Deploying Lambda functions
You can deploy code to your Lambda function by uploading a zip file archive, or by creating and uploading a container image.
Topics
.zip file archives
A .zip file archive includes your application code and its dependencies. When you author functions using the Lambda console or a toolkit, Lambda automatically creates a .zip file archive of your code.
When you create functions with the Lambda API, command line tools, or the Amazon SDKs, you must create a deployment package. You also must create a deployment package if your function uses a compiled language, or to add dependencies to your function. To deploy your function's code, you upload the deployment package from Amazon Simple Storage Service (Amazon S3) or your local machine.
You can upload a .zip file as your deployment package using the Lambda console, Amazon Command Line Interface (Amazon CLI), or to an Amazon Simple Storage Service (Amazon S3) bucket.
Deployment package file permissions
The Lambda runtime needs permission to read the files in your deployment package. In Linux permissions octal notation, Lambda needs 644 permissions for non-executable files (rw-r--r--) and 755 permissions (rwxr-xr-x) for directories and executable files.
In Linux and MacOS, use the chmod command to change file permissions on files and directories in your deployment package. For
example, to give an executable file the correct permissions, run the following command.
chmod 755 <filepath>
To change file permissions in Windows, see Set, View, Change, or Remove Permissions on an Object
Container images
You can package your code and dependencies as a container image using tools such as the Docker command line interface (CLI). You can then upload the image to your container registry hosted on Amazon Elastic Container Registry (Amazon ECR).
When you invoke the function, Lambda deploys the container image to an execution environment. Lambda initializes any extensions and then runs the function’s initialization code (the code outside the main handler). Note that function initialization duration is included in billed execution time.
Lambda then runs the function by calling the code entry point specified in the function configuration (the ENTRYPOINT and CMD container image settings).
Amazon provides a set of open-source base images that you can use to build the container image for your function code. You can also use alternative base images from other container registries. Amazon also provides an open-source runtime client that you add to your alternative base image to make it compatible with the Lambda service.
Additionally, Amazon provides a runtime interface emulator for you to test your functions locally using tools such as the Docker CLI.
Note
You create each container image to be compatible with one of the instruction set architectures that Lambda supports. Lambda provides base images for each of the instruction set architectures and Lambda also provides base images that support both architectures.
The image that you build for your function must target only one of the architectures.
There is no additional charge for packaging and deploying functions as container images. When a function
deployed as a container image is invoked, you pay for invocation requests and execution duration. You do incur
charges related to storing your container images in Amazon ECR. For more information, see Amazon ECR pricing
Image security
When Lambda first downloads the container image from its original source (Amazon ECR), the container image is optimized, encrypted, and stored using authenticated convergent encryption methods. All keys that are required to decrypt customer data are protected using Amazon KMS customer managed keys. To track and audit Lambda's usage of customer managed keys, you can view the Amazon CloudTrail logs.