Serverless on AWS: Lambda Functions and Their Infrastructure With QuickInfra

"Serverless" doesn't mean no infrastructure — it means someone else manages the servers. Lambda functions still require IAM roles, execution environments, event triggers, networking configuration (if they need VPC access), monitoring, and dead letter queue handling. QuickInfra manages this infrastructure layer for Lambda-based workloads.

Lambda Function IAM Roles

Every Lambda function needs an execution role — the IAM identity it assumes when running. The execution role needs at minimum the AWSLambdaBasicExecutionRole managed policy (permission to write CloudWatch Logs). For VPC-connected Lambdas, AWSLambdaVPCAccessExecutionRole is also required.

Beyond the baseline, the function only needs the permissions it actually uses: if a Lambda reads from DynamoDB, its role gets dynamodb:GetItem on the specific table. QuickInfra generates scoped execution role policies from your function configuration.

VPC Configuration

Lambdas that need to access resources in your VPC (RDS, ElastiCache, internal APIs) must be VPC-configured. VPC-connected Lambdas have higher cold start times and require ENI quota headroom in your VPC. QuickInfra places VPC-connected Lambdas in private subnets (not isolated subnets — they need outbound internet access through NAT Gateway for external API calls).

Event Source Mappings

Lambda functions are triggered by events. QuickInfra supports configuring event source mappings for:

• SQS: Lambda polls the queue, processes messages in batches
• DynamoDB Streams: Lambda processes change events from a table
• Kinesis Data Streams: Lambda processes records from a stream
• EventBridge: Lambda responds to scheduled events or custom event patterns
• S3: Lambda responds to object creation/deletion events

Each event source mapping has configuration: batch size, concurrency limits, error handling, and filtering.

Dead Letter Queues

When a Lambda invocation fails, the failed event can be sent to a Dead Letter Queue (SQS) or SNS topic. QuickInfra configures DLQs for all asynchronous Lambda invocations. Without a DLQ, failed asynchronous events disappear silently.

Monitoring

CloudWatch Logs are configured automatically for every Lambda function. QuickInfra adds CloudWatch alarms for: error rate above threshold, throttle rate above threshold, duration approaching timeout (if a function that should complete in 1 second takes 25 of a 30-second timeout, that's a warning), and concurrent execution count approaching account limit.