AWS lambda documentation change
Summary
Updated AWS Lambda durable execution documentation with significant changes: removed IAM permissions section, removed AllowInvokeLatest parameter, clarified durable execution can only be enabled during function creation, updated parameter ranges (RetentionPeriodInDays now 1-90 days), and updated best practices.
Security assessment
The changes are primarily feature updates and documentation restructuring. The removal of the IAM permissions section doesn't indicate a security issue but rather a documentation reorganization. The removal of AllowInvokeLatest parameter suggests feature deprecation or simplification, not a security fix. The reduction of RetentionPeriodInDays from 365 to 90 days appears to be a service limit change rather than a security response. No evidence of vulnerability disclosure, CVE reference, or security incident remediation.
Diff
diff --git a/lambda/latest/dg/durable-configuration.md b/lambda/latest/dg/durable-configuration.md index 259fa5e76..82c24dbb1 100644 --- a//lambda/latest/dg/durable-configuration.md +++ b//lambda/latest/dg/durable-configuration.md @@ -5 +5 @@ -Enable durable executionIAM permissions for durable functionsConfiguration best practices +Enable durable executionConfiguration best practices @@ -9 +9 @@ Enable durable executionIAM permissions for durable functionsConfiguration best -To enable durable execution for your Lambda function, you need to configure specific settings that control how long your function can run, how long state data is retained, and what permissions are required. +Durable execution settings control how long your Lambda function can run and how long the service retains execution history. Configure these settings to enable durable execution for your function. @@ -13 +13 @@ To enable durable execution for your Lambda function, you need to configure spec -To enable durable execution for your Lambda function, configure the `DurableConfig` in your function configuration. This setting controls execution timeout, state retention, and versioning behavior. +Configure the `DurableConfig` object when creating your function to set execution timeout and history retention. You can only enable durable execution when creating a function. You cannot enable it on existing functions. @@ -19 +19 @@ AWS CLI - aws lambda update-function-configuration \ + aws lambda create-function \ @@ -21,5 +21,5 @@ AWS CLI - --durable-config '{ - "ExecutionTimeout": 3600, - "RetentionPeriodInDays": 30, - "AllowInvokeLatest": true - }' + --runtime nodejs24.x \ + --role arn:aws:iam::123456789012:role/my-durable-role \ + --handler index.handler \ + --zip-file fileb://function.zip \ + --durable-config '{"ExecutionTimeout": 3600, "RetentionPeriodInDays": 30}' @@ -37 +37 @@ CloudFormation - Runtime: nodejs18.x + Runtime: nodejs24.x @@ -45 +44,0 @@ CloudFormation - AllowInvokeLatest: true @@ -50 +49 @@ CloudFormation - * `ExecutionTimeout` \- Maximum execution time in seconds (up to 31,536,000 for one year) + * `ExecutionTimeout` – The maximum time in seconds that a durable execution can run before Lambda stops the execution. This timeout applies to the entire durable execution, not individual function invocations. Valid range: 1–31622400. @@ -52 +51 @@ CloudFormation - * `RetentionPeriodInDays` \- How long to retain execution state and history (1-365 days) + * `RetentionPeriodInDays` – The number of days to retain execution history after a durable execution completes. After this period, execution history is no longer available through the `GetDurableExecutionHistory` API. Valid range: 1–90. @@ -54 +52,0 @@ CloudFormation - * `AllowInvokeLatest` \- Whether to allow invoking the $LATEST version for durable execution @@ -58,62 +56 @@ CloudFormation - -## IAM permissions for durable functions - -Durable functions require additional IAM permissions beyond standard Lambda execution roles. Your function's execution role must include permissions for state management and durable execution APIs. - -**Minimum required permissions:** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "lambda:InvokeFunction", - "lambda:GetFunction", - "lambda:ManageDurableState", - "lambda:GetDurableExecution", - "lambda:ListDurableExecutions" - ], - "Resource": "arn:aws:lambda:*:*:function:*" - }, - { - "Effect": "Allow", - "Action": [ - "logs:CreateLogGroup", - "logs:CreateLogStream", - "logs:PutLogEvents" - ], - "Resource": "arn:aws:logs:*:*:*" - } - ] - } - - -**CloudFormation execution role example:** - - - DurableFunctionRole: - Type: AWS::IAM::Role - Properties: - AssumeRolePolicyDocument: - Version: '2012-10-17' - Statement: - - Effect: Allow - Principal: - Service: lambda.amazonaws.com - Action: sts:AssumeRole - ManagedPolicyArns: - - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole - Policies: - - PolicyName: DurableFunctionPolicy - PolicyDocument: - Version: '2012-10-17' - Statement: - - Effect: Allow - Action: - - lambda:ManageDurableState - - lambda:GetDurableExecution - - lambda:ListDurableExecutions - Resource: '*' - +For the full API reference, see [DurableConfig](https://docs.aws.amazon.com/lambda/latest/api/API_DurableConfig.html) in the Lambda API Reference. @@ -125 +62 @@ Follow these best practices when configuring durable functions for production us - * **Set appropriate execution timeouts** \- Configure `ExecutionTimeout` based on your workflow's maximum expected duration. Don't set unnecessarily long timeouts as they affect cost and resource allocation. + * **Set appropriate execution timeouts** – Configure `ExecutionTimeout` based on your workflow's maximum expected duration. Do not set unnecessarily long timeouts as they affect cost and resource allocation. @@ -127 +64 @@ Follow these best practices when configuring durable functions for production us - * **Balance retention with storage costs** \- Set `RetentionPeriodInDays` based on your debugging and audit requirements. Longer retention periods increase storage costs. + * **Balance retention with storage costs** – Set `RetentionPeriodInDays` based on your debugging and audit requirements. Longer retention periods increase storage costs. @@ -129 +66 @@ Follow these best practices when configuring durable functions for production us - * **Use versioning in production** \- Set `AllowInvokeLatest` to `false` in production environments and use specific function versions or aliases for durable executions. + * **Monitor state size** – Large state objects increase storage costs and can impact performance. Keep state minimal and use external storage for large data. @@ -131,3 +68 @@ Follow these best practices when configuring durable functions for production us - * **Monitor state size** \- Large state objects increase storage costs and can impact performance. Keep state minimal and use external storage for large data. - - * **Configure appropriate logging** \- Enable detailed logging for troubleshooting long-running workflows, but be mindful of log volume and costs. + * **Configure appropriate logging** – Enable detailed logging for troubleshooting long-running workflows, but consider the impact on log volume and costs. @@ -143,2 +78 @@ Follow these best practices when configuring durable functions for production us - "RetentionPeriodInDays": 7, - "AllowInvokeLatest": false + "RetentionPeriodInDays": 7 @@ -147,0 +82,2 @@ Follow these best practices when configuring durable functions for production us +This example sets a 24-hour (86,400 seconds) execution timeout with a 7-day retention period, which balances debugging visibility with storage costs for most production workloads. + @@ -154 +90 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Timeout +Using Infrastructure as Code @@ -156 +92 @@ Timeout -Environment variables +Durable functions or Step Functions