> ## Documentation Index > Fetch the complete documentation index at: https://www.ravion.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Lambda Function inputs: AWS account & region to builder config > Reference the Lambda Function module's AWS account & region, Lambda function, Zip package, Build config, Docker, Nixpacks and more inputs. **Type:** `rvn-lambda` / **Latest version:** `2.1.0` See [Lambda Function module reference](/docs/module-definitions/catalog/rvn-lambda) for the full module page. ### AWS account & region **aws\_account\_id** `string` *required* **AWS account.** * Immutable after creation **aws\_region** `string` *required* **Region.** * Immutable after creation ### Lambda function config **lambda\_type** `string` *required* **Lambda type.** * Default: `regional` * Allowed values: `regional` (Regional Lambda), `edge` (CloudFront Lambda\@Edge) * Immutable after creation **name** `string` *required* **Function name.** Name for the Lambda function and related resources. * Default: `<>-<>-<>` * Immutable after creation * Pattern: `^[A-Za-z0-9_-]{1,64}$` — 1-64 letters, numbers, underscores, or hyphens. **description** `string` **Function description.** Description shown for the Lambda function in AWS. **package\_type** `string` *required* **Package type.** * Default: `Zip` * Allowed values: `Zip` (Zip package), `Image` (Container image) * Immutable after creation **architecture** `string` *required* **Architecture.** CPU architecture used by the function. * Default: `x86_64` * Allowed values: `x86_64`, `arm64` * Shown when: `{"lambda_type":"regional"}` **version\_publishing\_enabled** `boolean` **Version publishing.** Publish a new immutable Lambda version on function updates. Required for Lambda\@Edge and aliases that target published versions. * Default: `false` * Shown when: `{"lambda_type":"regional"}` ### Zip package **runtime** `string` *required* **Runtime.** Lambda runtime for Zip packages. * Default: `$values:first` * Allowed values: `nodejs24.x` (Node.js 24.x), `nodejs22.x` (Node.js 22.x), `nodejs20.x` (Node.js 20.x), `python3.13` (Python 3.13), `python3.12` (Python 3.12), `python3.11` (Python 3.11), `ruby3.4` (Ruby 3.4), `ruby3.3` (Ruby 3.3), `java21` (Java 21), `java17` (Java 17), `dotnet8` (.NET 8), `provided.al2023` (Go provided AL2023) * Shown when: `{"package_type":"Zip"}` **handler** `string` *required* **Handler.** Function entrypoint for the zip package, such as index.handler. * Shown when: `{"package_type":"Zip"}` **s3\_bucket** `string` **Package S3 bucket.** S3 bucket containing the deployment package. Leave empty to create a managed code bucket. * Shown when: `{"package_type":"Zip"}` **s3\_key** `string` **Package S3 key.** S3 key of the deployment package. Required when Package S3 bucket is set. * Shown when: `{"package_type":"Zip"}` **code\_bucket\_name** `string` **Code bucket name.** Name for the s3 bucket used for Lambda zip artifacts. Must be globally unique. Defaults to \-code-\. * Immutable after creation * Pattern: `^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$` — Use a valid S3 bucket name: lowercase letters, numbers, hyphens, and periods; start and end with a letter or number. * Shown when: `{"package_type":"Zip"}` **code\_bucket\_force\_destroy\_enabled** `boolean` **Force destroy code bucket.** Delete the code bucket even when it contains package objects during stack destroy. * Default: `true` * Shown when: `{"package_type":"Zip"}` **placeholder\_object\_key** `string` **Bootstrap object key.** S3 key for the initial bootstrap deployment package in the managed code bucket. * Default: `bootstrap-package.zip` * Shown when: `{"package_type":"Zip"}` ### Build config **build\_source** `string` *required* **Build source.** * Default: `dockerfile` * Allowed values: `dockerfile` (Dockerfile), `s3_package` (Pull from S3), `image_registry` (Pull from image registry) **source\_repo** `gitrepo` *required* **Git repository.** Repository containing the application source for Dockerfile or Railpack builds. * Shown when: `{"build_source":["nixpacks","dockerfile"]}` **source\_base\_path** `string` **Source base path.** Repository-relative source and build root. * Default: `.` * Shown when: `{"build_source":["nixpacks","dockerfile"]}` **output\_directory** `string` *required* **Package output directory.** Directory inside the built image that contains the Lambda package files. * Default: `/app` * Shown when: `{"build_source":["nixpacks","dockerfile"],"package_type":"Zip"}` **image\_repository** `string` *required* **Image repository.** ECR repository URI without a tag or digest, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-function. The repository must be in the same region as the function. A repository in a different AWS account works when its repository policy grants pull access to the function's account and the Lambda service principal. * Shown when: `{"build_source":"image_registry","package_type":"Image"}` **initial\_image\_ref** `string` *required* **Initial image tag or digest.** Tag or digest used only to create the function before its first deployment. It must already exist in the image repository above. Deployments promote the tag or digest you pass at deploy time; changing this value afterward has no effect. Do not include the repository URI. * Shown when: `{"build_source":"image_registry","package_type":"Image"}` **image\_start\_command** `string_array` **Start command.** Optional command arguments that override the image default command (CMD). Leave empty to use the image default. * Default: `[]` * Shown when: `{"build_source":"image_registry","lambda_type":"regional","package_type":"Image"}` **image\_entry\_point** `string_array` **Entry point.** Optional entry point arguments that override the image default ENTRYPOINT. * Default: `[]` * Shown when: `{"build_source":"image_registry","lambda_type":"regional","package_type":"Image"}` **image\_working\_directory** `string` **Working directory.** Optional working directory override inside the image. * Shown when: `{"build_source":"image_registry","lambda_type":"regional","package_type":"Image"}` ### Docker **dockerfile** `string` **Dockerfile path.** Path to the Dockerfile to use for the build, relative to the repository root or configured source base path. * Shown when: `{"build_source":"dockerfile"}` **dockerfile\_context** `string` **Docker build context path.** Directory to use as the Docker build context, relative to the repository root or configured source base path. * Shown when: `{"build_source":"dockerfile"}` ### Nixpacks **nixpacks\_install\_cmd** `string` **Install command.** * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_build\_cmd** `string` **Build command.** * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_start\_cmd** `string` **Start command.** * Shown when: `{"build_source":"nixpacks","package_type":"Image"}` **nixpacks\_config\_file\_path** `string` **Nixpacks config file path.** Path to a custom Nixpacks config file, relative to the repository root or configured source base path. * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_build\_path** `string` **Nixpacks build path.** Application path for Nixpacks to build, relative to the repository root or configured source base path. * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_version** `string` **Nixpacks version.** Optional Nixpacks version to use for the build. Leave blank to use the default version. * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_nix\_pkgs** `string_array` **Nix packages.** Additional Nix packages to install during the Nixpacks build. * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_apt\_pkgs** `string_array` **APT packages.** Additional APT packages to install during the Nixpacks build. * Shown when: `{"build_source":"nixpacks"}` **nixpacks\_nix\_libs** `string_array` **Nix libraries.** Additional Nix libraries to make available during the Nixpacks build. * Shown when: `{"build_source":"nixpacks"}` ### Runtime configuration **memory\_size** `number` *required* **Memory (MB).** Memory allocated to the function. Lambda CPU scales with memory. * Default: `128` * Min: `128` * Max: `10240` * Shown when: `{"lambda_type":"regional"}` **timeout** `number` *required* **Timeout (secs).** Maximum runtime for a single invocation. * Default: `5` * Min: `1` * Max: `900` * Shown when: `{"lambda_type":"regional"}` **ephemeral\_storage\_size** `number` **Ephemeral storage (MB).** Size of the function's /tmp directory. * Default: `512` * Min: `512` * Max: `10240` * Shown when: `{"lambda_type":"regional"}` **layers** `string_array` **Lambda layers.** Versioned Lambda layer ARNs to attach to the function. * Default: `[]` * Shown when: `{"lambda_type":"regional","package_type":"Zip"}` **reserved\_concurrent\_executions** `number` **Reserved concurrency.** Reserved concurrent executions for this function. Use -1 to remove limits. * Min: `-1` * Shown when: `{"lambda_type":"regional"}` **kms\_key\_arn** `string` **Environment KMS key ARN.** Optional customer-managed KMS key ARN used to encrypt environment variables. * Shown when: `{"lambda_type":"regional"}` **tracing\_mode** `string` **X-Ray tracing.** Choose whether Lambda actively traces invocations with AWS X-Ray. * Default: `PassThrough` * Allowed values: `PassThrough` (Pass through), `Active` * Shown when: `{"lambda_type":"regional"}` **code\_signing\_config\_arn** `string` **Code signing config ARN.** Optional Lambda code signing configuration ARN. * Shown when: `{"lambda_type":"regional","package_type":"Zip"}` **dead\_letter\_target\_arn** `string` **Dead-letter target ARN.** Optional SQS queue or SNS topic ARN for asynchronous invocation failures. * Shown when: `{"lambda_type":"regional"}` **file\_system\_configs** `object_array` **File systems.** EFS access points mounted into the function. * Default: `[]` * Shown when: `{"lambda_type":"regional"}` **item fields** **arn** `string` *required* **EFS access point ARN.** EFS access point ARN. **local\_mount\_path** `string` *required* **Local mount path.** Mount path inside the function. AWS requires paths under /mnt/. ### Environment variables **build\_environment\_variables** `object` **Build environment variables.** Only available during the build, not at runtime. * Shown when: `{"build_source":["nixpacks","dockerfile"]}` **dockerfile\_environment\_variable\_injection\_enabled** `boolean` **Inject environment variables in Dockerfile.** Pass build environment variables into Dockerfile builds as build arguments. * Default: `false` * Shown when: `{"build_source":"dockerfile"}` **environment\_variables** `object` **Runtime environment variables.** Environment variables passed to the Lambda function. * Default: `{}` * Shown when: `{"lambda_type":"regional"}` ### VPC config **vpc\_config\_enabled** `boolean` **VPC access.** Optional. Attach the Lambda function to a VPC only when it needs private network access. * Default: `false` * Shown when: `{"lambda_type":"regional"}` **network** `$ref:rvn-aws-network` *required* **VPC network.** Optional VPC network for Lambda VPC access. Leave empty for a Lambda function that does not attach to a VPC. * Immutable after creation * Shown when: `{"lambda_type":"regional","vpc_config_enabled":true}` Set `network` to `null`. Mapped inputs for `network`: set these keys alongside `network`, not inside it, when supplying existing infrastructure instead of a module reference. **vpc\_id** `string` **VPC ID.** * Default: `<>` * Immutable after creation **private\_subnet\_ids** `string_array` **Private subnet IDs.** Private subnet IDs from the selected VPC network. * Default: `<>` * Immutable after creation **public\_subnet\_ids** `string_array` **Public subnet IDs.** Public subnet IDs from the selected VPC network. * Default: `<>` * Immutable after creation **private\_subnet\_placement\_enabled** `boolean` **Run in private subnets.** Use private subnets from the selected VPC network. Turn off to use public subnets. * Default: `true` * Shown when: `{"lambda_type":"regional","vpc_config_enabled":true}` **vpc\_security\_group\_ids** `string_array` *required* **Security group IDs.** Security group IDs to attach to the Lambda function ENIs. * Shown when: `{"lambda_type":"regional","vpc_config_enabled":true}` **vpc\_ipv6\_allowed\_for\_dual\_stack** `boolean` **IPv6 allowed for dual stack.** Allow outbound IPv6 for dual-stack subnets. * Default: `false` * Shown when: `{"lambda_type":"regional","vpc_config_enabled":true}` ### IAM permissions **role\_creation\_enabled** `boolean` **Create IAM role.** Create and manage the Lambda execution role in this module. * Default: `true` * Immutable after creation **role\_arn** `string` *required* **Existing role ARN.** IAM role ARN to use when this module should not create the role. * Shown when: `{"role_creation_enabled":false}` **role\_name** `string` **Role name.** Custom IAM role name. Defaults to \-lambda-role. * Immutable after creation * Shown when: `{"role_creation_enabled":true}` **role\_path** `string` **Role path.** IAM path for the created role. * Default: `/` * Immutable after creation * Shown when: `{"role_creation_enabled":true}` **role\_permissions\_boundary** `string` **Permissions boundary ARN.** Optional IAM permissions boundary for the created role. * Shown when: `{"role_creation_enabled":true}` **basic\_execution\_policy\_enabled** `boolean` **Basic execution policy.** Attach AWSLambdaBasicExecutionRole to the created role. * Default: `true` * Shown when: `{"role_creation_enabled":true}` **vpc\_execution\_policy\_enabled** `boolean` **VPC execution policy.** Attach AWSLambdaVPCAccessExecutionRole to the created role when VPC config is set. * Default: `true` * Shown when: `{"lambda_type":"regional","role_creation_enabled":true}` **role\_managed\_policy\_arns** `string_array` **Managed policy ARNs.** Additional managed policies to attach to the created role. * Default: `[]` * Shown when: `{"role_creation_enabled":true}` **role\_inline\_policies** `object` **Inline role policies.** Map of inline policy name to JSON policy document for the created role. * Default: `{}` * Shown when: `{"role_creation_enabled":true}` **permissions** `object_array` **Invoke permissions.** Permission statements for services or accounts that invoke this function. * Default: `[]` * Shown when: `{"lambda_type":"regional"}` **item fields** **statement\_id** `string` **Statement ID.** Optional unique statement ID. **action** `string` *required* **Action.** Lambda action allowed by this permission. * Default: `lambda:InvokeFunction` **principal** `string` *required* **Principal.** Service principal or AWS account allowed to invoke the function. **source\_arn** `string` **Source ARN.** Optional source ARN that scopes the invoke permission. **source\_account** `string` **Source account.** Optional source AWS account ID. **qualifier** `string` **Qualifier.** Optional function version or alias qualifier. ### CloudWatch alarms **cloudwatch\_alarms\_creation\_enabled** `boolean` **Monitor invocation error rate.** Keep enabled to detect invocation failures. Disable if monitored elsewhere. Configure SNS actions or an EventBridge relay for notifications. * Default: `true` **cloudwatch\_alarm\_error\_rate\_threshold** `number` **Error rate threshold (%).** Failed invocations as a percentage of all invocations; triggers at or above this value. * Default: `1` * Min: `1` * Max: `100` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_evaluation\_periods** `number` **Consecutive alarm periods.** * Default: `1` * Min: `1` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_period** `number` **Alarm period (seconds).** * Default: `300` * Allowed values: `60` (60), `300` (300), `900` (900), `3600` (3600) * Min: `60` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_actions** `string_array` **Alarm action ARNs.** SNS topics must share the metric region. Use the overrides below for Edge. * Default: `[]` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_ok\_actions** `string_array` **Recovery action ARNs.** SNS topics must share the metric region. Use the overrides below for Edge. * Default: `[]` * Shown when: `{"cloudwatch_alarms_creation_enabled":true}` **cloudwatch\_alarm\_additional\_regions** `string_array` **Additional Edge alarm regions.** Select every region where this function executes. The origin region is always included. Update this list as traffic expands. * Default: `[]` * Shown when: `{"cloudwatch_alarms_creation_enabled":true,"lambda_type":"edge"}` **cloudwatch\_alarm\_actions\_by\_region** `object` **Alarm actions by region.** Overrides shared destinations by region. Set a region to \[] to suppress direct actions there. * Default: `{}` * Shown when: `{"cloudwatch_alarms_creation_enabled":true,"lambda_type":"edge"}` **cloudwatch\_ok\_actions\_by\_region** `object` **Recovery actions by region.** Overrides shared destinations by region. Set a region to \[] to suppress direct actions there. * Default: `{}` * Shown when: `{"cloudwatch_alarms_creation_enabled":true,"lambda_type":"edge"}` ### Logs **log\_group\_creation\_enabled** `boolean` **Create log group.** Create and manage the CloudWatch log group for this function. * Default: `true` **log\_group\_name** `string` **Log group name.** Custom CloudWatch log group name. Defaults to /aws/lambda/\{function name}. * Shown when: `{"log_group_creation_enabled":true}` **log\_retention\_days** `number` **Log retention days.** Days to retain CloudWatch logs. Use 0 to retain indefinitely. * Default: `30` * Allowed values: `0` (Never expire), `1` (1 day), `3` (3 days), `5` (5 days), `7` (7 days), `14` (14 days), `30` (30 days), `60` (60 days), `90` (90 days), `180` (180 days), `365` (1 year) * Shown when: `{"log_group_creation_enabled":true}` **log\_kms\_key\_id** `string` **Log KMS key ID.** Optional KMS key ID or ARN for log group encryption. * Shown when: `{"log_group_creation_enabled":true}` ### Function URL **function\_url\_enabled** `boolean` **Function URL.** Create an HTTPS endpoint for the function. * Default: `false` * Shown when: `{"lambda_type":"regional"}` **function\_url\_auth\_type** `string` *required* **Function URL auth type.** Choose whether the function URL requires AWS IAM authorization. * Default: `AWS_IAM` * Allowed values: `AWS_IAM` (AWS IAM), `NONE` (None) * Shown when: `{"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_invoke\_mode** `string` *required* **Function URL invoke mode.** Choose buffered responses or response streaming. * Default: `BUFFERED` * Allowed values: `BUFFERED` (Buffered), `RESPONSE_STREAM` (Response stream) * Shown when: `{"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_enabled** `boolean` **Function URL CORS.** Configure CORS headers for the function URL. * Default: `false` * Shown when: `{"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_allow\_origins** `string_array` *required* **Allowed origins.** Origins allowed to call the function URL. * Shown when: `{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_allow\_methods** `string_array` *required* **Allowed methods.** HTTP methods allowed by function URL CORS. * Default: `["GET","POST"]` * Allowed values: `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS` * Shown when: `{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_allow\_headers** `string_array` **Allowed headers.** HTTP headers allowed in CORS requests. * Default: `[]` * Shown when: `{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_allow\_credentials** `boolean` **Allow credentials.** Allow browsers to include credentials in CORS requests. * Default: `false` * Shown when: `{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_expose\_headers** `string_array` **Exposed headers.** Response headers browsers may expose to client code. * Default: `[]` * Shown when: `{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}` **function\_url\_cors\_max\_age** `number` **Max age (secs).** Seconds browsers can cache the CORS preflight response. * Min: `0` * Shown when: `{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}` ### Event sources and aliases **event\_source\_mappings** `object_array` **Event source mappings.** Event source mappings for streams, queues, and self-managed sources. Use advanced Terraform variables for uncommon nested mapping options. * Default: `[]` * Shown when: `{"lambda_type":"regional"}` **item fields** **event\_source\_arn** `string` *required* **Event source ARN.** Event source ARN, such as SQS, Kinesis, DynamoDB Streams, or MQ. **enabled** `boolean` **Enabled.** Enable this event source mapping. * Default: `true` **batch\_size** `number` **Batch size.** Number of records Lambda reads from the source per batch. * Min: `1` **maximum\_batching\_window\_in\_seconds** `number` **Maximum batching window (secs).** Maximum time in seconds to gather records before invoking the function. * Min: `0` **starting\_position** `string` **Starting position.** Starting position for stream sources. * Allowed values: `TRIM_HORIZON` (Trim horizon), `LATEST` (Latest), `AT_TIMESTAMP` (At timestamp) **destination\_config\_on\_failure\_arn** `string` **On-failure destination ARN.** Destination ARN used when Lambda cannot process records. **aliases** `object_map` **Aliases.** Lambda aliases keyed by alias name. Use aliases when callers need a stable function ARN, when routing traffic between published versions, or when integrating with services that should not point directly at \$LATEST. * Default: `{}` * Shown when: `{"lambda_type":"regional"}` **item fields** **description** `string` **Description.** Alias description. **function\_version** `string` **Function version.** Function version the alias points to. **routing\_additional\_version\_weights** `object` **Additional version weights.** Additional version weights for traffic shifting. ### Advanced Lambda settings **snap\_start\_apply\_on** `string` **SnapStart.** Enable Lambda SnapStart for published versions. AWS currently supports this for Java runtimes. * Allowed values: `PublishedVersions` (Published versions) * Shown when: `{"lambda_type":"regional","package_type":"Zip"}` ### Builder config **build\_capacity\_type** `string` *required* **Builder capacity type.** Sandbox starts fastest. EC2 spot costs less but may wait for capacity or be interrupted. * Default: `sandbox` * Allowed values: `sandbox` (Sandbox), `ec2` (EC2), `ec2-spot` (EC2 spot) * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **build\_instance\_type** `string` *required* **Builder instance type.** EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds. * Default: `c7a.4xlarge` * Shown when: `{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}` **build\_cpu** `number` *required* **Builder vCPUs.** * Default: `14` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}` **build\_memory** `number` *required* **Builder memory (GiB).** * Default: `28` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}` **build\_disk** `number` **Builder disk (GiB).** Space the build reserves on the pool host for what it writes. Larger values let fewer builds share a host. * Default: `30` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}` **build\_interruptible\_enabled** `boolean` **Interruptible build.** Lets the build run on spot hosts and start over if AWS reclaims the host. Turn off if your build commands change anything outside the build, such as running database migrations. * Default: `true` * Shown when: `{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}` **build\_execution\_environment\_id** `string` **Builder execution environment.** Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment. * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **build\_ami\_id** `string` **Builder AMI.** Optional AMI ID for build runners. Leave empty to use the default runner image. * Shown when: `{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}` **build\_default\_policies\_enabled** `boolean` **Include default build policies.** The step's built-in policies (ECR/S3 access, CloudWatch agent) stay attached alongside your Builder IAM policies. Turn off to run the build with only the policies listed below. * Default: `true` * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` **build\_iam\_policy\_arns** `string_array` **Builder IAM policies.** IAM managed policy ARNs for the EC2 build runner role, applied for the duration of each build. * Default: `[]` * Shown when: `{"build_source":["dockerfile","railpack","nixpacks"]}` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.