Skip to content
Clean Lambda Function
Lean Mean Clean Apps

Five templates, one search box. Everything in the docs is in here, including the bits we hoped you'd skim.

Try one of these

Results say which template they came from, so you won't end up reading about Lambda when you wanted GraphQL. Again.

Secure the function

The function is invoked directly, so there’s no bearer token for it to check. AWS IAM decides who can call it. Think of IAM as the bouncer and your function as the band. The band doesn’t check tickets.

Invoked by other AWS services

Section titled “Invoked by other AWS services”

Only principals allowed lambda:InvokeFunction on the function can invoke it. Grant that through an IAM policy on the caller, or through the function’s resource-based policy for services like EventBridge, SQS or S3. Keep it to the callers that need it. “Everyone in the account” is not a security model.

Called over HTTP with tokens

Section titled “Called over HTTP with tokens”

Put the function behind an API Gateway HTTP API with a JWT authorizer. API Gateway validates the token before the function runs, so bad requests never cost you an invocation, and the function itself stays the same.

The sibling templates for HTTP, Clean Minimal API and Clean Web API, have optional bearer token checking built in if you’d rather run a web API than a function.

Part of Lean Mean Clean Apps

Made by the Lean Mean Clean Apps team with Clean Architecture, strong coffee and a healthy disregard for pomp and ceremony. Not affiliated with Microsoft, AWS, Uncle Bob or anyone with a marketing budget.