How to make a Lambda function answer from a web address, without setting up anything else

Imagine a small program you only want to run when someone calls it: receiving the notice that a customer has paid, processing a contact form, converting an image. You do not want a server running 24 hours a day for that. That is what Lambda is for: you give Amazon your code, and Amazon runs it only when needed and charges you only for that time. No machines to maintain.

The question is: how do you call it? The most universal way is to give it a web address, a URL like https://algo.on.aws/, so that any browser or program can "open" it and your code answers. This guide does exactly that with the option Lambda includes out of the box, called function URL. There is nothing else to install or sign up for.

Step by step

1. Check that your function knows how to answer a web request

   When the function is called through its web address, Lambda hands it a data package with the request (what was asked for, with what data) and expects your code to return a response with two things: a status code (200 means "all good") and a body (the text or data you return). If your function was written for another purpose, it has to be adapted. A minimal example, in Node.js, that answers "hello, world":

   export const handler = async (event) => ({
     statusCode: 200,
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({ hola: "mundo" })
   });

   If you are not the one who writes the code, pass this paragraph on to whoever does: they will know what it means.

2. Decide who will be able to call the function

   This is the only important decision in the guide, and it is worth understanding well. There are two options:

   • Only with AWS credentials (the option is called AWS_IAM): only a program of yours with permissions in your Amazon account will be able to call it. It is the safest, but a normal browser or an external service will not be able to use it.
   • Open (the option is called NONE): anyone who knows the address will be able to call it. This is what you need if it is going to be called by an external service (a webhook) or a web page. In exchange, the security has to be provided by your code: checking a password or a signature on every call. We cover that in the last step.

   Simple rule: if you do not know which one to choose, choose the first. If the function has to receive calls from outside your account, choose the second and do not skip the last step.

3. Turn on the web address

   In the AWS console go to Lambda, open your function and click the Configuration tab. In the left-hand menu choose Function URL and click Create function URL. Choose the access type from the previous step.

   If it is going to be called by a web page of yours from another domain, expand CORS and type that page's address under "Allow origin" (for example https://miweb.com). If you put an asterisk, any website in the world will be able to call it from the browser; avoid that unless it is what you want. Save. The new address appears at the top, looking like this: https://xxxxxxxx.lambda-url.eu-west-1.on.aws/. That is your URL.

4. Test it

   If you chose the open option, copy the address and paste it in the browser: you should see your function's response (in the example, the text "hello, world"). It is already working.

   If you prefer to test it from a terminal, in CloudShell (the terminal icon in the top bar of the AWS console) type:

   curl -i https://xxxxxxxx.lambda-url.eu-west-1.on.aws/

   If you chose the credentials option, the browser will say "Forbidden": that is expected, because it carries no credentials. The test will have to be done by the program of yours that is going to call it, using the AWS libraries, which already know how to sign requests.

5. Look at the execution diary

   Monitor tab, View CloudWatch logs button. Each call leaves an entry with how long it took and whatever your code wrote. If a call returns an error, this is where you will see the reason. A tip that saves money: in that log group, set a retention of, say, 30 days; otherwise the logs are kept forever and charged for.

6. If you left it open, protect it

   Open means anyone can call it, so your code must check something on every call. The usual way: the service that sends you the webhook includes a signature or a secret key in each notice, and your function checks that it is correct before doing anything. Store that key in the function's environment variables (Configuration tab), not written in the code.

   And put a cap on how many times it can run at once (reserved concurrency, under Configuration): if someone bombards the address, the cap keeps the bill from skyrocketing.

What can go wrong