# aws_lambda

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [cloud-data-platform-full.txt](https://docs.redpanda.com/cloud-data-platform-full.txt)

---
title: aws_lambda
latest-operator-version: v26.1.4
latest-console-tag: v3.7.3
latest-connect-version: 4.93.0
latest-redpanda-tag: v26.1.9
docname: connect/components/processors/aws_lambda
page-component-name: cloud-data-platform
page-version: master
page-component-version: master
page-component-title: Cloud
page-relative-src-path: connect/components/processors/aws_lambda.adoc
page-edit-url: https://github.com/redpanda-data/cloud-docs/edit/main/modules/develop/pages/connect/components/processors/aws_lambda.adoc
page-git-created-date: "2024-09-09"
page-git-modified-date: "2026-05-26"
---

<!-- Source: https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/aws_lambda.md -->

**Available in:** Cloud, [Self-Managed](https://docs.redpanda.com/connect/components/processors/aws_lambda/%20%22View%20the%20Self-Managed%20version%20of%20this%20component%22)

Invokes an AWS lambda for each message. The contents of the message is the payload of the request, and the result of the invocation will become the new contents of the message.

#### Common

```yml
processors:
  label: ""
  aws_lambda:
    parallel: false
    function: "" # No default (required)
```

#### Advanced

```yml
processors:
  label: ""
  aws_lambda:
    parallel: false
    function: "" # No default (required)
    rate_limit: ""
    region: "" # No default (optional)
    endpoint: "" # No default (optional)
    tcp:
      connect_timeout: 0s
      keep_alive:
        idle: 15s
        interval: 15s
        count: 9
      tcp_user_timeout: 0s
    credentials:
      profile: "" # No default (optional)
      id: "" # No default (optional)
      secret: "" # No default (optional)
      token: "" # No default (optional)
      from_ec2_role: "" # No default (optional)
      role: "" # No default (optional)
      role_external_id: "" # No default (optional)
    timeout: 5s
    retries: 3
```

The `rate_limit` field can be used to specify a rate limit [resource](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/rate_limits/about/) to cap the rate of requests across parallel components service wide.

In order to map or encode the payload to a specific request body, and map the response back into the original payload instead of replacing it entirely, you can use the [`branch` processor](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/branch/).

## [](#error-handling)Error handling

When Redpanda Connect is unable to connect to the AWS endpoint or is otherwise unable to invoke the target lambda function it will retry the request according to the configured number of retries. Once these attempts have been exhausted the failed message will continue through the pipeline with it’s contents unchanged, but flagged as having failed, allowing you to use [standard processor error handling patterns](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/error_handling/).

However, if the invocation of the function is successful but the function itself throws an error, then the message will have it’s contents updated with a JSON payload describing the reason for the failure, and a metadata field `lambda_function_error` will be added to the message allowing you to detect and handle function errors with a [`branch`](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/branch/):

```yaml
pipeline:
  processors:
    - branch:
        processors:
          - aws_lambda:
              function: foo
        result_map: |
          root = if meta().exists("lambda_function_error") {
            throw("Invocation failed due to %v: %v".format(this.errorType, this.errorMessage))
          } else {
            this
          }
output:
  switch:
    retry_until_success: false
    cases:
      - check: errored()
        output:
          reject: ${! error() }
      - output:
          resource: somewhere_else
```

## [](#credentials)Credentials

By default Redpanda Connect will use a shared credentials file when connecting to AWS services. It’s also possible to set them explicitly at the component level, allowing you to transfer data across accounts. You can find out more in [Amazon Web Services](https://docs.redpanda.com/cloud-data-platform/develop/connect/guides/cloud/aws/).

## [](#examples)Examples

### [](#branched-invoke)Branched Invoke

This example uses a [`branch` processor](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/branch/) to map a new payload for triggering a lambda function with an ID and username from the original message, and the result of the lambda is discarded, meaning the original message is unchanged.

```yaml
pipeline:
  processors:
    - branch:
        request_map: '{"id":this.doc.id,"username":this.user.name}'
        processors:
          - aws_lambda:
              function: trigger_user_update
```

## [](#fields)Fields

### [](#credentials-2)`credentials`

Optional manual configuration of AWS credentials to use. More information can be found in [Amazon Web Services](https://docs.redpanda.com/cloud-data-platform/develop/connect/guides/cloud/aws/).

**Type**: `object`

### [](#credentials-from_ec2_role)`credentials.from_ec2_role`

Use the credentials of a host EC2 machine configured to assume [an IAM role associated with the instance](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2.html).

**Type**: `bool`

### [](#credentials-id)`credentials.id`

The ID of credentials to use.

**Type**: `string`

### [](#credentials-profile)`credentials.profile`

A profile from `~/.aws/credentials` to use.

**Type**: `string`

### [](#credentials-role)`credentials.role`

A role ARN to assume.

**Type**: `string`

### [](#credentials-role_external_id)`credentials.role_external_id`

An external ID to provide when assuming a role.

**Type**: `string`

### [](#credentials-secret)`credentials.secret`

The secret for the credentials being used.

> ⚠️ **CAUTION**
>
> This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see [Manage Secrets](https://docs.redpanda.com/cloud-data-platform/develop/connect/configuration/secret-management/) before adding it to your configuration.

**Type**: `string`

### [](#credentials-token)`credentials.token`

The token for the credentials being used, required when using short term credentials.

**Type**: `string`

### [](#endpoint)`endpoint`

Allows you to specify a custom endpoint for the AWS API.

**Type**: `string`

### [](#function)`function`

The function to invoke.

**Type**: `string`

### [](#parallel)`parallel`

Whether messages of a batch should be dispatched in parallel.

**Type**: `bool`

**Default**: `false`

### [](#rate_limit)`rate_limit`

An optional [`rate_limit`](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/rate_limits/about/) to throttle invocations by.

**Type**: `string`

**Default**: `""`

### [](#region)`region`

The AWS region to target.

**Type**: `string`

### [](#retries)`retries`

The maximum number of retry attempts for each message.

**Type**: `int`

**Default**: `3`

### [](#tcp)`tcp`

TCP socket configuration.

**Type**: `object`

### [](#tcp-connect_timeout)`tcp.connect_timeout`

Maximum amount of time a dial will wait for a connect to complete. Zero disables.

**Type**: `string`

**Default**: `0s`

### [](#tcp-keep_alive)`tcp.keep_alive`

TCP keep-alive probe configuration.

**Type**: `object`

### [](#tcp-keep_alive-count)`tcp.keep_alive.count`

Maximum unanswered keep-alive probes before dropping the connection. Zero defaults to 9.

**Type**: `int`

**Default**: `9`

### [](#tcp-keep_alive-idle)`tcp.keep_alive.idle`

Duration the connection must be idle before sending the first keep-alive probe. Zero defaults to 15s. Negative values disable keep-alive probes.

**Type**: `string`

**Default**: `15s`

### [](#tcp-keep_alive-interval)`tcp.keep_alive.interval`

Duration between keep-alive probes. Zero defaults to 15s.

**Type**: `string`

**Default**: `15s`

### [](#tcp-tcp_user_timeout)`tcp.tcp_user_timeout`

Maximum time to wait for acknowledgment of transmitted data before killing the connection. Linux-only (kernel 2.6.37+), ignored on other platforms. When enabled, keep\_alive.idle must be greater than this value per RFC 5482. Zero disables.

**Type**: `string`

**Default**: `0s`

### [](#timeout)`timeout`

The maximum period of time to wait before abandoning an invocation.

**Type**: `string`

**Default**: `5s`