--- title: AWS Lambda actions source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/aws/aws-lambda --- This page provides a reference for AWS Lambda actions available in the workflow automation actions catalog. Use these actions to manage and invoke Lambda functions as part of your workflow definitions. ## Prerequisites Before using AWS Lambda actions in workflow automation, ensure you have: - An AWS account with appropriate permissions. - AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials). At least one credential option must be provided — IAM role takes precedence over static access keys. - The necessary IAM permissions for the specific Lambda operations you plan to use. See [Set up AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions. ## Invoke a Lambda function The action identifier is `aws.lambda.invoke`. Invokes a Lambda function synchronously or asynchronously with an optional payload. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | --------------------------------------------------------------------------- | ------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the function is located. | `us-east-2` | | `functionName` | String | Required. Name of the Lambda function to invoke. | `hello-you` | | `payload` | Map | Optional. Input payload to pass to the function. | `{"user": "R2-D2"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "payload", "expression": ".payload"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | ----------------- | -------- | --------------------------------------------- | | `payload` | Map | `{"statusCode": 200, "body": "Hello R2-D2!"}` | | `statusCode` | Int | `200` | | `executedVersion` | String | `"$LATEST"` | | `functionError` | String | `"Unhandled::Error occurred"` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | Error message on failure. | ## Update Lambda function configuration The action identifier is `aws.lambda.updateFunctionConfiguration`. Modifies the configuration of a Lambda function. Provide only the parameters you want to change. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the function is located. | `us-east-2` | | `functionName` | String | Required. Name of the Lambda function to update. | `my-lambda-function-to-update` | | `role` | String | Optional. ARN of the IAM role to assign to the function. | `arn:aws:iam::123456789012:role/new-lambda-role` | | `handler` | String | Optional. Updated handler for the function. | `main.new_handler` | | `description` | String | Optional. Updated description for the function. | `Updated function description` | | `parameters` | Map | Optional. Additional boto3 fields not otherwise modeled. Accepts any optional argument from the API. | `{"Timeout": "60", "MemorySize": 123}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | `{"FunctionName": "hello-you", "FunctionArn": "arn:aws:lambda:...", "Runtime": "nodejs20.x", "Timeout": 30, "MemorySize": 128}` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"An error occurred (ResourceNotFoundException) when calling the UpdateFunctionConfiguration operation: Function not found"` | ## Describe a Lambda function The action identifier is `aws.lambda.getFunction`. Retrieves the configuration details, code location, and other metadata for a specific Lambda function. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ---------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the function is located. | `us-east-2` | | `functionName` | String | Required. Name of the Lambda function. | `my-lambda-function` | | `parameters` | Map | Optional. Additional boto3 fields not otherwise modeled. Accepts any optional argument from the API. | `{"Qualifier": "1"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | Full API response. See the [get_function Boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/lambda/client/get_function.html). | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"ResourceNotFoundException: Function not found"` | ## List aliases for a Lambda function The action identifier is `aws.lambda.listAliases`. Returns a list of aliases for a Lambda function. Aliases are named pointers to function versions. Use `marker` and `maxItems` to paginate through large result sets. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ----------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the function is located. | `us-east-2` | | `functionName` | String | Required. Name of the Lambda function. | `my-lambda-function` | | `marker` | String | Optional. Pagination token. Pass the `NextMarker` value from a previous response to retrieve the next page. | `"abcd....."` | | `maxItems` | Int | Optional. Maximum number of aliases to return. | `123` | | `parameters` | Map | Optional. Additional boto3 fields not otherwise modeled. Accepts any optional argument from the API. | `{"AnotherOptionalParam": "value"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | Full API response. See the [list_aliases Boto3 reference](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/lambda/client/list_aliases.html). | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"ResourceNotFoundException: Function not found"` | ## List Lambda functions The action identifier is `aws.lambda.listFunctions`. Returns a list of Lambda functions in a region, with the version-specific configuration of each. AWS returns at most 50 functions per call — use `marker` and `maxItems` to paginate through large result sets. This action returns a subset of `FunctionConfiguration` fields. To get the complete set — including `State`, `StateReasonCode`, `LastUpdateStatus`, and `RuntimeVersionConfig` — use `aws.lambda.getFunction` instead. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region to list functions from. | `us-west-2` | | `functionVersion` | String | Optional. Set to `ALL` to include all published versions of each function in addition to the unpublished version. | `ALL` | | `marker` | String | Optional. Pagination token. Pass the `NextMarker` value from a previous response to retrieve the next page. | `"abcd....."` | | `maxItems` | Int | Optional. Maximum number of functions to return per call. AWS caps this at 50 regardless of a higher value. | `50` | | `parameters` | Map | Optional. Additional boto3 fields not otherwise modeled. `MasterRegion` is only relevant for Lambda@Edge functions and requires `functionVersion: ALL` when set. | `{"MasterRegion": "us-east-1"}` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "functions", "expression": ".response.Functions"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | `{"Functions": [{"FunctionName": "helloworld", "FunctionArn": "arn:aws:lambda:...", "Runtime": "nodejs20.x", "Timeout": 3, "MemorySize": 128}], "NextMarker": "..."}` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"InvalidParameterValueException: 1 validation error detected"` | ## Get Lambda durable execution history The action identifier is `aws.lambda.getDurableExecutionHistory`. Retrieves the execution history for a [Lambda durable execution](https://docs.aws.amazon.com/lambda/latest/dg/durable-functions.html), showing all steps, callbacks, and events that occurred. This action applies to Lambda durable executions only — it cannot retrieve invocation history for regular Lambda functions. History is available while the execution is running and for a configurable retention period after it completes (1–90 days, default 30 days). For long-running executions with many steps or callbacks, set `includeExecutionData` to `false` when you only need event types and timestamps rather than full payloads — this produces a more compact response. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | ---------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the durable execution is located. | `us-west-2` | | `durableExecutionArn` | String | Required. ARN of the durable execution to retrieve history for. | `arn:aws:lambda:us-west-2:123456789012:function:my-function:execution:abc123` | | `includeExecutionData` | Boolean | Optional. Include step results and callback payloads in the history events. Set to `false` for a more compact response. Defaults to `true`. | `true` | | `maxItems` | Int | Optional. Maximum number of history events to return per call. Default 100, maximum 1000. Set to `0` to use the default. | `100` | | `marker` | String | Optional. Pagination token. Pass the `NextMarker` value from a previous response. Tokens expire after 24 hours. | `"abcd....."` | | `reverseOrder` | Boolean | Optional. Return events newest-first (reverse chronological). Defaults to `false` (oldest-first). | `true` | | `parameters` | Map | Optional. Additional boto3 fields not otherwise modeled. | | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "events", "expression": ".response.Events"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | `{"Events": [{"EventType": "ExecutionStarted", "EventId": 1, "EventTimestamp": "2026-08-11T05:40:49.000+0000"}, {"EventType": "ExecutionSucceeded", "EventId": 4}], "NextMarker": ""}` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"ResourceNotFoundException: Durable execution not found: arn:aws:lambda:us-west-2:123456789012:function:my-function:execution:abc123"` | ## Set Lambda function concurrency The action identifier is `aws.lambda.putFunctionConcurrency`. Sets the reserved concurrency for a Lambda function — the maximum number of simultaneous executions. Reserving concurrency both ensures that the function has capacity for that number of simultaneous executions and prevents it from scaling beyond that level. The concurrency setting applies to all published versions and the unpublished version. Setting `reservedConcurrentExecutions` to `0` disables the function without deleting it. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | ------------------------------ | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the function is located. | `us-west-2` | | `functionName` | String | Required. Name, `name:version`, or ARN of the function. The 64-character length constraint applies only when specifying the name alone (not the full ARN). | `my-function` | | `reservedConcurrentExecutions` | Int | Required. Number of simultaneous executions to reserve. Minimum value is `0` (disables the function). The effective maximum is your account's unreserved concurrency pool. At least 100 unreserved executions must remain for functions without a per-function limit. | `100` | | `parameters` | Map | Optional. Additional boto3 fields not otherwise modeled. | | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "response", "expression": ".response"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | `{"ReservedConcurrentExecutions": 100}` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"InvalidParameterValueException: Specified ReservedConcurrentExecutions decreases account's UnreservedConcurrentExecution below its minimum value"` |