Introducing AWS Lambda Web Functions: Serverless HTTP Apps Made Simple

A Lambda Web Function is a distinct form factor that runs a standard HTTP server inside an AWS Lambda execution environment. Unlike traditional Lambda event functions, the code does not need an event‑handler wrapper; it simply listens on a port and processes HTTP requests directly, allowing developers to deploy existing Node.js frameworks (Express, Fastify, Next.js, etc.) with a single CLI command.

• HTTP‑native programming model: the function receives raw HTTP traffic, enabling familiar routing, middleware, and server‑side rendering patterns.
• Multi‑concurrent execution: each environment can handle up to 128 concurrent requests, sharing a warm sandbox instead of spawning a new instance per request.
• Active CPU billing: only the CPU time spent executing code is billed; idle time while awaiting I/O (e.g., database queries) incurs minimal cost. Memory is metered for the lifetime of the environment.
• Firecracker isolation: the same lightweight MicroVM technology underpins Web Functions, Event Functions, and Lambda MicroVMs, ensuring consistent security and performance isolation.

Typical usage mirrors a local development workflow. The following Express example runs unchanged in Lambda Web Functions, requiring only the AWS_LAMBDA_HTTP_ENDPOINT environment variable to bind the server:

import express from 'express';
const app = express();
const [host, port] = process.env.AWS_LAMBDA_HTTP_ENDPOINT.split(':');

app.get('/', (req, res) => {
  res.json({ message: 'Hello from Lambda Web Functions!' });
});

app.listen(port, host, () => {
  console.log(`Server running on ${host}:${port}`);
});

Contrast with the other Lambda form factors:

• Event Functions: single‑concurrent handler invoked by events (S3, SQS, etc.) with wall‑clock billing; suited for asynchronous processing.
• Web Functions: multi‑concurrent HTTP server with active CPU billing; ideal for user‑facing APIs, server‑side rendering, and I/O‑heavy workloads.
• MicroVMs: stateful, customer‑managed sandbox environments for executing untrusted or user‑generated code; provide persistent isolation beyond the stateless Lambda model.

Because a Web Function can serve many requests from a single warm environment, burst traffic benefits from reduced cold‑start latency and lower compute spend. The model also integrates seamlessly with Amazon CloudFront for static‑asset caching, enabling a unified global URL that routes requests to the lowest‑latency region while preserving the serverless compute advantages.

When a Lambda Web Function is deployed with the --regions flag, the service copies the immutable revision of the application code to every region listed. The deployment process creates a separate execution environment in each region, but all environments share a single logical endpoint. Internally, AWS configures an Amazon Route 53 latency‑based routing policy that maps the global DNS name (<domain-id>.lambda-web.global.on.aws) to the region that offers the lowest network latency for the caller, on a best‑effort basis.

Because the routing policy is managed by the Lambda Web Functions platform, engineers do not need to provision Route 53 records, health checks, or fail‑over logic. The global URL remains constant regardless of how many regions are added or removed, simplifying client configuration and DNS caching.

• Code replication: A single aws lambda-web deploy command with --regions us-east-1,eu-west-1,ap-northeast-1 creates identical revisions in North America, Europe, and Asia‑Pacific.
• Automatic latency routing: Route 53 evaluates the client’s source IP and selects the nearest region; the DNS response points to the regional endpoint without additional latency‑routing tables.
• Single global endpoint: All users access <domain-id>.lambda-web.global.on.aws, eliminating the need for region‑specific URLs or client‑side logic.
• Zero‑touch updates: Subsequent deployments replace the revision in each region and the routing policy automatically directs new traffic to the updated code.

Typical workflow for a globally distributed web service:

# Deploy to three regions with one command
aws lambda-web deploy \
  --name my-web-app \
  --code ./my-app \
  --regions us-east-1,eu-west-1,ap-northeast-1

After the command completes, the CLI returns the global URL. A client request such as:

curl https://<domain-id>.lambda-web.global.on.aws/

is resolved by Route 53 to the region with the lowest round‑trip time, and the request is processed by the warm Lambda environment in that region. This model provides consistent latency for a worldwide audience while preserving the simplicity of a single DNS name and eliminating manual multi‑region orchestration.

In an I/O‑heavy workload the dominant cost driver is often the time a request spends waiting for external services (databases, third‑party APIs, or model inference back‑ends). An execution environment that can host multiple concurrent requests and bills only for active CPU cycles therefore reduces the amount of compute that must be purchased.

Lambda Web Functions provide a single environment that can serve up to 128 concurrent HTTP requests. While the environment is warm, each request shares the same memory allocation and the same underlying Firecracker micro‑VM, eliminating the need to spin up a new container for every invocation. CPU usage is measured as active time: when the code is blocked on I/O, the CPU meter is idle, so the bill reflects only the cycles actually consumed. Memory, however, is billed for the full lifetime of the environment, regardless of request volume, which makes it predictable for long‑running services.

• Server‑side rendering (SSR): an Express or Next.js server can be deployed unchanged. Rendering HTML often waits on database reads; the CPU meter records minimal usage while the DB query runs, lowering the per‑render cost compared to a model that charges wall‑clock time.
• API back‑ends: high‑throughput REST endpoints that aggregate data from multiple services benefit from the shared environment. A burst of 200 calls can be handled by a few warm environments, each processing many requests concurrently, instead of provisioning separate instances for each call.
• AI inference streaming: token‑by‑token generation streams results while the model waits for GPU or external inference services. Because the CPU is idle during each wait, the active‑CPU billing model keeps the cost proportional to the actual compute performed on the model, not the total wall‑clock latency of the stream.

Practically, a developer can take an existing Node.js server, set the AWS_LAMBDA_HTTP_ENDPOINT environment variable, and deploy with a single CLI command. The same code runs locally and in the cloud, and the platform automatically distributes the function across regions, applying latency‑based routing without additional configuration. By consolidating many I/O‑bound requests into a few long‑lived, multi‑concurrent environments, organizations achieve predictable memory costs and lower CPU spend, directly translating into reduced compute expenses for SSR, API services, and streaming AI inference workloads.

When a Lambda Web Function is deployed, AWS automatically provisions an HTTPS endpoint that can be used as a CloudFront origin. The origin behaves like any other HTTP endpoint: CloudFront forwards requests, receives the response, and caches static assets according to the distribution’s cache‑behavior rules. Because the endpoint is managed by Lambda, you do not need to configure a separate load balancer or API‑Gateway proxy.

Private‑origin with Origin Access Control (OAC)

• Attach an OAC to the Web Function endpoint in the CloudFront console or via the CLI.
• CloudFront signs each request with a short‑lived token; the endpoint validates the signature and rejects any request that does not originate from the configured distribution.
• This pattern mirrors the S3 private‑origin workflow, eliminating the need for custom authentication logic in the application code.

Example CLI sequence to enable the private‑origin pattern:

aws cloudfront create-distribution \
  --origin-domain-name my-web-app.lambda-web.us-east-1.on.aws \
  --origin-access-control-id OAC12345678

After the OAC is attached, the Web Function will only respond to requests that include a valid CloudFront signature, effectively shielding the endpoint from direct internet access.

VPC connectivity

• Lambda Web Functions support VPC attachment, allowing the function to resolve private IP addresses and open TCP connections to resources such as RDS databases, ElastiCache clusters, or internal services.
• When a VPC is specified, Lambda creates ENIs in the selected subnets and applies the security groups you provide.
• Because the function still runs on Firecracker microVMs, the isolation model remains unchanged; only network reachability is extended.

Practical VPC example:

aws lambda-web deploy \
  --name my-web-app \
  --code ./my-app \
  --vpc-config SubnetIds=subnet-abc123,subnet-def456 SecurityGroupIds=sg-0123abcd

With this configuration, a CloudFront distribution can route dynamic API calls to the Web Function while static assets are cached at edge locations. The function can query a private Aurora database or invoke a service in a private subnet without exposing those resources to the public internet, satisfying compliance frameworks such as SOC 2 or ISO 27001 that require network segmentation and least‑privilege access.

AWS Lambda Web Functions expose an HTTP‑native programming model that runs a standard port‑listening server (Express, Fastify, Next.js, etc.) inside a Firecracker‑based microVM. The runtime executes multiple concurrent requests per environment and meters active CPU time, which reduces cost for I/O‑heavy workloads because idle wait time consumes little CPU.

When a Web Function is deployed, the service automatically replicates the code to the selected AWS Regions and creates a single global endpoint. Requests are routed on a best‑effort latency basis, so callers are served from the region that is geographically closest. This eliminates the need for separate CloudFront origins or custom latency‑based routing tables.

• US East (N. Virginia) – us-east-1
• US East (Ohio) – us-east-2
• US West (Oregon) – us-west-2
• Asia Pacific (Tokyo) – ap-northeast-1
• Europe (Ireland) – eu-west-1

At launch the only supported runtime is Node.js 24 (nodejs24.x) on Arm64. The Arm64 architecture provides a higher instructions‑per‑cycle ratio and lower power consumption compared with x86, which can translate into lower per‑request CPU costs when the function is active.

To create a minimal Web Function you can use the built‑in “hello‑world” template. The AWS CLI command below bundles the source, creates the function, publishes the first revision, and returns a live HTTPS URL in under a minute:

aws lambda-web deploy --name hello-world --hello-world

If you need multi‑region coverage, add the --regions flag with a comma‑separated list of the region codes shown above:

aws lambda-web deploy --name hello-world \
  --hello-world \
  --regions us-east-1,us-east-2,us-west-2,ap-northeast-1,eu-west-1

After deployment you can verify the endpoint with a simple curl request. The response will be generated by the same Node.js server code you run locally, without any Lambda‑specific adapters.

For cost estimation, consult the AWS Lambda pricing page. Detailed usage patterns, configuration options, and API references are available in the Lambda Web Functions documentation.