Repository navigation
fix(aws-lambda-web-functions): package the AWS SDK, warn on new-endpoint throttling, use OAC - #484
Merged
Merged
Conversation
…int throttling, use OAC Three corrections, each from a reported failure mode (version 1 -> 2). - The Web Functions runtime does not include the AWS SDK. An app importing @aws-sdk/* without packaging it fails at startup and every request 502s. Package the clients like any other dependency, keep them in dependencies, and do not mark them external. SKILL.md, deployment.md, architecture-patterns.md, migration.md, troubleshooting.md. - A new endpoint's per-environment concurrency limit starts low and learns, so a low maxEnvironments throttles early bursts and load tests with 429 Platform.EndpointMaxEnvThrottle. Do not set maxEnvironments unless a cap is requested, and warn when one is. The limit also restarts for a new endpoint on a warmed function, but not for a new revision on a warmed endpoint. scaling-and-concurrency.md, SKILL.md, troubleshooting.md. - Protect a CloudFront origin with OAC rather than a shared secret header: an IamAuth endpoint, an origin access control with origin type lambda and always-amz-auth signing, and a resource policy granting cloudfront.amazonaws.com lambda:InvokeWebFunctionEndpoint scoped with aws:SourceArn. domains-and-routing.md, infrastructure-as-code.md, iam-and-security.md, troubleshooting.md, SKILL.md. The description now excludes Python frameworks by name, so a Flask query no longer matches this skill.
anasstahr
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Three edits to
aws-lambda-web-functions(version 1 → 2)The AWS SDK is not in the Web Functions runtime. An app that imports
@aws-sdk/*withoutpackaging it fails at startup, so every request 502s. The skill now says to package the SDK clients
like any other dependency, keep them in
dependencies, and not mark them external. Files:SKILL.md(anti-pattern row),deployment.md,architecture-patterns.md,migration.md,troubleshooting.md.A new endpoint's per-environment concurrency limit starts low and learns. Setting a low
maxEnvironmentson a fresh endpoint causes429 Platform.EndpointMaxEnvThrottleon early burstsand load tests.
scaling-and-concurrency.mdgains a section saying not to setmaxEnvironmentsunless a cap is asked for, and to warn about early throttling when it is. The limit also restarts
for a new endpoint added to an already-warmed function, but not for a new revision on a warmed
endpoint. Files:
scaling-and-concurrency.md,SKILL.md,troubleshooting.md.CloudFront origins should use OAC, not a shared secret header. Replaces the shared-secret advice
with the documented setup: an
IamAuthendpoint, an origin access control with origin typelambdaand signing behavior
always-amz-auth, and a resource-based policy grantingcloudfront.amazonaws.comlambda:InvokeWebFunctionEndpointscoped withaws:SourceArn. Files:domains-and-routing.md,infrastructure-as-code.md,iam-and-security.md,troubleshooting.md,SKILL.md.The frontmatter
descriptionnow excludes Python frameworks by name — "non-Node.js runtimes orframeworks such as Flask or Django" — so a Flask VPC query no longer matches this skill.
Files changed
Verification
mise run lint:md— 0 errorspython3 tools/validate.py— passespython3 tools/sync-plugin-skills.py --check— passesuv run python tools/validate_spec.py— Agent Plugins v1.0.0 conformance passesgitleaks detect— no leaksrequest returns 403, GET and POST through CloudFront return 200, and removing the resource policy
or pointing
aws:SourceArnat a different distribution returns 403 again. Stacks deleted after.one capped at
maxEnvironments: 2and one uncapped, under 40 concurrent requests.Type of Change
Checklist
python3 tools/validate.pyBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.