---
schema_version: "1"
id: dae1e315c53e0f6f505b691732130de767a0c8f6f7d6382d927d6917085b752b
title: AWS Lambda Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/latest/policies-outbound-aws-lambda.md
canonical_url: https://docs.mulesoft.com/gateway/latest/policies-outbound-aws-lambda
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 6160eae4aed79b20e4dad579d42411a0e998dc360563956eeadfb2633ed27baa
description: MuleSoft Documentation Site
release: "1.14"
latest: true
---
---
product: Omni Gateway
version: 1.14
is-latest-version: true
---

# AWS Lambda Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy name</strong></p></td><td><div><div><p>AWS Lambda</p></div></div></td></tr><tr><td><p><strong>Summary</strong></p></td><td><div><div><p>Triggers an AWS Lambda function from a standard HTTP request</p></div></div></td></tr><tr><td><p><strong>Category</strong></p></td><td><div><div><p>Transformation</p></div></div></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><div><div><p>v1.9.0</p></div></div></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><div><div><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/outbound-aws-lambda-release-notes">AWS Lambda</a></p></div></div></td></tr><tr><td rowspan="4"><p><strong>Returned Status Codes</strong></p></td><td><div><div><p>502 - Bad Gateway, requests are blocked due to circuit breaker activation</p></div></div></td></tr></tbody></table>

## Summary

The AWS Lambda policy triggers an AWS Lambda function from a standard HTTP request. Pass the HTTP
request payload as is or wrapped in a JSON schema.

The AWS Lambda policy is an extension of the AWS Lambda filter native to Envoy. To learn more about
the AWS Lambda filter, see
[AWS Lambda Filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/aws_lambda_filter).
Not all AWS Lambda filter parameters are available to the AWS Lambda policy. To find what parameters
are configurable, see [Configuring Policy Parameters](#configuring-policy-parameters).

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

```yaml
- policyRef:
    name: native-aws-lambda
  config:
    arn: <string> // REQUIRED
    payloadPassthrough: <boolean> // REQUIRED
    invocationMode: <string> // REQUIRED
    authenticationMode: <string> // REQUIRED
    credentialProfile: <string> // OPTIONAL
    credentials:
      accessKeyId: <string> // OPTIONAL
      secretAccessKey: <string> // OPTIONAL
      sessionToken: <string> // OPTIONAL
```

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>arn</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>AWS Lambda ARN in this format: <code>arn:&lt;partition&gt;:lambda:&lt;region&gt;:&lt;account-number&gt;:function:&lt;function-name&gt;</code>.</p></div></div></td></tr><tr><td><div><div><p><code>payloadPassthrough</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>false</p></div></div></td><td><div><div><p>By default, Omni sends the request to the AWS Lambda function wrapped in JSON. When <code>payloadPassthrough</code> is enabled, the request is sent as is.</p></div></div></td></tr><tr><td><div><div><p><code>invocationMode</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>sync</p></div></div></td><td><div><div><p>The way to invoke the Lambda function, either <code>sync</code> or <code>async</code>. For <code>sync</code>, Omni Gateway awaits the AWS response. For <code>async</code>, Omni Gateway doesn’t wait for the response from AWS.</p></div></div></td></tr><tr><td><div><div><p><code>authenticationMode</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Determines the mode of authentication. Options are: <code>default</code>, uses in order credential AWS environment variables, AWS credential file, AWS roles; <code>profile</code>, profile from AWS credential file; <code>static</code>, credentials configured in the policy.</p></div></div></td></tr><tr><td><div><div><p><code>credentialProfile</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Specifies the credential <code>profile</code>. Only for <code>profile</code> authentication mode.</p></div></div></td></tr><tr><td><div><div><p><code>credentials</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Configures the <code>static</code> credentials object. Only for <code>static</code> authentication mode.</p></div></div></td></tr><tr><td><div><div><p><code>credentials.accessKeyId</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>AWS access key ID</p></div></div></td></tr><tr><td><div><div><p><code>credentials.secretAccessKey</code></p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>AWS access key</p></div></div></td></tr><tr><td><div><div><p><code>credentials.sessionToken</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>Session token</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

The following example defines a rate limit of three requests every six seconds:

```yaml
- policyRef:
    name: native-aws-lambda
  config:
    arn: rn:&lt;partition&gt;:lambda:&lt;region&gt;:&lt;account-number&gt;:function:&lt;function-name&gt;
    payloadPassthrough: true
    invocationMode: sync
    authenticationMode: static
    credentials:
      accessKeyId: id
      secretAccessKey: secret
      sessionToken: token
```

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>The ARN of the AWS Lambda</p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>AWS Lambda ARN in this format: <code>arn:&lt;partition&gt;:lambda:&lt;region&gt;:&lt;account-number&gt;:function:&lt;function-name&gt;</code>.</p></div></div></td></tr><tr><td><div><div><p>Payload passthrough</p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>By default, Omni sends the request to the AWS Lambda function wrapped in JSON. When enabled, the request is sent as is.</p></div></div></td></tr><tr><td><div><div><p>Determines the way to invoke the Lambda function</p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>The way to invoke the Lambda function. For <strong>Sync</strong>, Omni Gateway awaits the AWS response. For <strong>Async</strong>, Omni Gateway doesn’t wait for the response from AWS.</p></div></div></td></tr><tr><td><div><div><p>Determines origin of credentials</p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>Determines the mode of authentication. Options are: <strong>Default</strong>, uses in order credential AWS environment variables, AWS credential file, AWS roles; <strong>Profile</strong>, profile from AWS credential file; <strong>Static</strong>, credentials configured in the policy.</p></div></div></td></tr><tr><td><div><div><p>Credentials profile</p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Specifies the credential profile. Only for <strong>Profile</strong> authentication mode.</p></div></div></td></tr><tr><td><div><div><p>Credentials</p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Configures the static credentials. Only for <strong>Static</strong> authentication mode.</p></div></div></td></tr><tr><td><div><div><p>AccessKeyId</p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>AWS access key ID</p></div></div></td></tr><tr><td><div><div><p>SecretAccessKey</p></div></div></td><td><div><div><p>Required</p></div></div></td><td><div><div><p>AWS access key</p></div></div></td></tr><tr><td><div><div><p>SessionToken</p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>Session token</p></div></div></td></tr></tbody></table>