Skip to content

README.md

Latest commit

 

History

History
44 lines (34 loc) · 6.45 KB

README.md

File metadata and controls

44 lines (34 loc) · 6.45 KB
Raw

Lambda

Parity grade: A · SDK aws-sdk-go-v2/service/lambda@v1.112.2 · last audited 2026-10-07 (51ea2ace0) · protocol REST-JSON

Coverage

Metric Value
Feature families 11 (11 ok)
Known gaps 5
Structural gaps (can't be emulated) 11
Deferred items 0
Resource leaks ok

Known gaps

  • Extensions API: the Telemetry/Logs API (/2022-07-01/telemetry, /2020-08-15/logs) is not served; extensions that subscribe get 404.
  • Extensions API: container-image functions do not start /opt/extensions executables (no image entrypoint inspection; only Zip functions with layers are wrapped by the extension launcher), and internal extensions registering for SHUTDOWN are not rejected (internal vs external is not distinguishable at register time).
  • Extensions API: the error-type strings in register 4xx bodies (Extension.InvalidExtensionName, Extension.TooManyExtensions, Extension.RegistrationClosed, Extension.AlreadyRegistered, Extension.InvalidEventType) are unverified recall; the AWS docs list only the status codes. SHUTDOWN waits until each extension took the event (up to 2s), not until the process exits.
  • GET /_aws/lambda/runtimes returns {"Runtimes": [...]}; LocalStack's docs name the endpoint and filter=deprecated|all but do not document the response shape, so the shape is unverified. LOCALSTACK_INIT_LOG_LEVEL and LOCALSTACK_USER are not applicable (no LocalStack init binary); pass them through LAMBDA_DOCKER_FLAGS -e if an image needs them.
  • --lambda-isolation=firecracker is rejected at startup: no firecracker binary is installed on the build host, so no microVM runner exists. Design: export the function image with docker export into an ext4 rootfs, boot it under firecracker with a configured kernel image (--lambda-firecracker-kernel), and reach the Runtime API over vsock (or a TAP device) instead of the docker bridge. Needs /dev/kvm access and a firecracker binary to build and test (gopherstack-cefu7.7).

Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • Stream ESM ParallelizationFactor/TumblingWindowInSeconds: records are hashed by partition key (Kinesis) or item key (DynamoDB) onto N ordered lanes, drained concurrently; a retrying lane pauses reads for the whole shard, tumbling state is kept per lane, and windows close on the clock only once the shard is caught up (Kinesis's up-to-2-minute idle wait is not modeled).
  • ESM SchemaRegistryErrorCount and EventPollerUnit metrics: no Glue/Confluent schema-registry integration or poller-unit billing model exist to measure (ProvisionedPollers is emitted for SQS mappings with ProvisionedPollerConfig).
  • Kafka ESM LoggingConfig DEBUG offsets are logged on every commit, not once a minute, and omit endOffset; INFO/WARN omit securityProtocol, saslMechanism, networkConfig, assignedPartitions (no VPC/auth/rebalance model).
  • Invoke TenantId is validated (required for PER_TENANT, rejected otherwise) but does not route to a tenant-dedicated execution environment: one environment pool per function.
  • Kafka ESM: MSK sources are polled only when services/kafka runs a real broker (--kafka-engine=docker); metadata-only MSK clusters stay unpolled with a warning, and MSK auth settings (IAM/SCRAM/TLS) are ignored (gopherstack-ce985).
  • MQ ESM: Amazon MQ sources are polled only when services/mq runs a real broker (--mq-engine=docker); metadata-only brokers stay unpolled with a warning. ActiveMQ is consumed over STOMP (AWS uses OpenWire/JMS), so brokerInTime is the message timestamp and messageType is inferred from STOMP content-length; one queue per mapping (Queues[0]); no TLS; the BASIC_AUTH secret must be JSON with username/password keys (the Lambda guide does not show its layout) and is read from services/secretsmanager in the secret ARN's region.
  • Kafka ESM (self-managed): SourceAccessConfigurations (SASL/SCRAM, mTLS, TLS root CA, VPC) are ignored -- only plaintext brokers are reachable -- and per-partition concurrency is not modeled (gopherstack-ce985).
  • ESM SQS concurrency: with ScalingConfig.MaximumConcurrency (2..1000) or ProvisionedPollerConfig the mapping runs concurrent batch workers (cap = MaximumConcurrency, or pollers x 10 within Min..Max, doubling/halving with backlog). Without either, a mapping still processes one batch per tick, whereas AWS starts at 5 concurrent batches and scales up. Kafka/MSK ProvisionedPollerConfig and EventPollerUnit are stored only; the emulator's Kafka worker is one consumer per mapping.
  • UpdateFunctionCode SourceKMSKeyArn is stored and echoed only: no deployment-package encryption exists to apply the key to. Function KMSKeyArn encryption of environment variables is real (see the 2026-10-25 note); KMS Decrypt grants/key policies are not consulted (the emulated KMS has no principal for Lambda), so KMSAccessDeniedException arises only for a non-encrypt/decrypt key or a ciphertext/encryption-context mismatch.
  • FileSystemConfigs: mount-target subnet/AZ and security-group NFS reachability are checked only as VPC membership. EFSIO/EFSMount* exceptions are never raised. Deleting an access point a function references is allowed, as no EFS error documents otherwise. The access point PosixUser is applied by running the whole function process as that uid:gid (+ supplementary gids), not per-file NFS identity squashing, and RootDirectory CreationInfo ownership is chowned only when the emulator itself runs privileged (permissions are always applied).
  • Capacity providers (Lambda Managed Instances): execution environments are logical slots over the function's single local container, not separate containers or EC2 instances. Invocations are admitted per environment (PerExecutionEnvironmentMaxConcurrency; unset defaults per vCPU follow the runtime guides: nodejs 64, java/dotnet 32, python 16; runtimes with no documented default, e.g. provided/go/ruby, are uncapped per environment), environments scale out to FunctionScalingConfig max and the provider MaxVCpuCount (default 400), min defaults to 3; ScalingMode/ScalingPolicies, InstanceRequirements, VpcConfig and throttle-reason metrics (CPUThrottles/MemoryThrottles) are accepted and echoed but do not influence routing, and exhausted capacity is a synchronous 429 where AWS scales out asynchronously.

More