Getting started with Lambda Managed Instances

Open the Lambda console.

Choose Capacity providers from the left navigation pane.

Choose Create capacity provider.

In the Capacity provider settings section, enter a name for your capacity provider.

Select VPC and permissions for your capacity provider. You can either use an existing or create a new one. For information about creating the required operator role, see Lambda Operator role for Lambda Managed Instances.

Expand Advanced settings.

Define your Instance requirements by choosing the processor architecture and instance types.

Under Auto scaling, specify the maximum number of EC2 vCPUs for your capacity provider. You can also choose Manual instance scaling mode to set your own scaling value for precise control.

Choose Create capacity provider to create a new one.

Next, choose Create function.

Select Author from scratch.

In the Basic information pane, provide a Function name.

For Runtime, choose any of the supported Runtimes.

Choose the Architecture for your function (same as the one you selected for capacity provider). By default, x86_64.

Under Permissions, ensure you have permission for the chosen Execution role. Otherwise, you can create a new role.

Under Additional configurations, pick the Compute type as Lambda Managed Instances.

Capacity provider ARN of the capacity provider you created in the previous steps should be pre-selected.

Choose Memory size and Execution environment memory (GiB) per vCPU ratio.

Choose Create function.

Create a trust policy document that allows Lambda to assume the role:

cat > lambda-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

Create the execution role:

aws iam create-role \
  --role-name MyLambdaExecutionRole \
  --assume-role-policy-document file://lambda-trust-policy.json

Attach the basic execution policy:

aws iam attach-role-policy \
  --role-name MyLambdaExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Create a trust policy document that allows Lambda to assume the operator role:

cat > operator-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

Create the operator role:

aws iam create-role \
  --role-name MyCapacityProviderOperatorRole \
  --assume-role-policy-document file://operator-trust-policy.json

Attach the required EC2 permissions policy:

aws iam attach-role-policy \
  --role-name MyCapacityProviderOperatorRole \
  --policy-arn arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator

Create a VPC:

VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --query 'Vpc.VpcId' \
  --output text)

Create a subnet:

SUBNET_ID=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 \
  --query 'Subnet.SubnetId' \
  --output text)

Create a security group:

SECURITY_GROUP_ID=$(aws ec2 create-security-group \
  --group-name my-capacity-provider-sg \
  --description "Security group for Lambda Managed Instances" \
  --vpc-id $VPC_ID \
  --query 'GroupId' \
  --output text)

First, create a simple Python function and package it inline:

# Create a temporary directory for the function code
mkdir -p /tmp/my-lambda-function
cd /tmp/my-lambda-function

# Create a simple Python handler
cat > lambda_function.py << 'EOF'
import json

def lambda_handler(event, context):
    return {
        'statusCode': 200,
        'body': json.dumps({
            'message': 'Hello from Lambda Managed Instances!',
            'event': event
        })
    }
EOF

# Create a ZIP file
zip function.zip lambda_function.py

Create the Lambda function using the inline ZIP file:

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION=$(aws configure get region)

aws lambda create-function \
  --function-name my-managed-instance-function \
  --package-type Zip \
  --runtime python3.13 \
  --handler lambda_function.lambda_handler \
  --zip-file fileb:///tmp/my-lambda-function/function.zip \
  --role arn:aws:iam::${ACCOUNT_ID}:role/MyLambdaExecutionRole \
  --architectures x86_64 \
  --memory-size 2048 \
  --ephemeral-storage Size=512 \
  --capacity-provider-config LambdaManagedInstancesCapacityProviderConfig={CapacityProviderArn=arn:aws:lambda:${REGION}:${ACCOUNT_ID}:capacity-provider:my-capacity-provider}

The function is created with:

Delete the function:

aws lambda delete-function --function-name my-managed-instance-function

Delete the capacity provider:

aws lambda delete-capacity-provider --capacity-provider-name my-capacity-provider

Delete the VPC resources:

aws ec2 delete-security-group --group-id $SECURITY_GROUP_ID
aws ec2 delete-subnet --subnet-id $SUBNET_ID
aws ec2 delete-vpc --vpc-id $VPC_ID

Delete the IAM roles:

aws iam detach-role-policy \
  --role-name MyLambdaExecutionRole \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam detach-role-policy \
  --role-name MyCapacityProviderOperatorRole \
  --policy-arn arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator

aws iam delete-role --role-name MyLambdaExecutionRole
aws iam delete-role --role-name MyCapacityProviderOperatorRole