Lambda, Step Functions, API Gateway, and Configuration Management
Key Takeaways
- Reserved concurrency both guarantees and caps a function’s share of the account pool; provisioned concurrency pre-initializes environments on a published version or alias (not $LATEST) and cannot exceed reserved concurrency when both are set.
- VPC-attached Lambda uses shared Hyperplane ENIs per subnet and security-group pair (up to 65,000 connections per ENI); place functions in private subnets and use NAT for internet—attaching a public subnet does not give a public IP.
- Step Functions Standard workflows last up to one year with exactly-once execution and full history; Express workflows last up to five minutes, suit bursty event processing, and do not support .sync jobs, waitForTaskToken callbacks, Distributed Map, or activities.
- API Gateway REST APIs still own usage plans, API keys, response caching, and AWS WAF patterns that HTTP APIs omit or handle differently; HTTP APIs are cheaper and lower latency; WebSocket APIs keep bidirectional connections.
- Use AWS Systems Manager Parameter Store for hierarchical configuration (AMI IDs, endpoints, flags); use AWS Secrets Manager for rotatable credentials. Managed services remain the Professional way to cut undifferentiated operations.
Lambda concurrency is a design control
AWS Lambda billing and scaling are per concurrent execution environment, not per EC2 instance you forgot to patch. The Professional exam still expects you to isolate noisy neighbors and tame cold starts on interactive paths.
Each AWS account and Region has a concurrency quota (default 1,000 concurrent executions, increasable). Functions without reservation share the unreserved pool. Reserved concurrency sets both a floor and a ceiling for one function: that capacity cannot be stolen by another function, and the function throttles when it hits the reservation. Reserved concurrency has no extra Lambda charge; it only partitions the quota. Use it so a batch function cannot exhaust the account and throttle checkout, or so a function cannot open more database connections than the Amazon Relational Database Service (Amazon RDS) proxy pool allows.
Provisioned concurrency keeps a stated number of environments initialized so interactive APIs see double-digit-millisecond starts instead of cold init. It does cost extra. You attach it to a published version or alias, never to $LATEST. API Gateway, Amazon EventBridge, and Application Load Balancer integrations must invoke the qualified ARN (function:alias). If you set both reserved and provisioned, provisioned cannot exceed reserved. When reserved is unset, overflow past provisioned uses the unreserved pool (and can cold-start). When reserved is set, overflow throttles.
Apex Health’s checkout Lambda uses reserved concurrency of 200 and provisioned concurrency of 50 on alias live. Nightly claims export uses reserved concurrency of 20 so it cannot starve checkout, and no provisioned concurrency because a cold start on a batch job is acceptable.
VPC Hyperplane ENIs
Lambda always runs inside a service-owned VPC. Attaching your VPC is how the function reaches private RDS, ElastiCache, or Amazon OpenSearch Service endpoints. Lambda creates Hyperplane elastic network interfaces (ENIs) per subnet + security group combination and shares them across functions that use the same pair. Each Hyperplane ENI supports on the order of 65,000 connections; Lambda adds ENIs if you exceed that. The first attach can leave a function Pending for minutes. Idle unused ENIs may be reclaimed after 14 days, moving the function to Inactive until the next invoke recreates networking.
Execution roles need ec2:CreateNetworkInterface and related actions (the AWS managed AWSLambdaVPCAccessExecutionRole). Those permissions are also visible to function code, so least privilege often adds a Deny of EC2 ENI APIs when lambda:SourceFunctionArn is the function itself.
Internet access for a VPC-attached function requires private subnets plus a NAT gateway (or NAT instance) in a public subnet, or VPC endpoints for AWS APIs. Attaching the function to a public subnet does not assign a public IP and does not provide internet. Dual-stack IPv6 needs subnets with both CIDRs if you enable IPv6 on the function. Dedicated-instance-tenancy VPCs are not supported directly; peer to a default-tenancy VPC.
Do not attach Lambda to a VPC “for security” if the function only calls public AWS APIs—you add ENI cold path and NAT cost for no private resource. Prefer VPC endpoints and identity policies. When you do need RDS, put Lambda in private subnets, lock security groups to the database, and size reserved concurrency to the connection budget.
Step Functions: Standard versus Express (bursty events)
AWS Step Functions orchestrates retries, branching, and parallel work so you do not encode a distributed state machine in Lambda. Workflow type is immutable after create.
| Trait | Standard | Express (async / sync) |
|---|---|---|
| Max duration | One year | Five minutes |
| Semantics | Exactly-once (unless you Retry) | Async at-least-once; sync at-most-once |
| History | API + console, kept 90 days (reducible by quota request) | CloudWatch Logs; not the Standard execution history API |
| Pricing model | State transitions | Executions, duration, memory |
| Start rate | Account transition quotas apply | Built for high start rates (IoT, streaming transforms) |
| Patterns not in Express | — | .sync job runs, .waitForTaskToken, Distributed Map, activities |
Standard is the answer for payments, human approval, Amazon EMR clusters, and anything non-idempotent that must not run twice. Asynchronous Express is the answer for bursty event processing: tens of thousands of short, idempotent transforms (DynamoDB PutItem, S3 object tagging) where at-least-once is acceptable if handlers are idempotent. Synchronous Express waits for the result (API Gateway, Lambda, StartSyncExecution). Console sync calls expire in 60 seconds; use the SDK/CLI for up to five minutes. Sync Express does not consume the same account execution-rate capacity model as Standard in the same way—the service scales, but bursts can still throttle until capacity is available.
Apex Health’s telematics subsidiary ingests 50,000 device payloads per minute. Each payload validates, writes DynamoDB, and publishes a metric—under 30 seconds, fully idempotent. Express async workflows keep Standard’s transition bill and 1-year state machine out of that hot path. The claims appeal process that waits for a clinician for three days stays Standard with a callback pattern Express cannot offer.
Nesting is allowed: a Standard workflow can invoke Express children for the bursty fan-out, then continue a durable approval.
API Gateway flavors
Amazon API Gateway still fronts many Lambda and HTTP backends. Choose the API type at design time; it is expensive to swap later.
- REST API — broadest enterprise feature set: request validation, usage plans, API keys, response caching, AWS WAF association, private APIs on interface VPC endpoints, API keys, resource policies, and canary deployments on stages. Higher cost and latency than HTTP APIs.
- HTTP API — cheaper, lower latency, JWT/IAM/Lambda authorizers, automatic deployments, good default for simple Lambda proxy. Lacks several REST-only management features; if the stem demands usage plans plus WAF on API Gateway the way REST documents them, REST is the safer Professional pick.
- WebSocket API — persistent bidirectional connections for consoles, chat, and live dashboards. Route selection on message keys; backend is often Lambda. Idle and connection quotas apply; this is not a cheaper REST API.
Lambda function URLs attach HTTPS directly to a function without API Gateway. They fit a single-function webhook, not an estate that needs usage plans, API keys, or a shared custom domain policy. AWS AppSync is GraphQL and subscriptions—out of scope unless the stem asks for GraphQL.
Private REST APIs plus VPC endpoints keep partner traffic off the public internet. Combine with IAM or Lambda authorizers; do not leave an open /* resource policy because “it is private.”
Parameter Store versus Secrets Manager
AWS Systems Manager Parameter Store is hierarchical configuration: AMI IDs, endpoint URLs, non-secret tunables, String / StringList / optional SecureString (KMS). Standard parameters: up to 10,000 per account per Region, 4 KB, no additional Parameter Store charge. Advanced: up to 100,000, 8 KB, policies (expiration), cross-account sharing—billed. Throughput can be raised. Parameters version (about 100 versions retained). A put takes effect on the next read; there is no built-in gradual bake or automatic rollback—AWS AppConfig adds validation, bake, and CloudWatch-alarm rollback when a bad flag can outage production.
AWS Secrets Manager is for credentials: database passwords, API keys, OAuth tokens, with automatic rotation (Lambda rotation functions, native engine integrations), fine-grained audit, and cross-account access patterns. You pay per secret per month and per API call. AWS’s own Parameter Store guidance tells you to put usernames and passwords in Secrets Manager, not in Parameter Store, even though SecureString exists.
Apex Health stores /imaging/prod/ami-id and feature flags in Parameter Store (AppConfig for flags that need bake). The RDS master password and a third-party clearinghouse API key live in Secrets Manager with rotation. ECS tasks inject latest secrets at task start; changing a secret still needs a new task for environment-variable injection, or an agent/runtime fetch.
Reducing undifferentiated operations
Task 2.1 is also a reminder to not run a fleet when a managed service meets the non-functional requirements. Lambda plus API Gateway plus Step Functions plus Amazon EventBridge plus Amazon Simple Queue Service (Amazon SQS) removes OS patching that ECS on EC2 would reintroduce. Fargate removes AMI patching but keeps task networking. Beanstalk and Batch, from the previous section, occupy the middle. Secrets Manager rotation removes human password-spreadsheet operations. The Professional wrong answer is often “more EC2 so we can install our familiar agent,” when the stem never required that agent.
Exam traps: provisioned concurrency on $LATEST; reserved concurrency as a cold-start cure (it is not); Lambda in a public subnet for internet; Express for a one-week approval; Express with waitForTaskToken; HTTP API when the stem requires REST usage plans and WAF; Parameter Store for the rotating database password; inventing an AWS exam pass rate or quoting the practice-bank size as the real exam.
Apex Health’s telematics pipeline must process tens of thousands of device events per minute. Each workflow validates a payload, writes an idempotent DynamoDB put, and finishes in under 30 seconds. Occasional duplicate execution is acceptable if the put is idempotent. Which orchestration design fits cost and scale?
Checkout is an interactive Lambda function. It must keep capacity even when a nightly batch function spikes, and p99 cold starts are unacceptable. API Gateway must invoke the pre-warmed environments. Which concurrency design is correct?
You are designing configuration and the public API for a new Apex Health product. Golden AMI IDs and non-secret feature flags must be read by many accounts. The RDS master password must rotate automatically. External partners need API keys, usage plans, and AWS WAF on the HTTP facade. Which combination matches AWS service roles?