View a markdown version of this page

Enabling tenant isolation for Lambda Event Functions - Amazon Lambda
ConsoleAmazon CLIAPIAmazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Enabling tenant isolation for Lambda Event Functions

To activate tenant isolation mode, create a new Lambda Event Function. You cannot enable tenant isolation on existing Event Functions.

Enabling tenant isolation (console)

To create a Lambda Event Function using the console

  1. Open the Event Functions page of the Lambda console.

  2. Choose Create Event Function.

  3. Select Author from scratch.

  4. In the Basic information pane, for Function name, enter image-analysis.

  5. For Runtime, choose any of the supported Lambda runtimes.

  6. Under additional configurations, Tenant isolation mode, select Enable.

  7. Review your settings, and choose Create Event Function.

Enabling tenant isolation (Amazon CLI)

Create Event Function with tenant isolation

When creating a new Event Function using the CLI, add the --tenancy-config '{"TenantIsolationMode": "PER_TENANT"}' option to your create-function request. Example:

aws lambda create-function \
    --function-name image-analysis \
    --runtime nodejs24.x \
    --zip-file fileb://image-analysis-function.zip \
    --handler image-analysis-function.handler \
    --role arn:aws:iam:123456789012:role/execution-role \
    --tenancy-config '{"TenantIsolationMode": "PER_TENANT"}'

Enabling tenant isolation (API)

To enable tenant isolation using the Lambda API

  1. Create a new Event Function with tenant isolation enabled by using the CreateFunction API action with the TenancyConfig parameter.

  2. Confirm that tenant isolation is enabled for the Event Function by using the GetFunctionConfiguration action. If the response shows that TenantIsolationMode is PER_TENANT, then tenant isolation is enabled for the Event Function:

    "TenancyConfig": { 
        "TenantIsolationMode": "PER_TENANT"
     }

Invoke the function version with the Invoke action. For more information, see Invoking Lambda Event Functions with tenant isolation.

Enabling tenant isolation (Amazon CloudFormation)

The following Amazon CloudFormation template creates a new Lambda Event Function with tenant isolation enabled:

MyLambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: my-sample-python-lambda
      Runtime: python3.14
      Role: !GetAtt LambdaExecutionRole.Arn
      Handler: index.lambda_handler
      TenancyConfig:
        TenantIsolationMode: PER_TENANT
      Code:
        ZipFile: |
          import json

          def lambda_handler(event, context):
              return {
                  'statusCode': 200,
                  'body': json.dumps(f'Hello from Lambda! Tenant-ID: {context.tenant_id}')
              }
      Timeout: 10
      MemorySize: 128