AWS Lambda ExecModule

Overview

AwsLambdaModule connects ValkyrAI workflows to Amazon Lambda through the bundled AWS SDK v2 client. It covers n8n's high-value Lambda invocation behavior and adds bounded function and alias discovery, verified IntegrationAccount credentials, annotation-backed Workflow Studio discovery, fixed AWS routing, and explicit retry boundaries.

The connector implements five operations:

• functions: list_functions, get_function
• aliases: list_aliases, get_alias
• execution: invoke with request_response, event, or dry_run

The legacy AwsExecModule is not a replacement for this connector: it has no input-driven execution path and is not a discoverable production integration. AwsLambdaModule is the typed, governed workflow surface.

Usage

1. Create a dedicated AWS IAM principal whose policy is restricted to the required functions and Lambda actions.
2. Store its access key ID and secret access key in an AWS IntegrationAccount, verify the account, and keep it in READY status.
3. Add AwsLambdaModule to a workflow and bind the account through ExecModuleConfig.authConfig.integrationAccount.
4. Set operation, region, and the operation-specific function, alias, qualifier, payload, or list fields.
5. Put a caller correlation ID in the function payload when the function can produce side effects. Preserve returned AWS request IDs before reconciling an ambiguous invocation.

Never place AWS credentials in mapped input, logs, examples, or function payloads. Credential-like input fields are rejected before provider access.

Inputs

Name	Type	Required for	Default	Constraints
operation	string	Every execution	None	list_functions, get_function, list_aliases, get_alias, or invoke.
region	string	Every execution	None	AWS region syntax such as us-west-2; custom endpoints are not accepted.
functionName	string	All except list_functions	None	Function name or full Lambda function ARN, at most 170 characters.
qualifier	string	Optional get_function or invoke	None	Published version, $LATEST, or alias, at most 128 characters.
aliasName	string	get_alias	None	Alias name, at most 128 characters.
payload	object or JSON string	Optional invoke	{}	Valid JSON; at most 6 MiB synchronously/dry-run or 1 MiB asynchronously.
invocationType	string	invoke	request_response	request_response, event, or dry_run.
includeLogTail	boolean	Optional synchronous invoke	false	Allowed only for request_response; AWS returns at most the service-defined tail.
marker	string	Optional list resume point	None	Opaque AWS marker, at most 4,096 characters.
limit	integer	List operations	50	1–10,000 returned records; each AWS request asks for at most 50.
returnAll	boolean	List operations	false	Follow AWS markers until exhaustion or limit.

Outputs

Every execution returns stable status, operation, and attempts fields.

Name	Type	When present	Description
status	string	Always	success or error.
operation	string	Always	Normalized operation.
attempts	integer	Always	Provider calls, including safe-read retries and list pages.
data	object	Get or invocation success	Normalized function, alias, or invocation receipt.
items	array	List success	Bounded function or alias records.
count	integer	List success	Number of returned records.
hasMore	boolean	List success	Whether another AWS page exists.
nextMarker	string	Another page exists	Opaque marker for a later execution.
functionError	string	Lambda reports one	AWS Handled or Unhandled function-error classification.
logTailBase64	string	Requested and returned	Base64 execution log tail; decode only in an authorized destination.
requestId	string	AWS supplies one	Bounded request reference for reconciliation and provider support.
error	object	Failure	Safe {code, message, httpStatus?, retryable} details.

Function configuration output deliberately omits the code download location because AWS returns it as a temporary signed URL. Invocation output parses valid JSON into data.payload; a non-JSON response is returned as a bounded base64 envelope.

IntegrationAccount Requirements

Bind one AWS IntegrationAccount through the normalized ExecModule authentication relationship:

Field	Requirement
Provider	Amazon Web Services / Lambda
status	Must be READY.
verified	Must be true.
apiKey SecureField	AWS access key ID.
password SecureField	AWS secret access key.

Grant only the actions used by the workflow:

• lambda:ListFunctions for list_functions
• lambda:GetFunction for get_function
• lambda:ListAliases for list_aliases
• lambda:GetAlias for get_alias
• lambda:InvokeFunction for every invocation type

Restrict lambda:InvokeFunction resources to approved function and qualifier ARNs. The current module supports a long-lived access-key pair. Temporary session credentials, role assumption, cross-account role chaining, custom endpoints, and caller-supplied credentials are deferred.

Configuration

The awsAccount relationship is the only credential configuration. Operation, region, function details, and payload fields belong in module parameters or mapped input; read retries use the normalized retry policy.

{
  "version": "1.0.0",
  "authConfig": {
    "authStrategy": 1,
    "integrationAccount": "integration-account:aws-lambda-production"
  },
  "retryPolicy": {
    "maxAttempts": 3
  },
  "payloadConfig": {
    "parameters": "{\"operation\":\"invoke\",\"region\":\"us-west-2\",\"functionName\":\"customer-enrichment\",\"qualifier\":\"production\",\"invocationType\":\"request_response\"}"
  }
}

The relationship value is illustrative. Persisted workflows bind the generated IntegrationAccount relationship, never plaintext credentials.

Operations

Operation	Provider behavior	Side effect and retry behavior
list_functions	Lists function configurations with opaque marker pagination.	Read-only; transient failures retry within the configured bound.
get_function	Gets one function/version configuration without exposing its signed code URL.	Read-only; transient failures retry.
list_aliases	Lists aliases for one function with marker pagination.	Read-only; transient failures retry.
get_alias	Gets one named alias and routed function version.	Read-only; transient failures retry.
invoke / request_response	Executes once, waits for results, and returns bounded normalized output.	Can produce side effects; exactly one provider attempt.
invoke / event	Queues one asynchronous event and continues after AWS accepts it.	Can produce side effects; exactly one attempt; payload limit is 1 MiB.
invoke / dry_run	Validates parameters and permission without executing the function.	Exactly one provider attempt; no function execution.

Errors and Failure Modes

Code	Typical cause	Retryable	Resolution
VALIDATION_ERROR	Missing/invalid region, function, alias, qualifier, JSON, list bound, or invocation option.	No	Correct the named input; no unsafe request was sent.
UNSUPPORTED_OPERATION	Unknown operation.	No	Select a documented operation.
INTEGRATION_ACCOUNT_ERROR	Account missing, unverified, not READY, or missing key material.	No	Repair and bind the AWS account.
AWS_LAMBDA_HTTP_400	Invalid provider request, payload, qualifier, or function state.	No	Validate the current function configuration and request.
AWS_LAMBDA_HTTP_403	IAM denies discovery or invocation.	No	Grant only the missing action on the intended function ARN.
AWS_LAMBDA_HTTP_404	Function, version, or alias is absent or invisible.	No	Verify region and immutable function/qualifier.
AWS_LAMBDA_HTTP_409	Function state prevents invocation or update-related access.	No	Read current function state and wait for the provider transition.
AWS_LAMBDA_HTTP_429 / 503	Concurrency throttle or transient AWS pressure.	Yes for reads	Discovery reads can retry; reconcile before replaying an invocation.
NETWORK_ERROR	DNS, TLS, timeout, or connectivity failure.	Yes for reads	Verify connectivity. Treat an invocation outcome as ambiguous.
EXECUTION_ERROR	Unexpected bounded runtime failure.	No automatic invocation retry	Preserve identifiers/request ID and reconcile external effects.

AWS provider exception text is not copied into output, preventing credential echoes and unbounded error payloads. A functionError means Lambda accepted and executed the request but the function reported failure; inspect the authorized function observability surface using the request ID.

Example

Invoke an approved production alias synchronously:

{
  "operation": "invoke",
  "region": "us-west-2",
  "functionName": "customer-enrichment",
  "qualifier": "production",
  "invocationType": "request_response",
  "includeLogTail": false,
  "payload": {
    "customerId": "cust-123",
    "correlationId": "workflow-2026-09-04-cust-123"
  }
}

Expected result shape:

{
  "status": "success",
  "operation": "invoke",
  "attempts": 1,
  "requestId": "aws-request-reference",
  "data": {
    "functionName": "customer-enrichment",
    "invocationType": "request_response",
    "statusCode": 200,
    "executedVersion": "42",
    "payload": {
      "enriched": true
    }
  }
}

Notes

• Pagination: both list operations preserve AWS markers as opaque values. returnAll=true follows only fixed Lambda endpoints and stops at limit or 10,000 records.
• Rate limits: HTTP 408, 429, 500, 502, 503, and 504 plus network failures can retry only for discovery reads, bounded by RetryPolicy.maxAttempts from 1 through 5. AWS SDK retries are disabled so module accounting and single-attempt invocation are deterministic.
• API limits: synchronous and dry-run payloads are bounded at 6 MiB; asynchronous event payloads at 1 MiB; synchronous response bodies at 6 MiB. Streaming responses, response streaming, function creation/update/delete, layer management, concurrency mutation, event-source mappings, and destinations are deferred.
• Idempotency: function invocation has no universal provider idempotency key. Put a domain correlation ID in the payload and implement deduplication in the target function when retries are possible.
• Destructive behavior: this connector does not create, update, or delete Lambda resources, but invoked code can have arbitrary external effects. Every invocation is one provider attempt and is classified as external code execution.
• Data handling: invocation payloads and results are confidential and sent only to the Lambda endpoint selected by the validated AWS region. Request/response bodies are never logged by the module.
• Provider verification boundary: deterministic tests cover validation, account isolation, SDK request mapping, pagination, retry boundaries, response normalization, redaction, and discovery. Live AWS behavior remains unverified until an authorized Lambda credential and reviewed test function are supplied.
• Functional reference: n8n's current AWS Lambda node invokes a selected function with a qualifier, JSON payload, and synchronous/asynchronous mode. ValkyrAI adds bounded function/alias discovery, dry-run permission checks, fixed routing, verified IntegrationAccount enforcement, safe output normalization, and read-only retry boundaries.
• Runtime boundary: merged source and published documentation do not update the deployed Workflow Studio catalog until a ValkyrAI backend release exposes AwsLambdaModule through /v1/modules/metadata.

Related Documentation

• ExecModule catalog
• AWS S3 ExecModule
• AWS Fargate Launch ExecModule
• Integration Account Console