Tendrl

Docs / Strand / connectors/aws-lambda

AWS Lambda

Direction: Read / Write | Type: aws.lambda

Amazon Lambda connector for invoking serverless functions. Supports synchronous (request/response) and asynchronous (fire-and-forget) invocations.

Required Permissions

The IAM user or role must have the following permissions:

Operation Required IAM Permissions
invoke lambda:InvokeFunction
Tip: Scope permissions to specific function ARNs to follow the principle of least privilege.

Operations

Operation Direction Description
invoke Write Invoke a Lambda function

Connector Configuration

Field Required Default Description
Authentication Type No api_key api_key for explicit credentials, role to use the host's IAM role / default credential chain
Region Yes - AWS region code (e.g., us-east-1)
Endpoint URL No - Custom endpoint for a self-managed target or an AWS VPC endpoint. Leave empty for AWS.
Access Key ID Conditional - AWS access key (encrypted). Required when Authentication Type is api_key
Secret Access Key Conditional - AWS secret key (encrypted). Required when Authentication Type is api_key
Role ARN Conditional - Your IAM role ARN for cross-account access via STS AssumeRole. Required when Authentication Type is role. The role must trust the Tendrl AWS account.
External ID No - External ID for STS AssumeRole (encrypted). Recommended with role auth to prevent confused-deputy attacks.
Function Name No - Default Lambda function name or ARN (can be overridden at node level)
Role-Based Authentication

With role authentication you do not store static access keys; Strand authenticates using the host's default credential chain (EC2 instance profile, ECS task role, or environment credentials). You must still provide a Role ARN when creating the connector (the role should trust the Tendrl AWS account); an optional External ID hardens the trust policy.

Node Configuration

Field Required Description
Function Name No Lambda function name or ARN (overrides connector default)
Invocation Type No RequestResponse (synchronous, default) or Event (asynchronous)

Output

Synchronous (RequestResponse)

json

{
  "success": true,
  "status": "completed",
  "data": {
    "function_name": "my-function",
    "response": {"result": "value"}
  },
  "service": "aws.lambda",
  "operation": "invoke"
}

Access the Lambda response:

jinja2

{{ payload.data.response.result }}

Asynchronous (Event)

json

{
  "success": true,
  "status": "invoked",
  "data": {
    "function_name": "my-function",
    "request_id": "abc-123"
  },
  "service": "aws.lambda",
  "operation": "invoke"
}

Example

Connector Setup:

json

{
  "region": "us-east-1",
  "access_key_id": "AKIAIOSFODNN7EXAMPLE",
  "secret_access_key": "wJalrXUtnFEMI/K7MDENG...",
  "function_name": "process-order"
}

Connector Setup (role-based):

json

{
  "auth_type": "role",
  "region": "us-east-1",
  "role_arn": "arn:aws:iam::123456789012:role/strand-access",
  "function_name": "process-order"
}

Node Configuration (sync):

Node Configuration (async):

← Back to Strand docs