feat: Add Lambda Managed Instances pattern (Python, SAM/CloudFormation) by awsTest1992 · Pull Request #3253 · aws-samples/serverless-patterns

awsTest1992 · 2026-07-24T16:51:03Z

Issue #, if available:

Description of changes:

Adds a SAM/CloudFormation-based pattern for AWS Lambda Managed Instances with Python. This fills the gap where CDK and Terraform versions exist but no SAM equivalent was available.

Pattern includes:

VPC with private subnets
Lambda Capacity Provider (ARM64/Graviton4)
Capacity Provider Operator IAM role (AWSLambdaManagedEC2ResourceOperator)
Python 3.13 function with multi-concurrency (thread-safe)
Published version + alias for invocation
CloudWatch Logs with 14-day retention

Tested: Deployed and invoked successfully in us-east-1.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

- Narrow IAM wildcard: orchestrator* -> orchestrator:* - Fix casing: 'Durable Lambda Function' -> 'Lambda durable function' - Use single quotes for function-name in test commands - Fix docstring casing: 'Durable Functions' -> 'durable functions' - Add CloudWatch Logs group with 14-day retention

ellisms

Hi @awsTest1992 I started reviewing this and have 2 initial findings that need to be reviewed before I test:

It looks like the route tables are missing from the VPC/subnet definitions. Can you confirm this will still be a valid deploy? See the networking documentation: https://docs.aws.amazon.com/lambda/latest/dg/lambda-managed-instances-networking.html
A second directory, lambda-durable-saga-python-sam, is included in this PR. Was that intended?

ellisms · 2026-09-15T20:30:17Z

@@ -0,0 +1,115 @@
+# Lambda Managed Instances with SAM (Python)
+
+This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using CloudFormation. Lambda Managed Instances enables you to run functions on EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.


Suggested change

This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using CloudFormation. Lambda Managed Instances enables you to run functions on EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.

This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using AWS SAM. Lambda Managed Instances enables you to run functions on EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.

ellisms · 2026-09-15T20:31:47Z

+
+2. **Capacity Provider Operator IAM Role**: An IAM role with the `AWSLambdaManagedEC2ResourceOperator` managed policy that Lambda uses to provision and manage EC2 instances.
+
+3. **Lambda Capacity Provider**: Defines where functions run — VPC config, instance architecture (ARM64/Graviton4), and the operator role for instance management.


Suggested change

3. **Lambda Capacity Provider**: Defines where functions run — VPC config, instance architecture (ARM64/Graviton4), and the operator role for instance management.

3. **Lambda Capacity Provider**: Defines where functions run — VPC config, instance architecture (arm64 / AWS Graviton), and the operator role for instance management.

@ellisms

Address @ellisms review on PR aws-samples#3253: - Add private route table + subnet associations so the private subnets have an explicit table (was missing, using only the VPC main table) - Add PrivateLink egress with no internet route: interface endpoints for CloudWatch Logs, ECR (api + dkr), and EC2, plus an S3 gateway endpoint, so Managed Instances can send logs and pull the runtime image privately - Remove the accidental lambda-durable-saga-python-sam directory - Remove src/ and keep the inline ZipFile as the single source of truth - README: 'using CloudFormation' -> 'using AWS SAM'; 'ARM64/Graviton4' -> 'arm64 / AWS Graviton'; document the private networking Verified: sam validate --lint and cfn-lint pass clean; deployed to a test account, confirmed private route table + endpoints, successful invoke on managed instances, and log delivery via the private logs endpoint; stack deleted after testing.

awsTest1992 · 2026-09-15T22:21:19Z

Thanks for the review @ellisms! I've pushed a commit addressing all the feedback.

1. Missing route tables / networking
Fixed. The private subnets now have a dedicated PrivateRouteTable with explicit associations for both subnets. Rather than adding a NAT/internet path, I kept the pattern fully private and added PrivateLink egress:

Interface endpoints for CloudWatch Logs, ECR (ecr.api + ecr.dkr), and EC2 (private DNS enabled, both subnets)
An S3 gateway endpoint (bound to the private route table) for pulling the runtime image layers
An endpoint security group allowing 443 only from the instance SG

The route table has only the local route + the S3 prefix-list route — no 0.0.0.0/0 — so there's no internet egress, which matches the "private subnets / VPC placement control" framing of the pattern.

2. Stray lambda-durable-saga-python-sam directory
Not intended — it rode in from the base branch. Removed from this PR.

3. Inline code vs src/
Agreed. Removed the src/ directory; the inline ZipFile is now the single source of truth.

4 & 5. README wording

"using CloudFormation" → "using AWS SAM"
"ARM64/Graviton4" → "arm64 / AWS Graviton"
Also updated the "How it works" networking bullet to describe the route table + endpoints.

Verification

sam validate --lint and cfn-lint both pass clean.
Deployed end-to-end to a test account: confirmed the private route table + both associations, all 5 endpoints available, a successful invoke via the live alias, and — importantly — log delivery to CloudWatch through the private logs endpoint (initializationType: lambda-managed-instances, status success). Stack was deleted after testing.

Ready for another look when you have a chance. Thanks!

ellisms

Thanks for the updates @awsTest1992 . Requesting a few additional minor changes.

ellisms · 2026-09-16T11:32:30Z

+1. From the command line, use AWS SAM to build and deploy:
+   ```
+   sam build
+   sam deploy --guided


During testing I had to add --capabilities CAPABILITY_NAMED_IAM to sam deploy.

ellisms · 2026-09-16T12:12:26Z

+   }
+   ```
+
+3. Test multi-concurrency by invoking in parallel:


Provide a sample expected response

ellisms · 2026-09-16T12:15:09Z

@@ -0,0 +1,115 @@
+# Lambda Managed Instances with SAM (Python)


Suggested change

# Lambda Managed Instances with SAM (Python)

# AWS Lambda Managed Instances with AWS SAM (Python)

ellisms · 2026-09-16T12:15:29Z

@@ -0,0 +1,115 @@
+# Lambda Managed Instances with SAM (Python)
+
+This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using AWS SAM. Lambda Managed Instances enables you to run functions on EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.


Suggested change

This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using AWS SAM. Lambda Managed Instances enables you to run functions on EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.

This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using AWS SAM. Lambda Managed Instances enables you to run functions on Amazon EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.

ellisms · 2026-09-16T12:16:05Z

+
+This pattern creates:
+
+1. **VPC with private subnets**: Two private subnets across availability zones for the capacity provider. The subnets use a dedicated private route table with no internet route (no NAT, no internet gateway). Egress to AWS services stays inside the VPC via PrivateLink: interface endpoints for CloudWatch Logs, Amazon ECR (`ecr.api` and `ecr.dkr`), and Amazon EC2, plus an S3 gateway endpoint for pulling the runtime image layers.


Suggested change

1. **VPC with private subnets**: Two private subnets across availability zones for the capacity provider. The subnets use a dedicated private route table with no internet route (no NAT, no internet gateway). Egress to AWS services stays inside the VPC via PrivateLink: interface endpoints for CloudWatch Logs, Amazon ECR (`ecr.api` and `ecr.dkr`), and Amazon EC2, plus an S3 gateway endpoint for pulling the runtime image layers.

1. **VPC with private subnets**: Two private subnets across availability zones for the capacity provider. The subnets use a dedicated private route table with no internet route (no NAT, no internet gateway). Egress to AWS services stays inside the VPC via PrivateLink: interface endpoints for Amazon CloudWatch Logs, Amazon ECR (`ecr.api` and `ecr.dkr`), and Amazon EC2, plus an Amazon S3 gateway endpoint for pulling the runtime image layers.

ellisms · 2026-09-16T12:16:46Z

+
+1. **VPC with private subnets**: Two private subnets across availability zones for the capacity provider. The subnets use a dedicated private route table with no internet route (no NAT, no internet gateway). Egress to AWS services stays inside the VPC via PrivateLink: interface endpoints for CloudWatch Logs, Amazon ECR (`ecr.api` and `ecr.dkr`), and Amazon EC2, plus an S3 gateway endpoint for pulling the runtime image layers.
+
+2. **Capacity Provider Operator IAM Role**: An IAM role with the `AWSLambdaManagedEC2ResourceOperator` managed policy that Lambda uses to provision and manage EC2 instances.


Suggested change

2. **Capacity Provider Operator IAM Role**: An IAM role with the `AWSLambdaManagedEC2ResourceOperator` managed policy that Lambda uses to provision and manage EC2 instances.

2. **Capacity Provider Operator IAM Role**: An Amazon IAM role with the `AWSLambdaManagedEC2ResourceOperator` managed policy that Lambda uses to provision and manage EC2 instances.

Apply maintainer-requested wording and instruction fixes for the lambda-managed-instances-python-sam pattern: - Retitle to 'AWS Lambda Managed Instances with AWS SAM (Python)' - Use full service names (Amazon EC2, Amazon CloudWatch Logs, Amazon S3, Amazon IAM) in the intro and How it works section - Add --capabilities CAPABILITY_NAMED_IAM to sam deploy (the template creates a named IAM role for the capacity provider operator) - Replace the placeholder timestamp with a concrete sample response

awsTest1992 added 3 commits June 24, 2026 12:20

feat: Add saga pattern with Lambda durable functions (Python)

57fa931

feat: Add Lambda Managed Instances pattern (Python, SAM/CloudFormation)

6f92327

julianwood assigned ellisms and julianwood Jul 24, 2026

ellisms requested changes Sep 15, 2026

View reviewed changes

ellisms requested changes Sep 16, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat: Add Lambda Managed Instances pattern (Python, SAM/CloudFormation) - #3253

feat: Add Lambda Managed Instances pattern (Python, SAM/CloudFormation)#3253
awsTest1992 wants to merge 5 commits into
aws-samples:mainfrom
awsTest1992:lambda-managed-instances-python-sam

awsTest1992 commented Jul 24, 2026

Uh oh!

ellisms left a comment

Uh oh!

Uh oh!

Uh oh!

ellisms Sep 15, 2026

Uh oh!

ellisms Sep 15, 2026

Uh oh!

awsTest1992 commented Sep 15, 2026

Uh oh!

ellisms left a comment

Uh oh!

ellisms Sep 16, 2026

Uh oh!

ellisms Sep 16, 2026

Uh oh!

ellisms Sep 16, 2026

Uh oh!

ellisms Sep 16, 2026

Uh oh!

ellisms Sep 16, 2026

Uh oh!

ellisms Sep 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,115 @@
		# Lambda Managed Instances with SAM (Python)

		This pattern deploys a Python Lambda function running on AWS Lambda Managed Instances using CloudFormation. Lambda Managed Instances enables you to run functions on EC2 instances while AWS handles lifecycle management, patching, routing, and scaling. You benefit from EC2 pricing (Savings Plans, Reserved Instances) and multi-concurrency support.


		2. Capacity Provider Operator IAM Role: An IAM role with the `AWSLambdaManagedEC2ResourceOperator` managed policy that Lambda uses to provision and manage EC2 instances.

		3. Lambda Capacity Provider: Defines where functions run — VPC config, instance architecture (ARM64/Graviton4), and the operator role for instance management.

	# Lambda Managed Instances with SAM (Python)
	# AWS Lambda Managed Instances with AWS SAM (Python)


		This pattern creates:

		1. VPC with private subnets: Two private subnets across availability zones for the capacity provider. The subnets use a dedicated private route table with no internet route (no NAT, no internet gateway). Egress to AWS services stays inside the VPC via PrivateLink: interface endpoints for CloudWatch Logs, Amazon ECR (`ecr.api` and `ecr.dkr`), and Amazon EC2, plus an S3 gateway endpoint for pulling the runtime image layers.

Uh oh!

Conversation

awsTest1992 commented Jul 24, 2026

Uh oh!

ellisms left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

awsTest1992 commented Sep 15, 2026

Uh oh!

ellisms left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants