# Lambda operations 61 of 62 listed operations are implemented. Back to [Lambda](/docs/services/lambda/index.md). ## Summary | Category | ✅ Supported | ⚠️ Partial | ❌ Unsupported | | --- | --- | --- | --- | | Function management | 10 | | | | Resource-based policies | 4 | 2 | | | Code signing | 6 | | | | Invocation | 2 | | 1 | | Aliases & versions | 7 | | | | Function URLs | 5 | | | | Event source mappings | 5 | | | | Layers | 5 | | | | Asynchronous invocation | 5 | | | | Concurrency & configuration | 7 | | | | Tags | 3 | | | --- ## Endpoints ### Function management | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `ListFunctions` | ✅ Supported | Returns all stored functions; empty list if none | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctions.html) | | `CreateFunction` | ✅ Supported | Stores metadata; validates Runtime against the pinned model and refuses runtimes past AWS's block-create date; a modeled runtime with no execution image returns 501 and persists nothing; auto-creates CWL log group; VpcConfig supported; PackageType=Image runs the image Code.ImageUri names, resolving an `{account}.dkr.ecr.{region}.amazonaws.com` URI to the registry the emulated ECR serves, with ImageConfig EntryPoint/Command/WorkingDirectory overriding the image's own; LoggingConfig honoured for both Text and JSON LogFormat, with ApplicationLogLevel/SystemLogLevel filtering in JSON mode; FileSystemConfigs round-trip (EFS mounts in live mode; S3 Files runtime mounts tracked in #647); TracingConfig, EphemeralStorage and KMSKeyArn are validated, stored and echoed but change nothing — X-Ray tracing is not emulated, the ephemeral storage size is not enforced on the container, and environment variables are not encrypted at rest; DeadLetterConfig is validated, stored, echoed and honoured — a failed asynchronous invocation is delivered to the SQS queue or SNS topic it names; Code.S3ObjectVersion fetches that version of the object; an unfetchable Code.S3Bucket/S3Key/S3ObjectVersion fails the create and persists nothing; answers Pending and reaches Active once the image is pulled — Failed with the reason when it cannot be — so `aws lambda wait function-active` returns, and LastUpdateStatus is first set when the create completes, as on AWS | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunction.html) | | `DeleteFunction` | ✅ Supported | Qualifier deletes only that published version, with its qualified policy and provisioned concurrency; refuses $LATEST and versions an alias references; unqualified deletes the function | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunction.html) | | `GetFunction` | ✅ Supported | Returns FunctionConfiguration + Code location block; State/StateReason/StateReasonCode and LastUpdateStatus/LastUpdateStatusReason/LastUpdateStatusReasonCode both report, so `aws lambda wait function-active` and `wait function-updated` return; TracingConfig and EphemeralStorage always present, defaulting to PassThrough and 512 MB as on AWS; DeadLetterConfig reported only when the function has one | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunction.html) | | `GetFunctionConfiguration` | ✅ Supported | Returns FunctionConfiguration only (no Code block); State/StateReason/StateReasonCode and LastUpdateStatus/LastUpdateStatusReason/LastUpdateStatusReasonCode both report, which is what the FunctionActive and FunctionUpdated waiters poll; TracingConfig and EphemeralStorage always present, defaulting to PassThrough and 512 MB as on AWS; DeadLetterConfig reported only when the function has one | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConfiguration.html) | | `UpdateFunctionCode` | ✅ Supported | Updates code zip or image URI and Architectures; a new image URI is pulled and the warm environment retired; S3ObjectVersion fetches that version of the object, and a version that cannot be read leaves the function untouched; generates new RevisionId; reports LastUpdateStatus, so `aws lambda wait function-updated` returns — a zip deployment answers Successful because it is already applied, while a new image URI answers InProgress and settles when the pull does, to Successful or to Failed with ImageAccessDenied/InvalidImage/InternalError, and a second update or a PublishVersion inside that window is refused with ResourceConflictException | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionCode.html) | | `UpdateFunctionConfiguration` | ✅ Supported | Presence-aware updates for supported configuration, including TracingConfig, EphemeralStorage and KMSKeyArn (recorded and echoed, never enforced) and DeadLetterConfig (an explicit empty TargetArn removes the target); a Runtime past AWS's block-update date is refused; LoggingConfig with explicit members applies, including LogFormat JSON, but an explicitly empty LoggingConfig object still returns 501 because AWS's semantics for it are uncaptured (#660); unsupported advanced fields fail before mutation; reports LastUpdateStatus, always Successful because the new configuration is stored before the call answers | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html) | | `GetFunctionCodeSigningConfig` | ✅ Supported | Returns the associated config; ResourceNotFoundException when the function has none | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionCodeSigningConfig.html) | | `PutFunctionCodeSigningConfig` | ✅ Supported | Stores the association and validates the ARN shape; signature validation is not emulated | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionCodeSigningConfig.html) | | `DeleteFunctionCodeSigningConfig` | ✅ Supported | Removes the association; idempotent | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionCodeSigningConfig.html) | ### Resource-based policies | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `AddPermission` | ⚠️ Partial | Appends a validated statement to the function's, version's or alias's policy, rendering Principal, Resource and the ArnLike/StringEquals conditions AWS builds from SourceArn, SourceAccount, EventSourceToken, PrincipalOrgID and the function-URL members; duplicate statement IDs answer ResourceConflictException, a stale RevisionId PreconditionFailedException, a policy over 20 KB PolicyLengthExceededException, and Qualifier=$LATEST is refused as it is on AWS; statements are consulted at invoke time only for service-originated invocations and only when OVERCAST_ENFORCE_LAMBDA_RESOURCE_POLICY is set (#629) — a direct client Invoke is never authorised against them, because credentials are accepted without being validated | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_AddPermission.html) | | `GetPolicy` | ✅ Supported | Returns the stored AWS policy document and revision ID, for the function, a version or an alias | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetPolicy.html) | | `RemovePermission` | ✅ Supported | Removes a statement by ID; supports revision preconditions | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_RemovePermission.html) | | `GetResourcePolicy` | ✅ Supported | Returns the same policy document and revision ID GetPolicy does, addressed by function, version or alias ARN; ResourceNotFoundException when the resource carries no policy | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetResourcePolicy.html) | | `PutResourcePolicy` | ⚠️ Partial | Replaces the whole policy, statements AddPermission wrote included, and preserves the full IAM statement grammar — explicit Deny, list-valued Action/Resource/Principal, arbitrary condition keys — so a document survives a Put/Get round trip unchanged; a stale RevisionId answers PreconditionFailedException and a policy over 20 KB PolicyLengthExceededException; a statement allowing every principal with no condition is refused with PublicPolicyException, unconditionally, because there is no PutPublicAccessBlockConfig here to relax it with; statements are consulted at invoke time only for service-originated invocations and only when OVERCAST_ENFORCE_LAMBDA_RESOURCE_POLICY is set (#629) | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PutResourcePolicy.html) | | `DeleteResourcePolicy` | ✅ Supported | Deletes the whole policy, statements added by AddPermission included; the RevisionId query parameter is a precondition; ResourceNotFoundException when there is no policy to delete | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteResourcePolicy.html) | ### Code signing | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateCodeSigningConfig` | ✅ Supported | Stored as a real resource; AllowedPublishers required, UntrustedArtifactOnDeployment defaults to Warn | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateCodeSigningConfig.html) | | `GetCodeSigningConfig` | ✅ Supported | Returns the stored configuration | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetCodeSigningConfig.html) | | `UpdateCodeSigningConfig` | ✅ Supported | Partial update; omitted members keep their stored value | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateCodeSigningConfig.html) | | `DeleteCodeSigningConfig` | ✅ Supported | ResourceConflictException while a function still references it | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteCodeSigningConfig.html) | | `ListCodeSigningConfigs` | ✅ Supported | Region-scoped; pagination not implemented | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListCodeSigningConfigs.html) | | `ListFunctionsByCodeSigningConfig` | ✅ Supported | Returns the ARNs of functions referencing the configuration | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionsByCodeSigningConfig.html) | ### Invocation | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `Invoke` | ✅ Supported | Container-based execution via Docker; falls back to stub when Docker unavailable; under LogFormat JSON the START/END/REPORT lines become Telemetry-API-shaped platform.start, platform.runtimeDone and platform.report records, filtered by SystemLogLevel, and function output is filtered by ApplicationLogLevel; the in-container init also reports the INIT phase as platform.initStart, platform.initRuntimeDone and platform.initReport, ordered against the phase's own output, and Telemetry/Logs API subscribers receive every platform record in either log format — subscriptions via the Logs API (2020-08-15) and the Telemetry API (2022-07-01, schemaVersion-aware, with the documented cross-API exclusivity), invocation records carrying the runtime's real X-Amzn-Trace-Id, platform.runtimeDone metrics and its responseLatency span measured by the in-container init, errorType Runtime.ExitError on a crashed runtime's records, deliveries batched per the subscription's buffering configuration, and a lost delivery reported to its subscriber as platform.logsDropped; an InvocationType=Event invocation whose function errors is retried per the function's FunctionEventInvokeConfig (AWS's default of twice, waiting AWS's one minute then two, when unconfigured) and then delivered to its on-failure destination and its DeadLetterConfig target; MaximumEventAgeInSeconds is measured from acceptance and discards the event before the next attempt rather than after it, but the resulting record's condition reads RetriesExhausted because AWS does not document a distinct value for an aged-out event; records AWS/Lambda CloudWatch metrics (Invocations, Errors, Duration, Throttles, ConcurrentExecutions) at this outcome boundary for every invocation mechanism (sync, async, function URLs, event source mappings); DryRun never invokes and so never records; Resource/ExecutedVersion metric dimensions are not recorded yet; a direct Invoke is never authorised against the function's resource-based policy, which gates only the invocations Overcast originates for another service and only under OVERCAST_ENFORCE_LAMBDA_RESOURCE_POLICY (#629); emulator-only and off by default, a function tagged overcast:debug=true under OVERCAST_LAMBDA_DEBUGGER=true gets a step debugger port, and while a debugger client is attached the invocation clock is suspended per OVERCAST_DEBUGGER_TIMEOUT (attached, paused or strict, which keeps AWS's timeout) — the one behavioural divergence, never observable without a debugger attached (#1939); the console's Code tab can open that same session itself, over a WebSocket bridge on the emulator's own port, and counts as one such client while it does; a function also tagged overcast:debug-wait=true has each invocation that finds no client attached held, after INIT and before the event is dispatched, until one attaches plus a 750 ms settle, bounded by OVERCAST_DEBUGGER_WAIT_TIMEOUT (120s) after which it runs anyway with a WARN — the function's clock and its Lambda-Runtime-Deadline-Ms start at dispatch, so the hold spends none of the budget; never under the strict policy, and never observable without the tag (#1944) | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) | | `InvokeAsync` | ❌ Unsupported | stub; returns 501 | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeAsync.html) | | `InvokeWithResponseStream` | ✅ Supported | Invokes synchronously, wraps result in AWS event stream binary encoding (PayloadChunk → InvokeComplete); RequestResponse only | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_InvokeWithResponseStream.html) | ### Aliases & versions | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PublishVersion` | ✅ Supported | Immutable snapshot of function config, reporting LastUpdateStatus Successful because nothing can update it; version numbers are monotonically incrementing integers; refused with ResourceConflictException while an update is still in progress | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PublishVersion.html) | | `ListVersionsByFunction` | ✅ Supported | Always includes `$LATEST` as first entry | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListVersionsByFunction.html) | | `CreateAlias` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateAlias.html) | | `UpdateAlias` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateAlias.html) | | `DeleteAlias` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteAlias.html) | | `GetAlias` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetAlias.html) | | `ListAliases` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListAliases.html) | ### Function URLs | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateFunctionUrlConfig` | ✅ Supported | FunctionUrl always echoes the caller's Host (see docs/networking.md); AuthType stored but never enforced | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html) | | `GetFunctionUrlConfig` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionUrlConfig.html) | | `UpdateFunctionUrlConfig` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionUrlConfig.html) | | `DeleteFunctionUrlConfig` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionUrlConfig.html) | | `ListFunctionUrlConfigs` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionUrlConfigs.html) | ### Event source mappings | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `CreateEventSourceMapping` | ✅ Supported | SQS→Lambda, DynamoDB Streams→Lambda; `FunctionResponseTypes: ["ReportBatchItemFailures"]` is honoured; Tags are stored and readable through ListTags | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_CreateEventSourceMapping.html) | | `GetEventSourceMapping` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetEventSourceMapping.html) | | `UpdateEventSourceMapping` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateEventSourceMapping.html) | | `DeleteEventSourceMapping` | ✅ Supported | | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteEventSourceMapping.html) | | `ListEventSourceMappings` | ✅ Supported | Filters by `FunctionName` and `EventSourceArn` | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListEventSourceMappings.html) | ### Layers | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PublishLayerVersion` | ✅ Supported | Increments per-layer version counter; stores zip content | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PublishLayerVersion.html) | | `GetLayerVersion` | ✅ Supported | Returns metadata and content info for the specified version | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html) | | `ListLayerVersions` | ✅ Supported | Returns all versions for a layer, newest first | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayerVersions.html) | | `ListLayers` | ✅ Supported | Returns distinct layer names with their latest matching version | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListLayers.html) | | `DeleteLayerVersion` | ✅ Supported | Removes the specific layer version; 404 if not found | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteLayerVersion.html) | ### Asynchronous invocation | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PutFunctionEventInvokeConfig` | ✅ Supported | Overwrites the configuration, removing members the request omits; MaximumRetryAttempts and MaximumEventAgeInSeconds are validated against AWS's ranges and honoured by the async invoke path; SQS, SNS, Lambda and EventBridge destinations receive AWS's invocation record; an S3 on-failure destination returns 501 because the record is not written to S3, and an S3 on-success destination is rejected as AWS rejects it | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionEventInvokeConfig.html) | | `UpdateFunctionEventInvokeConfig` | ✅ Supported | Partial update; members the request omits keep their stored value, which is the only difference from Put | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionEventInvokeConfig.html) | | `GetFunctionEventInvokeConfig` | ✅ Supported | ResourceNotFoundException when the function has no configuration; LastModified is Unix seconds, as AWS returns for this resource | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionEventInvokeConfig.html) | | `DeleteFunctionEventInvokeConfig` | ✅ Supported | Returns 204; ResourceNotFoundException when there is no configuration to delete | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionEventInvokeConfig.html) | | `ListFunctionEventInvokeConfigs` | ✅ Supported | Every qualifier's configuration for the function; MaxItems is validated but the result is a single page, so NextMarker is never returned | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListFunctionEventInvokeConfigs.html) | ### Concurrency & configuration | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `PutFunctionConcurrency` | ✅ Supported | Enforced: over-limit invokes get 429 TooManyRequestsException; 0 throttles the function entirely | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PutFunctionConcurrency.html) | | `GetFunctionConcurrency` | ✅ Supported | A function with no reservation answers 200 with an empty body, as on AWS; a reservation of 0 is reported rather than omitted, since 0 is the documented way to switch a function off. ResourceNotFoundException is for the function itself | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetFunctionConcurrency.html) | | `DeleteFunctionConcurrency` | ✅ Supported | Clears reserved concurrency limit; returns 204 | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteFunctionConcurrency.html) | | `PutProvisionedConcurrencyConfig` | ✅ Supported | Pre-warms the requested execution environments in the background (IN_PROGRESS then READY); FAILED when Docker is unavailable | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_PutProvisionedConcurrencyConfig.html) | | `GetProvisionedConcurrencyConfig` | ✅ Supported | Reports live Allocated/Available; ProvisionedConcurrencyConfigNotFoundException if not set | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_GetProvisionedConcurrencyConfig.html) | | `DeleteProvisionedConcurrencyConfig` | ✅ Supported | Releases the reservation; the environments age out on the idle TTL rather than being killed | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_DeleteProvisionedConcurrencyConfig.html) | | `ListProvisionedConcurrencyConfigs` | ✅ Supported | Single page; NextMarker is always null | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListProvisionedConcurrencyConfigs.html) | ### Tags | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `TagResource` | ✅ Supported | Function and event-source-mapping ARNs; merges tags; max 50; validates key/value lengths; rejects qualified ARNs and non-ARN resources | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_TagResource.html) | | `UntagResource` | ✅ Supported | Removes specified keys; idempotent on missing keys; tagKeys is required | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_UntagResource.html) | | `ListTags` | ✅ Supported | Returns the resource's tags; code-signing-config, capacity-provider and network-connector ARNs return 501 | [docs](https://docs.aws.amazon.com/lambda/latest/dg/API_ListTags.html) | ## Related - [Lambda](/docs/services/lambda/index.md) — quick start, what works, and the differences from AWS - [All service pages](/docs/services/index.md)