Lambda operations
Every Lambda operation Overcast declares — 61 of 62 implemented — with status, behaviour notes and a link to the AWS API reference for each.
61 of 62 listed operations are implemented. Back to Lambda.
Summary
| Category | ✅ Supported | ⚠️ Partial | ❌ Unsupported |
|---|---|---|---|
| Function management | 10 | ||
| Resource-based policies | 4 | 2 | |
| Code signing | 6 | ||
| Invocation | 2 | 1 | |
| Aliases & versions | 7 | ||
| Function URLs | 5 | ||
| Event source mappings | 5 | ||
| Layers | 5 | ||
| Asynchronous invocation | 5 | ||
| Concurrency & configuration | 7 | ||
| Tags | 3 |
Endpoints
Function management
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
ListFunctions | ✅ Supported | Returns all stored functions; empty list if none | docs |
CreateFunction | ✅ Supported | Stores metadata; validates Runtime against the pinned model and refuses runtimes past AWS’s block-create date; a modeled runtime with no execution image returns 501 and persists nothing; auto-creates CWL log group; VpcConfig supported; PackageType=Image runs the image Code.ImageUri names, resolving an {account}.dkr.ecr.{region}.amazonaws.com URI to the registry the emulated ECR serves, with ImageConfig EntryPoint/Command/WorkingDirectory overriding the image’s own; LoggingConfig honoured for both Text and JSON LogFormat, with ApplicationLogLevel/SystemLogLevel filtering in JSON mode; FileSystemConfigs round-trip (EFS mounts in live mode; S3 Files runtime mounts tracked in #647); TracingConfig, EphemeralStorage and KMSKeyArn are validated, stored and echoed but change nothing — X-Ray tracing is not emulated, the ephemeral storage size is not enforced on the container, and environment variables are not encrypted at rest; DeadLetterConfig is validated, stored, echoed and honoured — a failed asynchronous invocation is delivered to the SQS queue or SNS topic it names; Code.S3ObjectVersion fetches that version of the object; an unfetchable Code.S3Bucket/S3Key/S3ObjectVersion fails the create and persists nothing; answers Pending and reaches Active once the image is pulled — Failed with the reason when it cannot be — so aws lambda wait function-active returns, and LastUpdateStatus is first set when the create completes, as on AWS | docs |
DeleteFunction | ✅ Supported | Qualifier deletes only that published version, with its qualified policy and provisioned concurrency; refuses $LATEST and versions an alias references; unqualified deletes the function | docs |
GetFunction | ✅ Supported | Returns FunctionConfiguration + Code location block; State/StateReason/StateReasonCode and LastUpdateStatus/LastUpdateStatusReason/LastUpdateStatusReasonCode both report, so aws lambda wait function-active and wait function-updated return; TracingConfig and EphemeralStorage always present, defaulting to PassThrough and 512 MB as on AWS; DeadLetterConfig reported only when the function has one | docs |
GetFunctionConfiguration | ✅ Supported | Returns FunctionConfiguration only (no Code block); State/StateReason/StateReasonCode and LastUpdateStatus/LastUpdateStatusReason/LastUpdateStatusReasonCode both report, which is what the FunctionActive and FunctionUpdated waiters poll; TracingConfig and EphemeralStorage always present, defaulting to PassThrough and 512 MB as on AWS; DeadLetterConfig reported only when the function has one | docs |
UpdateFunctionCode | ✅ Supported | Updates code zip or image URI and Architectures; a new image URI is pulled and the warm environment retired; S3ObjectVersion fetches that version of the object, and a version that cannot be read leaves the function untouched; generates new RevisionId; reports LastUpdateStatus, so aws lambda wait function-updated returns — a zip deployment answers Successful because it is already applied, while a new image URI answers InProgress and settles when the pull does, to Successful or to Failed with ImageAccessDenied/InvalidImage/InternalError, and a second update or a PublishVersion inside that window is refused with ResourceConflictException | docs |
UpdateFunctionConfiguration | ✅ Supported | Presence-aware updates for supported configuration, including TracingConfig, EphemeralStorage and KMSKeyArn (recorded and echoed, never enforced) and DeadLetterConfig (an explicit empty TargetArn removes the target); a Runtime past AWS’s block-update date is refused; LoggingConfig with explicit members applies, including LogFormat JSON, but an explicitly empty LoggingConfig object still returns 501 because AWS’s semantics for it are uncaptured (#660); unsupported advanced fields fail before mutation; reports LastUpdateStatus, always Successful because the new configuration is stored before the call answers | docs |
GetFunctionCodeSigningConfig | ✅ Supported | Returns the associated config; ResourceNotFoundException when the function has none | docs |
PutFunctionCodeSigningConfig | ✅ Supported | Stores the association and validates the ARN shape; signature validation is not emulated | docs |
DeleteFunctionCodeSigningConfig | ✅ Supported | Removes the association; idempotent | docs |
Resource-based policies
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
AddPermission | ⚠️ Partial | Appends a validated statement to the function’s, version’s or alias’s policy, rendering Principal, Resource and the ArnLike/StringEquals conditions AWS builds from SourceArn, SourceAccount, EventSourceToken, PrincipalOrgID and the function-URL members; duplicate statement IDs answer ResourceConflictException, a stale RevisionId PreconditionFailedException, a policy over 20 KB PolicyLengthExceededException, and Qualifier=$LATEST is refused as it is on AWS; statements are consulted at invoke time only for service-originated invocations and only when OVERCAST_ENFORCE_LAMBDA_RESOURCE_POLICY is set (#629) — a direct client Invoke is never authorised against them, because credentials are accepted without being validated | docs |
GetPolicy | ✅ Supported | Returns the stored AWS policy document and revision ID, for the function, a version or an alias | docs |
RemovePermission | ✅ Supported | Removes a statement by ID; supports revision preconditions | docs |
GetResourcePolicy | ✅ Supported | Returns the same policy document and revision ID GetPolicy does, addressed by function, version or alias ARN; ResourceNotFoundException when the resource carries no policy | docs |
PutResourcePolicy | ⚠️ Partial | Replaces the whole policy, statements AddPermission wrote included, and preserves the full IAM statement grammar — explicit Deny, list-valued Action/Resource/Principal, arbitrary condition keys — so a document survives a Put/Get round trip unchanged; a stale RevisionId answers PreconditionFailedException and a policy over 20 KB PolicyLengthExceededException; a statement allowing every principal with no condition is refused with PublicPolicyException, unconditionally, because there is no PutPublicAccessBlockConfig here to relax it with; statements are consulted at invoke time only for service-originated invocations and only when OVERCAST_ENFORCE_LAMBDA_RESOURCE_POLICY is set (#629) | docs |
DeleteResourcePolicy | ✅ Supported | Deletes the whole policy, statements added by AddPermission included; the RevisionId query parameter is a precondition; ResourceNotFoundException when there is no policy to delete | docs |
Code signing
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateCodeSigningConfig | ✅ Supported | Stored as a real resource; AllowedPublishers required, UntrustedArtifactOnDeployment defaults to Warn | docs |
GetCodeSigningConfig | ✅ Supported | Returns the stored configuration | docs |
UpdateCodeSigningConfig | ✅ Supported | Partial update; omitted members keep their stored value | docs |
DeleteCodeSigningConfig | ✅ Supported | ResourceConflictException while a function still references it | docs |
ListCodeSigningConfigs | ✅ Supported | Region-scoped; pagination not implemented | docs |
ListFunctionsByCodeSigningConfig | ✅ Supported | Returns the ARNs of functions referencing the configuration | docs |
Invocation
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
Invoke | ✅ Supported | Container-based execution via Docker; falls back to stub when Docker unavailable; under LogFormat JSON the START/END/REPORT lines become Telemetry-API-shaped platform.start, platform.runtimeDone and platform.report records, filtered by SystemLogLevel, and function output is filtered by ApplicationLogLevel; the in-container init also reports the INIT phase as platform.initStart, platform.initRuntimeDone and platform.initReport, ordered against the phase’s own output, and Telemetry/Logs API subscribers receive every platform record in either log format — subscriptions via the Logs API (2020-08-15) and the Telemetry API (2022-07-01, schemaVersion-aware, with the documented cross-API exclusivity), invocation records carrying the runtime’s real X-Amzn-Trace-Id, platform.runtimeDone metrics and its responseLatency span measured by the in-container init, errorType Runtime.ExitError on a crashed runtime’s records, deliveries batched per the subscription’s buffering configuration, and a lost delivery reported to its subscriber as platform.logsDropped; an InvocationType=Event invocation whose function errors is retried per the function’s FunctionEventInvokeConfig (AWS’s default of twice, waiting AWS’s one minute then two, when unconfigured) and then delivered to its on-failure destination and its DeadLetterConfig target; MaximumEventAgeInSeconds is measured from acceptance and discards the event before the next attempt rather than after it, but the resulting record’s condition reads RetriesExhausted because AWS does not document a distinct value for an aged-out event; records AWS/Lambda CloudWatch metrics (Invocations, Errors, Duration, Throttles, ConcurrentExecutions) at this outcome boundary for every invocation mechanism (sync, async, function URLs, event source mappings); DryRun never invokes and so never records; Resource/ExecutedVersion metric dimensions are not recorded yet; a direct Invoke is never authorised against the function’s resource-based policy, which gates only the invocations Overcast originates for another service and only under OVERCAST_ENFORCE_LAMBDA_RESOURCE_POLICY (#629); emulator-only and off by default, a function tagged overcast:debug=true under OVERCAST_LAMBDA_DEBUGGER=true gets a step debugger port, and while a debugger client is attached the invocation clock is suspended per OVERCAST_DEBUGGER_TIMEOUT (attached, paused or strict, which keeps AWS’s timeout) — the one behavioural divergence, never observable without a debugger attached (#1939); the console’s Code tab can open that same session itself, over a WebSocket bridge on the emulator’s own port, and counts as one such client while it does; a function also tagged overcast:debug-wait=true has each invocation that finds no client attached held, after INIT and before the event is dispatched, until one attaches plus a 750 ms settle, bounded by OVERCAST_DEBUGGER_WAIT_TIMEOUT (120s) after which it runs anyway with a WARN — the function’s clock and its Lambda-Runtime-Deadline-Ms start at dispatch, so the hold spends none of the budget; never under the strict policy, and never observable without the tag (#1944) | docs |
InvokeAsync | ❌ Unsupported | stub; returns 501 | docs |
InvokeWithResponseStream | ✅ Supported | Invokes synchronously, wraps result in AWS event stream binary encoding (PayloadChunk → InvokeComplete); RequestResponse only | docs |
Aliases & versions
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
PublishVersion | ✅ Supported | Immutable snapshot of function config, reporting LastUpdateStatus Successful because nothing can update it; version numbers are monotonically incrementing integers; refused with ResourceConflictException while an update is still in progress | docs |
ListVersionsByFunction | ✅ Supported | Always includes $LATEST as first entry | docs |
CreateAlias | ✅ Supported | docs | |
UpdateAlias | ✅ Supported | docs | |
DeleteAlias | ✅ Supported | docs | |
GetAlias | ✅ Supported | docs | |
ListAliases | ✅ Supported | docs |
Function URLs
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateFunctionUrlConfig | ✅ Supported | FunctionUrl always echoes the caller’s Host (see docs/networking.md); AuthType stored but never enforced | docs |
GetFunctionUrlConfig | ✅ Supported | docs | |
UpdateFunctionUrlConfig | ✅ Supported | docs | |
DeleteFunctionUrlConfig | ✅ Supported | docs | |
ListFunctionUrlConfigs | ✅ Supported | docs |
Event source mappings
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
CreateEventSourceMapping | ✅ Supported | SQS→Lambda, DynamoDB Streams→Lambda; FunctionResponseTypes: ["ReportBatchItemFailures"] is honoured; Tags are stored and readable through ListTags | docs |
GetEventSourceMapping | ✅ Supported | docs | |
UpdateEventSourceMapping | ✅ Supported | docs | |
DeleteEventSourceMapping | ✅ Supported | docs | |
ListEventSourceMappings | ✅ Supported | Filters by FunctionName and EventSourceArn | docs |
Layers
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
PublishLayerVersion | ✅ Supported | Increments per-layer version counter; stores zip content | docs |
GetLayerVersion | ✅ Supported | Returns metadata and content info for the specified version | docs |
ListLayerVersions | ✅ Supported | Returns all versions for a layer, newest first | docs |
ListLayers | ✅ Supported | Returns distinct layer names with their latest matching version | docs |
DeleteLayerVersion | ✅ Supported | Removes the specific layer version; 404 if not found | docs |
Asynchronous invocation
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
PutFunctionEventInvokeConfig | ✅ Supported | Overwrites the configuration, removing members the request omits; MaximumRetryAttempts and MaximumEventAgeInSeconds are validated against AWS’s ranges and honoured by the async invoke path; SQS, SNS, Lambda and EventBridge destinations receive AWS’s invocation record; an S3 on-failure destination returns 501 because the record is not written to S3, and an S3 on-success destination is rejected as AWS rejects it | docs |
UpdateFunctionEventInvokeConfig | ✅ Supported | Partial update; members the request omits keep their stored value, which is the only difference from Put | docs |
GetFunctionEventInvokeConfig | ✅ Supported | ResourceNotFoundException when the function has no configuration; LastModified is Unix seconds, as AWS returns for this resource | docs |
DeleteFunctionEventInvokeConfig | ✅ Supported | Returns 204; ResourceNotFoundException when there is no configuration to delete | docs |
ListFunctionEventInvokeConfigs | ✅ Supported | Every qualifier’s configuration for the function; MaxItems is validated but the result is a single page, so NextMarker is never returned | docs |
Concurrency & configuration
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
PutFunctionConcurrency | ✅ Supported | Enforced: over-limit invokes get 429 TooManyRequestsException; 0 throttles the function entirely | docs |
GetFunctionConcurrency | ✅ Supported | A function with no reservation answers 200 with an empty body, as on AWS; a reservation of 0 is reported rather than omitted, since 0 is the documented way to switch a function off. ResourceNotFoundException is for the function itself | docs |
DeleteFunctionConcurrency | ✅ Supported | Clears reserved concurrency limit; returns 204 | docs |
PutProvisionedConcurrencyConfig | ✅ Supported | Pre-warms the requested execution environments in the background (IN_PROGRESS then READY); FAILED when Docker is unavailable | docs |
GetProvisionedConcurrencyConfig | ✅ Supported | Reports live Allocated/Available; ProvisionedConcurrencyConfigNotFoundException if not set | docs |
DeleteProvisionedConcurrencyConfig | ✅ Supported | Releases the reservation; the environments age out on the idle TTL rather than being killed | docs |
ListProvisionedConcurrencyConfigs | ✅ Supported | Single page; NextMarker is always null | docs |
Tags
| Operation | Status | Notes | AWS Docs |
|---|---|---|---|
TagResource | ✅ Supported | Function and event-source-mapping ARNs; merges tags; max 50; validates key/value lengths; rejects qualified ARNs and non-ARN resources | docs |
UntagResource | ✅ Supported | Removes specified keys; idempotent on missing keys; tagKeys is required | docs |
ListTags | ✅ Supported | Returns the resource’s tags; code-signing-config, capacity-provider and network-connector ARNs return 501 | docs |
Related
- Lambda — quick start, what works, and the differences from AWS
- All service pages