sep 7, 2026

2026.09.06.1Sep 6, 2026

2026.09.05.1Sep 5, 2026

2026.09.04.1Sep 4, 2026

2026.09.02.1Sep 2, 2026

2026.09.01.1Sep 1, 2026

2026.08.31.1Aug 31, 2026

2026.08.30.1Aug 30, 2026

2026.08.29.1Aug 29, 2026

2026.08.28.1Aug 28, 2026

Updated: resource_policy

2026.08.27.1Aug 27, 2026

Updated: function

2026.08.26.1Aug 26, 2026

2026.08.25.6Aug 25, 2026

2026.08.25.5Aug 25, 2026

2026.08.24.6Aug 25, 2026

04Stats

100 / 100

Downloads

711

Archive size

3.4 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit2/2earned
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

05Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

06Labels

#aws #lambda #cloud #infrastructure