Rust on AWS Lambda: The Production Guide to Cold Starts, cargo-lambda, and Managed Instances

# macOS (Homebrew)
brew tap cargo-lambda/cargo-lambda
brew install cargo-lambda

# Linux / any platform (pip)
pip install cargo-lambda

# Verify
cargo lambda --version
# cargo-lambda 1.6.0

cargo lambda new my-function
# Interactive prompts:
# > What type of event will trigger your function?
#   HTTP (API Gateway, ALB, Function URL)
#   SQS
#   EventBridge / CloudWatch Events
#   S3
#   SNS
#   Custom event

my-function/
  Cargo.toml
  src/
    main.rs

[package]
name = "my-function"
version = "0.1.0"
edition = "2021"

[[bin]]
name = "bootstrap"
path = "src/main.rs"

[dependencies]
lambda_http = "0.14"
tokio = { version = "1", features = ["macros"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
serde = { version = "1", features = ["derive"] }

# Build for ARM64 (recommended)
cargo lambda build --release --arm64

# Build for x86_64
cargo lambda build --release

# Output location:
# target/lambda/my-function/bootstrap

# Start the local emulator with environment variables
cargo lambda watch --env-var DATABASE_URL=postgres://localhost/dev                    --env-var LOG_LEVEL=debug

# In another terminal, invoke the local function
cargo lambda invoke my-function   --data-ascii '{"name": "alice"}'

# Use a built-in event fixture (API Gateway, SQS, S3, etc.)
cargo lambda invoke my-function   --data-example apigw-request

# Invoke a deployed remote function
cargo lambda invoke my-function   --remote   --data-ascii '{"name": "alice"}'

cargo lambda deploy

# Output:
# 🔍 My-function not found, creating new Lambda function
# ✅ Function ARN: arn:aws:lambda:us-east-1:123456789:function:my-function
# ⚡ Architecture: arm64
# 📦 Code size: 1.8 MB

# Root Cargo.toml
[workspace]
members = [
  "functions/api-handler",
  "functions/sqs-processor",
  "functions/scheduled-job",
  "shared/common",
]

# functions/api-handler/Cargo.toml
[package.metadata.lambda.deploy]
memory = 256
timeout = 30
env = [
  { key = "LOG_LEVEL", value = "info" },
]
iam_role = "arn:aws:iam::123456789:role/my-lambda-role"

# functions/sqs-processor/Cargo.toml
[package.metadata.lambda.deploy]
memory = 128
timeout = 300

cargo lambda build --release --arm64
cargo lambda deploy --function-name api-handler
cargo lambda deploy --function-name sqs-processor

# Cargo.toml
[dependencies]
lambda_runtime = "0.14"
tokio = { version = "1", features = ["macros"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }

use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use serde::{Deserialize, Serialize};
use tracing::info;

#[derive(Deserialize)]
struct Request {
    name: String,
    operation: String,
}

#[derive(Serialize)]
struct Response {
    message: String,
    request_id: String,
    processed: bool,
}

async fn function_handler(event: LambdaEvent<Request>) -> Result<Response, Error> {
    let (payload, ctx) = event.into_parts();

    if payload.name.is_empty() {
        return Err("name field cannot be empty".into());
    }

    info!(
        request_id = %ctx.request_id,
        operation = %payload.operation,
        "Processing request"
    );

    Ok(Response {
        message: format!("Processed {} for {}", payload.operation, payload.name),
        request_id: ctx.request_id,
        processed: true,
    })
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    tracing_subscriber::fmt()
        .with_env_filter(
            tracing_subscriber::EnvFilter::from_default_env()
                .add_directive("my_function=info".parse()?)
        )
        .json()
        .init();

    run(service_fn(function_handler)).await
}

cargo lambda build --release --arm64
cargo lambda deploy --function-name my-function
cargo lambda invoke my-function   --remote   --data-ascii '{"name": "alice", "operation": "transform"}'

# Response:
# {
#   "message": "Processed transform for alice",
#   "request_id": "abc123-...",
#   "processed": true
# }

[dependencies]
sha2 = { version = "0.10", features = ["asm"] }

# From macOS Intel, macOS ARM64, or Linux x86_64:
cargo lambda build --release --arm64
# Just works. cargo-lambda installs the target toolchain on first use.

[profile.release]
opt-level = "z"       # Optimize for size (use 3 for CPU-bound functions)
lto = true            # Link-time optimization reduces binary size significantly
codegen-units = 1     # Single codegen unit for better optimization
panic = "abort"       # Smaller binary, no unwinding overhead
strip = true          # Remove debug symbols (saves 1-2 MB typically)

[dependencies]
lambda_runtime = "0.14"
aws-config = "1.5"
aws-sdk-dynamodb = "1.55"
tokio = { version = "1", features = ["macros", "sync"] }
tokio-postgres = "0.7"

use aws_config::BehaviorVersion;
use aws_sdk_dynamodb::Client as DynamoClient;
use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use serde_json::Value;
use tokio::sync::OnceCell;

// SDK clients are cheap to initialize (no network calls in the constructor)
// Initialize them in main() so they are reused across invocations
static DYNAMO: OnceCell<DynamoClient> = OnceCell::const_new();

async fn get_dynamo() -> &'static DynamoClient {
    DYNAMO.get_or_init(|| async {
        let config = aws_config::load_defaults(BehaviorVersion::latest()).await;
        DynamoClient::new(&config)
    }).await
}

async fn handler(event: LambdaEvent<Value>) -> Result<Value, Error> {
    let client = get_dynamo().await;
    // use client...
    Ok(serde_json::json!({"status": "ok"}))
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    // Initialize the DynamoDB client during cold start
    // Subsequent invocations reuse the same client
    let config = aws_config::load_defaults(BehaviorVersion::latest()).await;
    DYNAMO.set(DynamoClient::new(&config)).ok();

    run(service_fn(handler)).await
}

REPORT RequestId: abc123  Duration: 14.23 ms  Billed Duration: 15 ms
Memory Size: 128 MB  Max Memory Used: 42 MB  Init Duration: 18.45 ms

filter @type = "REPORT"
| parse @message "Init Duration: @initDuration ms"
| filter ispresent(@initDuration)
| stats count() as coldStarts,
        avg(@initDuration) as avgInitMs,
        pct(@initDuration, 95) as p95InitMs,
        pct(@initDuration, 99) as p99InitMs
| sort by coldStarts desc

[dependencies]
lambda_runtime = { version = "0.14", features = ["tokio"] }
tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
aws-sdk-dynamodb = "1.55"
aws-config = "1.5"

use aws_config::BehaviorVersion;
use aws_sdk_dynamodb::Client as DynamoClient;
use lambda_runtime::{run_concurrent, service_fn, Error, LambdaEvent};
use serde::{Deserialize, Serialize};
use std::sync::Arc;
use tokio::sync::RwLock;
use tracing::{info, instrument};

#[derive(Clone)]
struct AppState {
    dynamo: DynamoClient,
    // In-memory cache shared across concurrent requests
    cache: Arc<RwLock<std::collections::HashMap<String, String>>>,
}

#[derive(Deserialize)]
struct Request {
    user_id: String,
}

#[derive(Serialize)]
struct Response {
    user_id: String,
    data: String,
}

#[instrument(skip(state), fields(user_id = %event.payload.user_id))]
async fn handler(
    state: Arc<AppState>,
    event: LambdaEvent<Request>,
) -> Result<Response, Error> {
    let user_id = event.payload.user_id.clone();
    let request_id = event.context.request_id.clone();

    info!(request_id = %request_id, "Processing request");

    // Check cache first (read lock, non-exclusive)
    {
        let cache = state.cache.read().await;
        if let Some(data) = cache.get(&user_id) {
            return Ok(Response {
                user_id,
                data: data.clone(),
            });
        }
    }

    // Cache miss: query DynamoDB
    let result = state.dynamo
        .get_item()
        .table_name("users")
        .key("user_id", aws_sdk_dynamodb::types::AttributeValue::S(user_id.clone()))
        .send()
        .await?;

    let data = result.item()
        .and_then(|i| i.get("data"))
        .and_then(|v| v.as_s().ok())
        .cloned()
        .unwrap_or_default();

    // Update cache (write lock)
    {
        let mut cache = state.cache.write().await;
        cache.insert(user_id.clone(), data.clone());
    }

    Ok(Response { user_id, data })
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    tracing_subscriber::fmt().json().init();

    let config = aws_config::load_defaults(BehaviorVersion::latest()).await;
    let state = Arc::new(AppState {
        dynamo: DynamoClient::new(&config),
        cache: Arc::new(RwLock::new(std::collections::HashMap::new())),
    });

    run_concurrent(service_fn(move |event| {
        let state = Arc::clone(&state);
        async move { handler(state, event).await }
    }))
    .await
}

use lambda_runtime::Runtime;
use tokio::signal::unix::{signal, SignalKind};

#[tokio::main]
async fn main() -> Result<(), Error> {
    // ... state initialization ...

    let runtime = Runtime::new(service_fn(move |event| {
        // ... handler ...
    }));

    tokio::select! {
        result = runtime.run_concurrent() => result?,
        _ = async {
            let mut sigterm = signal(SignalKind::terminate()).unwrap();
            sigterm.recv().await;
            tracing::info!("SIGTERM received, draining in-flight requests");
        } => {}
    }

    Ok(())
}

[dependencies]
lambda_http = "0.14"
axum = "0.7"
tower-http = { version = "0.5", features = ["trace", "cors", "compression-gzip"] }
tokio = { version = "1", features = ["macros"] }
serde = { version = "1", features = ["derive"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

use axum::{
    extract::Path,
    http::StatusCode,
    response::IntoResponse,
    routing::{get, post},
    Json, Router,
};
use lambda_http::{run, Error};
use serde::{Deserialize, Serialize};
use tower_http::{cors::CorsLayer, trace::TraceLayer};

#[derive(Serialize)]
struct HealthResponse {
    status: String,
}

#[derive(Deserialize)]
struct CreateItemRequest {
    name: String,
    value: String,
}

#[derive(Serialize)]
struct CreateItemResponse {
    id: String,
    name: String,
}

async fn health_handler() -> impl IntoResponse {
    Json(HealthResponse {
        status: "healthy".to_string(),
    })
}

async fn get_item_handler(Path(id): Path<String>) -> impl IntoResponse {
    if id.is_empty() {
        return (StatusCode::BAD_REQUEST, Json(serde_json::json!({"error": "id required"}))).into_response();
    }
    Json(serde_json::json!({"id": id, "found": true})).into_response()
}

async fn create_item_handler(
    Json(body): Json<CreateItemRequest>,
) -> impl IntoResponse {
    let id = uuid::Uuid::new_v4().to_string();
    (
        StatusCode::CREATED,
        Json(CreateItemResponse {
            id,
            name: body.name,
        }),
    )
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    tracing_subscriber::fmt()
        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
        .json()
        .init();

    let app = Router::new()
        .route("/health", get(health_handler))
        .route("/items/:id", get(get_item_handler))
        .route("/items", post(create_item_handler))
        .layer(TraceLayer::new_for_http())
        .layer(CorsLayer::permissive());

    run(app).await
}

[dependencies]
lambda_runtime = "0.14"
aws_lambda_events = { version = "0.15", features = ["sqs"] }
tokio = { version = "1", features = ["macros"] }
futures = "0.3"

use aws_lambda_events::event::sqs::{SqsBatchResponse, SqsEvent, SqsJobProps};
use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use futures::future::join_all;
use tracing::{error, info};

async fn process_record(record: &aws_lambda_events::event::sqs::SqsMessage) -> Result<(), String> {
    let body = record.body.as_deref().unwrap_or("");
    info!(message_id = ?record.message_id, "Processing SQS message");

    // Your processing logic here
    if body.contains("invalid") {
        return Err(format!("Invalid message: {}", body));
    }

    Ok(())
}

async fn handler(event: LambdaEvent<SqsEvent>) -> Result<SqsBatchResponse, Error> {
    let records = event.payload.records;

    let results = join_all(
        records.iter().map(|record| async move {
            match process_record(record).await {
                Ok(()) => None,
                Err(e) => {
                    error!(
                        message_id = ?record.message_id,
                        error = %e,
                        "Failed to process message"
                    );
                    record.message_id.clone().map(|id| SqsJobProps { item_identifier: id })
                }
            }
        })
    ).await;

    let item_failures: Vec<SqsJobProps> = results.into_iter().flatten().collect();
    info!(failed_count = item_failures.len(), "Batch complete");

    Ok(SqsBatchResponse { batch_item_failures: item_failures })
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    tracing_subscriber::fmt().json().init();
    run(service_fn(handler)).await
}

[dependencies]
aws_lambda_events = { version = "0.15", features = ["s3"] }
aws-sdk-s3 = "1.65"

use aws_lambda_events::event::s3::S3Event;
use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use aws_sdk_s3::Client as S3Client;
use aws_config::BehaviorVersion;

async fn handler(event: LambdaEvent<S3Event>) -> Result<(), Error> {
    let config = aws_config::load_defaults(BehaviorVersion::latest()).await;
    let s3 = S3Client::new(&config);

    for record in &event.payload.records {
        let bucket = record.s3.bucket.name.as_deref().unwrap_or("");
        let key = record.s3.object.key.as_deref().unwrap_or("");

        let object = s3.get_object()
            .bucket(bucket)
            .key(key)
            .send()
            .await?;

        let bytes = object.body.collect().await?.into_bytes();
        tracing::info!(bucket = bucket, key = key, bytes = bytes.len(), "Processed S3 object");

        // Process bytes, then upload result to another bucket
    }

    Ok(())
}

use aws_lambda_events::event::cloudwatch_events::CloudWatchEvent;
use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use serde_json::Value;

async fn handler(event: LambdaEvent<CloudWatchEvent<Value>>) -> Result<(), Error> {
    tracing::info!(
        source = ?event.payload.source,
        detail_type = ?event.payload.detail_type,
        "Scheduled job triggered"
    );

    // Nightly cleanup, batch processing, etc.
    run_cleanup_job().await?;

    Ok(())
}

async fn run_cleanup_job() -> Result<(), Error> {
    tracing::info!("Running cleanup job");
    // ... cleanup logic ...
    Ok(())
}

[dependencies]
aws-config = "1.5"
aws-sdk-dynamodb = "1.55"
aws-sdk-s3 = "1.65"
aws-sdk-secretsmanager = "1.50"

use aws_config::BehaviorVersion;
use aws_sdk_dynamodb::{
    types::AttributeValue,
    Client as DynamoClient,
};

async fn get_item(client: &DynamoClient, id: &str) -> Result<Option<String>, aws_sdk_dynamodb::Error> {
    let result = client
        .get_item()
        .table_name("my-table")
        .key("id", AttributeValue::S(id.to_string()))
        .send()
        .await?;

    Ok(result
        .item()
        .and_then(|item| item.get("data"))
        .and_then(|v| v.as_s().ok())
        .cloned())
}

async fn put_item(client: &DynamoClient, id: &str, data: &str) -> Result<(), aws_sdk_dynamodb::Error> {
    client
        .put_item()
        .table_name("my-table")
        .item("id", AttributeValue::S(id.to_string()))
        .item("data", AttributeValue::S(data.to_string()))
        .item("ttl", AttributeValue::N(
            (std::time::SystemTime::now()
                .duration_since(std::time::UNIX_EPOCH)
                .unwrap()
                .as_secs() + 86400)
                .to_string()
        ))
        .send()
        .await?;

    Ok(())
}

#[tokio::main]
async fn main() -> Result<(), lambda_runtime::Error> {
    let aws_config = aws_config::load_defaults(BehaviorVersion::latest()).await;
    let dynamo = DynamoClient::new(&aws_config);

    // dynamo is cloneable and thread-safe — pass it by clone or Arc to your handler
    lambda_runtime::run(lambda_runtime::service_fn(move |event| {
        let client = dynamo.clone();
        async move {
            // use client in handler
            let _ = get_item(&client, "test").await;
            Ok::<serde_json::Value, lambda_runtime::Error>(serde_json::json!({}))
        }
    }))
    .await
}

[dependencies]
thiserror = "1"
anyhow = "1"

use thiserror::Error;

#[derive(Error, Debug)]
pub enum AppError {
    #[error("item not found: {id}")]
    NotFound { id: String },

    #[error("validation error: {field} - {message}")]
    ValidationError { field: String, message: String },

    #[error("database error: {0}")]
    DatabaseError(#[from] aws_sdk_dynamodb::Error),

    #[error("downstream service error: {status} - {body}")]
    DownstreamError { status: u16, body: String },
}

async fn find_item(client: &aws_sdk_dynamodb::Client, id: &str) -> Result<String, AppError> {
    if id.is_empty() {
        return Err(AppError::ValidationError {
            field: "id".to_string(),
            message: "cannot be empty".to_string(),
        });
    }

    let result = client
        .get_item()
        .table_name("items")
        .key("id", aws_sdk_dynamodb::types::AttributeValue::S(id.to_string()))
        .send()
        .await?; // DatabaseError via #[from]

    result
        .item()
        .and_then(|i| i.get("data"))
        .and_then(|v| v.as_s().ok())
        .cloned()
        .ok_or_else(|| AppError::NotFound { id: id.to_string() })
}

use anyhow::{anyhow, Context, Result};

async fn handler(event: LambdaEvent<Request>) -> Result<Response, lambda_runtime::Error> {
    let data = fetch_data(&event.payload.id)
        .await
        .context("failed to fetch item from DynamoDB")?;

    let processed = process_data(data)
        .context("data processing failed")?;

    Ok(Response { result: processed })
}

use tracing_subscriber::{fmt, layer::SubscriberExt, util::SubscriberInitExt, EnvFilter};

fn init_tracing() {
    tracing_subscriber::registry()
        .with(EnvFilter::from_default_env())
        .with(fmt::layer().json())
        .init();
}

async fn handler(event: LambdaEvent<Request>) -> Result<Response, Error> {
    let request_id = event.context.request_id.clone();

    // Create a span with request_id so all child logs include it
    let span = tracing::info_span!("handler", request_id = %request_id);
    let _guard = span.enter();

    tracing::info!(
        user_id = %event.payload.user_id,
        operation = "fetch",
        "Starting operation"
    );

    // ... handler logic ...

    tracing::info!(duration_ms = 14, "Operation complete");

    Ok(Response { /* ... */ })
}

filter @message like /handler/
| parse @message '{"timestamp":"*","level":"*","message":"*","request_id":"*"' as ts, level, msg, reqId
| filter level = "ERROR"
| stats count() by reqId
| sort count desc

[dependencies]
lambda-otel-lite = "0.10"
opentelemetry = "0.25"

use lambda_otel_lite::{init_telemetry, TelemetryConfig};
use opentelemetry::trace::Tracer;

#[tokio::main]
async fn main() -> Result<(), Error> {
    let (tracer_provider, completion_handler) = init_telemetry(
        TelemetryConfig::builder()
            .with_service_name("my-function")
            .build()
    ).await?;

    lambda_runtime::run(service_fn(|event| async move {
        let tracer = tracer_provider.tracer("my-function");
        let span = tracer.start("handle_request");
        // ... handler logic ...
        drop(span);
        Ok::<_, Error>(serde_json::json!({}))
    })).await?;

    completion_handler.shutdown().await;
    Ok(())
}

name: Deploy Lambda

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  id-token: write  # Required for OIDC authentication
  contents: read

env:
  RUST_VERSION: "1.83"
  FUNCTION_NAME: "my-function"
  AWS_REGION: "us-east-1"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/index
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-

      - name: Run tests
        run: cargo test --all

      - name: Run cargo audit
        run: |
          cargo install cargo-audit --locked
          cargo audit

  deploy:
    needs: test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: ${{ env.RUST_VERSION }}

      - name: Cache cargo registry and build artifacts
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/index
            target/
          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

      - name: Install cargo-lambda
        run: pip install cargo-lambda

      - name: Build for ARM64
        run: cargo lambda build --release --arm64

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/github-actions-deploy
          aws-region: ${{ env.AWS_REGION }}

      - name: Deploy to Lambda
        run: |
          cargo lambda deploy             --function-name ${{ env.FUNCTION_NAME }}             --iam-role arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/lambda-execution-role

      - name: Smoke test
        run: |
          cargo lambda invoke ${{ env.FUNCTION_NAME }}             --remote             --data-ascii '{"test": true}'

def handler(event, context):
    name = event.get('name', '')
    if not name:
        raise ValueError("name is required")
    return {'message': f'Hello, {name}!', 'requestId': context.aws_request_id}

use lambda_runtime::{run, service_fn, Error, LambdaEvent};
use serde::{Deserialize, Serialize};

#[derive(Deserialize)]
struct Request { name: String }

#[derive(Serialize)]
struct Response { message: String, request_id: String }

async fn handler(event: LambdaEvent<Request>) -> Result<Response, Error> {
    if event.payload.name.is_empty() {
        return Err("name is required".into());
    }
    Ok(Response {
        message: format!("Hello, {}!", event.payload.name),
        request_id: event.context.request_id,
    })
}

#[tokio::main]
async fn main() -> Result<(), Error> {
    run(service_fn(handler)).await
}

# template.yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  MyFunction:
    Type: AWS::Serverless::Function
    Metadata:
      BuildMethod: rust-cargolambda
      BuildProperties:
        Binary: my-function
    Properties:
      FunctionName: my-function
      CodeUri: ./
      Handler: bootstrap
      Runtime: provided.al2023
      Architectures:
        - arm64
      MemorySize: 128
      Timeout: 30
      Environment:
        Variables:
          RUST_LOG: info
      Events:
        ApiEvent:
          Type: HttpApi
          Properties:
            Path: /items/{id}
            Method: GET

import { Stack } from 'aws-cdk-lib';
import { RustFunction } from 'cargo-lambda-cdk';
import * as apigateway from 'aws-cdk-lib/aws-apigatewayv2';
import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations';

export class MyStack extends Stack {
  constructor(scope: any, id: string) {
    super(scope, id);

    const fn = new RustFunction(this, 'MyFunction', {
      functionName: 'my-function',
      manifestPath: 'Cargo.toml',
      architecture: 'arm64',
      memorySize: 128,
      timeout: cdk.Duration.seconds(30),
      environment: {
        RUST_LOG: 'info',
        TABLE_NAME: 'my-table',
      },
    });

    const api = new apigateway.HttpApi(this, 'Api');
    api.addRoutes({
      path: '/items/{id}',
      methods: [apigateway.HttpMethod.GET],
      integration: new HttpLambdaIntegration('ItemIntegration', fn),
    });
  }
}

resource "null_resource" "build_lambda" {
  triggers = {
    src_hash = sha256(join("", [for f in fileset("src", "**/*.rs") : filesha256("src/${f}")]))
  }

  provisioner "local-exec" {
    command = "cargo lambda build --release --arm64"
  }
}

data "archive_file" "lambda_zip" {
  depends_on  = [null_resource.build_lambda]
  type        = "zip"
  source_file = "${path.module}/target/lambda/my-function/bootstrap"
  output_path = "${path.module}/target/lambda/my-function.zip"
}

resource "aws_lambda_function" "my_function" {
  depends_on       = [null_resource.build_lambda]
  function_name    = "my-function"
  filename         = data.archive_file.lambda_zip.output_path
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
  handler          = "bootstrap"
  runtime          = "provided.al2023"
  architectures    = ["arm64"]
  memory_size      = 128
  timeout          = 30
  role             = aws_iam_role.lambda_role.arn

  environment {
    variables = {
      RUST_LOG = "info"
    }
  }
}

use aws_sdk_secretsmanager::Client as SecretsClient;
use tokio::sync::OnceCell;

static DB_PASSWORD: OnceCell<String> = OnceCell::const_new();

async fn get_db_password() -> &'static str {
    DB_PASSWORD.get_or_init(|| async {
        let config = aws_config::load_defaults(aws_config::BehaviorVersion::latest()).await;
        let client = SecretsClient::new(&config);

        client
            .get_secret_value()
            .secret_id("prod/my-function/db-password")
            .send()
            .await
            .expect("failed to fetch secret")
            .secret_string()
            .expect("secret has no string value")
            .to_string()
    }).await
}

# Install cargo-audit
cargo install cargo-audit --locked

# Audit your dependency tree against the RustSec advisory database
cargo audit

# Example output:
# Crate:         openssl
# Version:       0.10.55
# Advisory:      RUSTSEC-2023-0044
# Severity:      high (8.1)
# Fix:           Upgrade to >= 0.10.57

# Add to CI to fail builds on high-severity advisories
cargo audit --deny warnings

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789:table/my-table"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

Need High-Performance Rust & AWS Lambda Solutions?

At Nandann Creative, we build fast, production-grade applications. If your cloud costs are spiraling or you need maximum scale without latency spikes, we can help you transition to Rust and AWS Lambda.