{"id":51036848,"url":"https://github.com/rlauer6/amazon-lambda-runtime-builder","last_synced_at":"2026-06-22T07:01:23.055Z","repository":{"id":364873355,"uuid":"1244554396","full_name":"rlauer6/Amazon-Lambda-Runtime-Builder","owner":"rlauer6","description":"Create Docker containers for use with Amazon::Lambda::Runtime Lambdas","archived":false,"fork":false,"pushed_at":"2026-06-14T21:06:13.000Z","size":87,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-14T23:08:12.650Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rlauer6.png","metadata":{"files":{"readme":"README.md","changelog":"ChangeLog","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-20T11:26:56.000Z","updated_at":"2026-06-14T21:06:08.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/rlauer6/Amazon-Lambda-Runtime-Builder","commit_stats":null,"previous_names":["rlauer6/amazon-lambda-runtime-builder"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/rlauer6/Amazon-Lambda-Runtime-Builder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rlauer6%2FAmazon-Lambda-Runtime-Builder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rlauer6%2FAmazon-Lambda-Runtime-Builder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rlauer6%2FAmazon-Lambda-Runtime-Builder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rlauer6%2FAmazon-Lambda-Runtime-Builder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rlauer6","download_url":"https://codeload.github.com/rlauer6/Amazon-Lambda-Runtime-Builder/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rlauer6%2FAmazon-Lambda-Runtime-Builder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34637937,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-22T02:00:06.391Z","response_time":106,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-22T07:01:21.750Z","updated_at":"2026-06-22T07:01:23.048Z","avatar_url":"https://github.com/rlauer6.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Table of Contents\n\n* [NAME](#name)\n* [SYNOPSIS](#synopsis)\n* [DESCRIPTION](#description)\n* [COMMANDS](#commands)\n  * [install](#install)\n  * [check](#check)\n  * [check-env-file](#check-env-file)\n  * [generate-yaml](#generate-yaml)\n* [OPTIONS](#options)\n* [CONFIGURATION](#configuration)\n  * [lambda.yaml structure](#lambdayaml-structure)\n* [WORKFLOW](#workflow)\n  * [Phase 1 - Build the container image](#phase-1---build-the-container-image)\n  * [Phase 2 - Deploy and create the Lambda function](#phase-2---deploy-and-create-the-lambda-function)\n  * [Phase 3 - Configure event triggers](#phase-3---configure-event-triggers)\n  * [The policies File](#the-policies-file)\n* [MAKEFILE VARIABLES](#makefile-variables)\n* [MAKEFILE TARGETS](#makefile-targets)\n  * [Primary Targets](#primary-targets)\n  * [Event Trigger Targets](#event-trigger-targets)\n  * [Internal Targets](#internal-targets)\n* [REQUIRED IAM PERMISSIONS](#required-iam-permissions)\n    * [ECR](#ecr)\n    * [IAM](#iam)\n    * [Lambda](#lambda)\n    * [SQS / SNS / S3 / EventBridge / STS](#sqs--sns--s3--eventbridge--sts)\n    * [Handler Runtime Permissions](#handler-runtime-permissions)\n* [OPTIONAL DEPENDENCIES](#optional-dependencies)\n* [SEE ALSO](#see-also)\n* [AUTHOR](#author)\n* [LICENSE](#license)\n# NAME\n\nAmazon::Lambda::Runtime::Builder - Project scaffolding and environment\nchecker for Perl Lambda container images\n\n# SYNOPSIS\n\n    # Scaffold a new project in the current directory\n    alr-builder install\n\n    # Scaffold into a specific directory\n    alr-builder install --install-dir /path/to/my-lambda\n\n    # Verify tools and IAM permissions before your first build\n    alr-builder check\n\n    # Validate lambda.env (or lambda.yaml) against this Lambda's requirements\n    alr-builder check-env-file\n\n    # Migrate an existing lambda.env to lambda.yaml\n    alr-builder generate-yaml\n\n# DESCRIPTION\n\n`Amazon::Lambda::Runtime::Builder` is the companion deployment tool for\n[Amazon::Lambda::Runtime](https://metacpan.org/pod/Amazon%3A%3ALambda%3A%3ARuntime). It handles everything outside of the Perl\nruntime itself: scaffolding a new project directory, verifying your build\nenvironment, and documenting the full build and deploy workflow.\n\nIt provides four commands via the `alr-builder` CLI:\n\n- **install** - copies the project scaffold (Dockerfile, Makefile,\nhandler template, cpanfile, and test fixtures) into a target directory.\n- **check** - verifies that required system tools are present on\nyour `PATH` and, if the optional IAM modules are installed, confirms\nthat your AWS credentials have sufficient permissions to build and deploy.\n- **check-env-file** - validates `lambda.env` (or `lambda.yaml`, if\npresent) against this Lambda's configuration requirements, reporting\nmissing required values, customized values, and values using defaults.\n- **generate-yaml** - migrates an existing, hand-written `lambda.env`\nto a minimal `lambda.yaml`, the starting point for the generate-on-demand\nworkflow described in [\"CONFIGURATION\"](#configuration).\n\n# COMMANDS\n\n## install\n\n    alr-builder install [--install-dir DIR]\n\nCopies the project scaffold from the distribution's `share/` directory\ninto the target directory (defaults to the current working directory).\nCreates the directory if it does not exist.\n\nThe following files are installed:\n\n- `Dockerfile` - multi-stage build using `debian:trixie-slim`.\nThe builder stage installs Perl, build tools, and your `cpanfile`\ndependencies via Carton. The runtime stage is a minimal image containing\nonly the Perl interpreter, runtime libraries, and your handler.\n- `LambdaHandler.pm.in` - handler template with stub\nimplementations for SQS, SNS, S3, and EventBridge events, plus a\nstreaming response example for Function URL invocations. Rename or copy\nthis file and customize it for your Lambda.\n- `Makefile` (installed as `Makefile.build`, renamed on install)\n- provides targets for the complete build and deployment workflow. See\n[\"WORKFLOW\"](#workflow) and [\"MAKEFILE TARGETS\"](#makefile-targets).\n- `cpanfile` - starting point for your Perl dependencies. Add\nmodules here.\n- Test fixture makefiles - `sqs-test.mk`, `sns-test.mk`,\n`s3-test.mk`, `eventbridge-test.mk`, `streaming-test.mk` - provide\ntargets for creating and testing each event source trigger.\n- `payload.json`, `payload-sns.json` - sample invocation payloads\nfor `make invoke` and `make test-sns`.\n- `ecr-create-repo.mk` - creates the ECR repository if it does\nnot already exist.\n- `policies` - IAM managed policy ARNs to attach to the Lambda\nexecution role. Add one ARN per line; lines beginning with `#` are\ncomments.\n\n## check\n\n    alr-builder check\n\nVerifies that your environment is ready to build and deploy. Checks two\nthings:\n\n**Required system tools** - `docker` and `make` must be on your\n`PATH`. `curl` is checked as an optional tool. Missing required\ntools are reported as errors.\n\n**IAM permissions** - if [Amazon::API::IAM](https://metacpan.org/pod/Amazon%3A%3AAPI%3A%3AIAM), [Amazon::API::STS](https://metacpan.org/pod/Amazon%3A%3AAPI%3A%3ASTS), and\n[Amazon::Credentials](https://metacpan.org/pod/Amazon%3A%3ACredentials) are installed, calls `SimulatePrincipalPolicy`\nusing your current credentials to confirm your IAM identity has the\npermissions required to build and deploy. See [\"REQUIRED IAM PERMISSIONS\"](#required-iam-permissions)\nfor the full list.\n\nIf the IAM modules are not installed, tool checks still run but permission\nchecking is skipped with a warning.\n\n## check-env-file\n\n    alr-builder check-env-file\n\nValidates the project's configuration against this Lambda's requirements\n(see [\"CONFIGURATION\"](#configuration)). Reads `lambda.env` if present - an absent\n`lambda.env` is treated as \"nothing configured yet\", useful for seeing\nthe full set of required and defaulted values for a brand-new project -\nand reports three groups:\n\n- **MISSING (required)** - required values with no default that are\nnot set. `image.handler` (`HANDLER_CLASS`) is required for every trigger\ntype; `trigger.bucket` (`BUCKET_NAME`) is additionally required for the\n`s3-sqs` trigger type.\n- **Customized** - values present in `lambda.env` that differ from\ntheir `lambda-mapping.yml` default, or have no default at all.\n- **Using defaults** - values not set in `lambda.env`, and the\ndefault that applies in their place.\n\nExits non-zero if any required values are missing.\n\n## generate-yaml\n\n    alr-builder generate-yaml\n\nMigrates an existing `lambda.env` to `lambda.yaml`. Requires\n`lambda.env` to exist and `lambda.yaml` to not already exist - this is a\none-time migration step, not something to re-run once `lambda.yaml` is\nyour source of truth (see [\"CONFIGURATION\"](#configuration)).\n\nPerforms the same validation as `check-env-file` first; if any required\nvalues are missing, no `lambda.yaml` is written and the missing fields\nare reported instead. Otherwise, writes a minimal `lambda.yaml`\ncontaining only values that differ from their defaults (plus any field\nwith no default, such as `trigger.bucket`/`trigger.prefix`) - fields\nmatching their default are omitted, since `Makefile.mk` applies the same\ndefaults via `lambda-mapping.yml`.\n\n# OPTIONS\n\n- `--install-dir|-i` DIR\n\n    Target directory for `install`. Defaults to the current working directory.\n\n- `--log-level|-l` LEVEL\n\n    Log verbosity. Accepts Log4perl level names: `trace`, `debug`, `info`\n    (default), `warn`, `error`, `fatal`.\n\n- `--help|-h`\n\n    Display usage information.\n\n# CONFIGURATION\n\nYour Lambda's configuration - function name, memory, timeout, trigger\ndetails, and so on - lives in `lambda.env`, a flat `KEY = value` file\nthat `Makefile.mk` reads via `-include lambda.env`. Every field has a\ncorresponding entry in `lambda-mapping.yml` (installed as part of this\ndistribution), which also defines each field's default.\n\n`lambda.env` can be managed in either of two ways:\n\n- **Hand-written** - edit `lambda.env` directly. This is the\noriginal, and still fully supported, workflow. Run `alr-builder\ncheck-env-file` to verify it against `lambda-mapping.yml`'s requirements.\n- **Generated from lambda.yaml** - write a `lambda.yaml` describing\nonly the values that matter for your Lambda; everything else comes from\n`lambda-mapping.yml`'s defaults. `alr-builder` regenerates `lambda.env`\nfrom `lambda.yaml` automatically whenever `lambda.yaml` is newer than\n`lambda.env`, or when `lambda-mapping.yml`'s mapping version has changed\nsince `lambda.env` was last generated. A generated `lambda.env` begins\nwith a header noting it is generated; hand edits to it are overwritten\nthe next time `lambda.yaml` changes.\n\nTo move an existing `lambda.env` to the `lambda.yaml` workflow, run\n`alr-builder generate-yaml` once.\n\n## lambda.yaml structure\n\nFor the `s3-sqs` trigger type (currently the only supported type):\n\n    image:\n      repo: ...            # ECR repository name (REPO_NAME)\n      handler: ...         # Perl handler class (HANDLER_CLASS) - required\n    lambda:\n      name: ...            # function name (FUNCTION_NAME)\n      timeout: ...         # seconds (TIMEOUT)\n      memory: ...          # MB (MEMORY)\n      concurrency: ...     # reserved concurrency (CONCURRENCY)\n    role:\n      name: ...            # IAM role name (ROLE_NAME)\n      profile: ...         # named policy profile (ROLE_PROFILE)\n    trigger:\n      type: s3-sqs\n      bucket: ...          # source S3 bucket (BUCKET_NAME) - required\n      prefix: ...          # key prefix filter (KEY_PREFIX)\n      event: ...           # S3 event type (S3_EVENT)\n      queue:\n        name: ...                     # SQS queue name (QUEUE_NAME)\n        batch_size: ...               # (BATCH_SIZE)\n        visibility_timeout: ...       # seconds (VISIBILITY_TIMEOUT)\n        retention: ...                # seconds (RETENTION)\n        receive_count: ...            # max receives before DLQ (RECEIVE_COUNT)\n        partial_batch_response: ...   # true/false (PARTIAL_BATCH_RESPONSE)\n        dlq:\n          name: ...          # DLQ name (DLQ_NAME)\n          retention: ...     # seconds (DLQ_RETENTION)\n\n`image.handler` is required for every trigger type; `trigger.bucket` is\nadditionally required for `s3-sqs`. Every other field may be omitted, in\nwhich case `lambda-mapping.yml`'s default applies. See [\"MAKEFILE\nTARGETS\"](#makefile-targets) for how `role.profile` is applied.\n\n# WORKFLOW\n\nThe typical workflow for a new Lambda function:\n\n1. **Scaffold the project**:\n\n        alr-builder install --install-dir my-lambda\n        cd my-lambda\n\n2. **Verify your environment**:\n\n        alr-builder check\n\n3. **Implement your handler** - edit `LambdaHandler.pm.in` or create your\nown handler module. Add dependencies to `cpanfile`.\n4. **Build a CPAN distribution** - `install` provides a template handler\nmodule (`LambdaHandler.pm.in`); turn it into a standard CPAN\ndistribution (with its own `META.json`/`Makefile.PL` or equivalent)\nusing whatever tooling you prefer, then run `make dist` to produce a\ndistribution tarball. `make image` resolves `DIST_TARBALL` to the most\nrecent `$(DIST_NAME)-*.tar.gz` in `$(BUILDER_HOME)`, where `DIST_NAME`\ncomes from that distribution's `META.json`.\n5. **First-time deployment** - builds the image, pushes to ECR, creates the\nIAM role and Lambda function:\n\n        make lambda-function\n\n6. **Test**:\n\n        make invoke\n\n7. **Deploy subsequent changes**:\n\n        make update-function\n\n## Phase 1 - Build the container image\n\n`make image` requires a CPAN distribution tarball\n(`$(DIST_NAME)-*.tar.gz`) to already exist in `$(BUILDER_HOME)` -\nsee Workflow step 4.\n\nLambda runs your handler inside an OCI-compliant container image. The\nimage must contain a Perl interpreter, your CPAN dependencies,\n`Amazon::Lambda::Runtime`, the `bootstrap` entrypoint, the `plambda.pl`\ndriver, and your handler module.\n\nThe installed Dockerfile handles all of this. Build with:\n\n    make image\n\nThe key Dockerfile directives that wire everything together:\n\n    ARG LAMBDA_MODULE=LambdaHandler.pm\n    COPY ${LAMBDA_MODULE} /usr/src/app/local/lib/perl5\n\n    ENV PERL5LIB=/usr/src/app/local/lib/perl5\n    ENV LAMBDA_MODULE=${LAMBDA_MODULE}\n\n    ENTRYPOINT [\"/usr/local/bin/bootstrap\"]\n\n`ENV LAMBDA_MODULE` tells `bootstrap` which handler to load.\nSet `LAMBDA_MODULE` at build time to use a different handler module:\n\n    make image LAMBDA_MODULE=MyHandler.pm\n\n## Phase 2 - Deploy and create the Lambda function\n\nOnce the image is built it must be pushed to ECR and the Lambda function\ncreated or updated.\n\nFor a first-time deployment, a single target runs the full dependency\nchain automatically:\n\n    make lambda-function\n\nThis runs: `ecr-repo` =\u003e `deploy` =\u003e `lambda-role` =\u003e `lambda-policies`\n\u0026#x3d;\u003e `lambda-function`. Each step is idempotent - re-running is always safe.\nSentinel files track completed steps so `make` skips what already exists.\n\nTo deploy a code change:\n\n    make update-function\n\nThis rebuilds the image, pushes to ECR using the image digest (never\n`:latest`), and updates the Lambda function code.\n\n## Phase 3 - Configure event triggers\n\nThe installed Makefile already includes all five trigger makefiles, so\nall trigger targets are available immediately. Use whichever targets\napply to your Lambda:\n\n    make lambda-sqs-trigger QUEUE_NAME=my-queue\n    make lambda-s3-trigger  BUCKET_NAME=my-bucket\n    make lambda-eventbridge-trigger\n    make lambda-function-url\n    make test-streaming\n\nSee [\"MAKEFILE TARGETS\"](#makefile-targets) for the full list of targets provided by each\ntrigger makefile and the variables that control their behavior.\n\n## The policies File\n\nThe `policies` file controls which IAM managed policies are attached\nto the Lambda execution role. Add one policy ARN per line:\n\n    # required - CloudWatch logging\n    arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole\n\n    # uncomment for SQS trigger\n    # arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole\n\n    # uncomment for S3 read access\n    # arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess\n\nApply changes at any time:\n\n    make update-policies\n\n**Note:** receiving an event from a service does not automatically grant\nyour handler permission to call that service's APIs. An S3 trigger allows\nLambda to invoke your function - it does not allow your function to read\nor write S3 objects. For broad access, add or uncomment the appropriate\nmanaged policy ARN in the `policies` file and run `make update-policies`.\nFor access to a specific resource - a particular bucket, queue, or topic -\ncreate a custom IAM policy that scopes the permissions to that resource ARN\nand attach it to the execution role (`ROLE_NAME`) via the AWS console or\nCLI, then add its ARN to the `policies` file so `make update-policies`\nkeeps it attached on subsequent deployments.\n\n# MAKEFILE VARIABLES\n\nFor `s3-sqs` configuration (function name, memory, timeout, queue\nsettings, and so on), see [\"CONFIGURATION\"](#configuration) and `lambda-mapping.yml`.\nThe variables below are either tool-level (apply regardless of trigger\ntype) or specific to trigger types not yet covered by `lambda.yaml`.\n\n- `AWS_PROFILE`\n\n    AWS profile. Default: `default`\n\n- `REGION`\n\n    AWS region. Default: `us-east-1`\n\n- `PERL_LAMBDA`\n\n    Docker image name (local). Default: `perl-lambda`\n\n- `LAMBDA_MODULE`\n\n    Your handler module filename. Default: `LambdaHandler.pm`\n\n- `PAYLOAD`\n\n    Payload file for `make invoke`. Default: `payload.json`\n\n- `AWS_ACCOUNT`\n\n    AWS account ID. Resolved automatically via `alr-helper get-account`\n    if not set. Set it explicitly to avoid the STS call:\n\n        export AWS_ACCOUNT=$(alr-helper get-account)\n\n- `RULE_NAME`\n\n    EventBridge rule name. Default: `lambda-handler-test`\n\n- `SCHEDULE_EXPRESSION`\n\n    EventBridge schedule. Default: `rate(1 minute)`\n\n- `INVOKE_MODE`\n\n    Lambda Function URL invoke mode. Default: `RESPONSE_STREAM`\n\n# MAKEFILE TARGETS\n\n## Primary Targets\n\n- `lambda-function`\n\n    First-time deployment. Runs the full dependency chain: ECR repository,\n    IAM role, policies, image build, push, and function creation. Run once\n    per function.\n\n- `update-function`\n\n    Deploy a code change. Rebuilds the image, pushes to ECR, and updates the\n    Lambda function code.\n\n- `invoke`\n\n    Test the function with `$(PAYLOAD)` and print the response.\n\n- `clean`\n\n    Remove local sentinel files. AWS resources are not affected.\n\n- `update-policies`\n\n    Re-attach IAM policies to the execution role. If `ROLE_PROFILE` is set\n    (in `lambda.env`/`lambda.yaml`), attaches the policies listed for that\n    profile in `profiles.yml`; otherwise, attaches the policies listed in\n    the `policies` file.\n\n- `lambda-configuration`\n\n    Updates the function's memory and timeout from `lambda.env` (`MEMORY`,\n    `TIMEOUT`) via `UpdateFunctionConfiguration`. Useful for applying a\n    configuration-only change without rebuilding the image.\n\n## Event Trigger Targets\n\n- `lambda-sqs-trigger`\n\n    Creates an SQS queue (`QUEUE_NAME`) and attaches it as an event source.\n    Requires `AWSLambdaSQSQueueExecutionRole` in the `policies` file. A\n    component of `lambda-sqs-pipeline`; run that instead unless you\n    specifically need just the queue/event-source step.\n\n- `lambda-sqs-pipeline`\n\n    Runs the full `s3-sqs` trigger setup: creates the SQS queue and DLQ,\n    configures the S3-to-SQS event source mapping, sets reserved concurrency\n    (`CONCURRENCY`), applies `lambda-configuration` (`MEMORY`/`TIMEOUT`),\n    and sets the event source mapping's `FunctionResponseTypes` according to\n    `PARTIAL_BATCH_RESPONSE`. This is the target to run - or re-run after\n    editing `lambda.yaml`/`lambda.env` - for `s3-sqs` projects.\n\n- `lambda-s3-trigger`\n\n    Configures S3 bucket notifications to invoke the Lambda on `S3_EVENT`\n    events.\n\n- `lambda-eventbridge-trigger`\n\n    Registers the Lambda as the target of an EventBridge scheduled rule.\n\n- `enable-eventbridge-rule` / `disable-eventbridge-rule`\n\n    Enables or disables the EventBridge rule without deleting infrastructure.\n    Use `disable-eventbridge-rule` after testing to stop scheduled invocations.\n\n- `delete-eventbridge-rule`\n\n    Removes targets and deletes the rule. Targets must be removed before the\n    rule can be deleted.\n\n- `lambda-function-url`\n\n    Creates a Lambda Function URL with `auth-type NONE` and\n    `InvokeMode=$(INVOKE_MODE)`.\n\n- `test-streaming`\n\n    Invokes the Function URL with `curl -sN` to test streaming responses.\n\n## Internal Targets\n\nCalled automatically as dependencies - you should not need to invoke\nthese directly:\n\n`image` - builds the Docker image.\n`ecr-repo` - creates the ECR repository if it does not exist.\n`deploy` - logs in to ECR and pushes the image using the image digest.\n`lambda-role` - creates the IAM execution role if it does not exist.\n`lambda-policies` - attaches policies to the execution role, either from\n`profiles.yml` (if `ROLE_PROFILE` is set) or the `policies` file.\n`lambda-concurrency` - sets reserved concurrency (`CONCURRENCY`) via\n`PutFunctionConcurrency`.\n`lambda-sqs-response-types` - sets the SQS event source mapping's\n`FunctionResponseTypes` according to `PARTIAL_BATCH_RESPONSE`.\n`policy-document` - generates the IAM assume-role trust policy JSON.\n\n# REQUIRED IAM PERMISSIONS\n\nThe `check` command verifies these permissions via\n`SimulatePrincipalPolicy`. You will need them to run the full build and\ndeploy workflow.\n\n### ECR\n\n    ecr:CreateRepository         ecr:DescribeRepositories\n    ecr:GetAuthorizationToken    ecr:BatchCheckLayerAvailability\n    ecr:PutImage                 ecr:InitiateLayerUpload\n    ecr:UploadLayerPart          ecr:CompleteLayerUpload\n    ecr:PutLifecyclePolicy       ecr:GetLifecyclePolicy\n\n### IAM\n\n    iam:GetRole                  iam:CreateRole\n    iam:AttachRolePolicy         iam:PassRole\n    iam:ListAttachedRolePolicies\n\n**Note:** `iam:PassRole` is frequently overlooked. Its absence produces\na confusing `InvalidParameterValueException` stating the role cannot be\nassumed by Lambda even though the role exists and appears correct.\n\n### Lambda\n\n    lambda:GetFunction              lambda:CreateFunction\n    lambda:UpdateFunctionCode       lambda:UpdateFunctionConfiguration\n    lambda:GetFunctionConfiguration lambda:InvokeFunction\n    lambda:CreateEventSourceMapping lambda:ListEventSourceMappings\n    lambda:GetPolicy                lambda:AddPermission\n    lambda:RemovePermission         lambda:CreateFunctionUrlConfig\n    lambda:GetFunctionUrlConfig     lambda:DeleteFunctionUrlConfig\n\n### SQS / SNS / S3 / EventBridge / STS\n\n    sqs:ListQueues                  sqs:CreateQueue\n    sns:ListTopics                  sns:CreateTopic\n    sns:Subscribe                   sns:GetTopicAttributes\n    s3:CreateBucket                 s3:ListBuckets\n    s3:PutBucketNotificationConfiguration\n    events:DescribeRule             events:PutRule\n    events:PutTargets               events:RemoveTargets\n    events:DeleteRule               events:EnableRule\n    events:DisableRule\n    sts:GetCallerIdentity\n\n### Handler Runtime Permissions\n\n`AWSLambdaBasicExecutionRole` covers CloudWatch logging only. Any AWS\nAPIs your handler calls directly require additional policies in the\n`policies` file. For example, a handler that reads S3 objects needs\n`AmazonS3ReadOnlyAccess` even if its trigger is an S3 event notification\n\\- the trigger and the API access are governed by separate policies.\n\n# OPTIONAL DEPENDENCIES\n\nIAM permission checking in `check` requires:\n\n- [Amazon::API::IAM](https://metacpan.org/pod/Amazon%3A%3AAPI%3A%3AIAM)\n- [Amazon::API::STS](https://metacpan.org/pod/Amazon%3A%3AAPI%3A%3ASTS)\n- [Amazon::Credentials](https://metacpan.org/pod/Amazon%3A%3ACredentials)\n\nThese are not hard dependencies - the tool is fully functional without\nthem, but `check` will only verify system tools.\n\n# SEE ALSO\n\n[Amazon::Lambda::Runtime](https://metacpan.org/pod/Amazon%3A%3ALambda%3A%3ARuntime) - the runtime library your handler inherits from\n\n[Amazon::Credentials](https://metacpan.org/pod/Amazon%3A%3ACredentials) - credential provider used for IAM permission checking\n\n[Amazon::API::IAM](https://metacpan.org/pod/Amazon%3A%3AAPI%3A%3AIAM), [Amazon::API::STS](https://metacpan.org/pod/Amazon%3A%3AAPI%3A%3ASTS) - AWS API clients used by `check`\n\n# AUTHOR\n\nRob Lauer - \u003crlauer@treasurersbriefcase.com\u003e\n\n# LICENSE\n\n(c) Copyright 2019-2026 Robert C. Lauer. All rights reserved. This\nmodule is free software. It may be used, redistributed and/or modified\nunder the same terms as Perl itself.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frlauer6%2Famazon-lambda-runtime-builder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frlauer6%2Famazon-lambda-runtime-builder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frlauer6%2Famazon-lambda-runtime-builder/lists"}