New serverless pattern - lambda-durable-bedrock-cdk by NithinChandranR-AWS · Pull Request #3053 · aws-samples/serverless-patterns

NithinChandranR-AWS · 2026-04-17T08:54:38Z

New Serverless Pattern: Lambda Durable Functions with Amazon Bedrock

Description

Deploys a Lambda durable function that orchestrates a multi-step AI content pipeline using Amazon Bedrock (Claude). Each step is automatically checkpointed — if the function is interrupted, it resumes from the last completed step without re-invoking Bedrock.

Architecture

Invoke → Lambda Durable Function → Bedrock (Claude)
Step 1: Generate Outline ✓ checkpoint
Wait: 5s (simulate review) ✓ checkpoint
Step 2: Expand Draft ✓ checkpoint
Step 3: Summarize ✓ checkpoint

Key Features

Uses @aws/durable-execution-sdk-js with automatic checkpointing
DurableExecution: { Enabled: true } via CfnFunction escape hatch
3 Bedrock invocations + 1 wait operation, all checkpointed
Eliminates need for Step Functions in tightly-coupled AI workflows

Framework / Language

AWS CDK (TypeScript)
Lambda runtime: Node.js 20.x

Testing

Includes CLI invoke commands and durable execution status check
CDK synth verified (9 CloudFormation resources)

- Fix Bedrock model ID default (add -v1:0 suffix for inference profile) - Fix DurableExecution → DurableConfig with ExecutionTimeout - Override runtime to nodejs24.x (required for durable functions) - Remove logRetention to avoid circular dependency with CfnVersion - Use wildcard resource for durable execution IAM permissions Tested: CDK synth verified, deployed to AWS account

biswanathmukherjee · 2026-04-21T04:43:41Z

+    fn.addToRolePolicy(
+      new iam.PolicyStatement({
+        actions: ["bedrock:InvokeModel"],
+        resources: ["*"],


This is too permissive. Can you make it as restrictive as possible to support this use case? Please try out different variation and use what is feasible.

For example,

new iam.PolicyStatement({ actions: ["bedrock:InvokeModel"], resources: [ `arn:aws:bedrock:${this.region}:${this.account}:inference-profile/${modelId.valueAsString}`, `arn:aws:bedrock:*::foundation-model/*`, ], }) );```

Scoped it down to the specific inference profile ARN and foundation-model/*. The double colon (empty account) is needed because cross-region inference profiles resolve to foundation models in service-owned accounts. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T04:45:29Z

+          "lambda:CheckpointDurableExecution",
+          "lambda:GetDurableExecutionState",
+        ],
+        resources: ["*"],


This is too permissive. Can you make it as restrictive as possible to support this use case? Please try out different variation and use what is feasible.

For example:

new iam.PolicyStatement({ actions: [ "lambda:CheckpointDurableExecution", "lambda:GetDurableExecutionState", ], resources: [fn.functionArn, `${fn.functionArn}:*`], }) );```

Replaced the inline policy with the AWSLambdaBasicDurableExecutionRolePolicy managed policy, which covers both lambda:CheckpointDurableExecution and lambda:GetDurableExecutionState. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T04:52:15Z

+
+    // Durable execution permissions (wildcard to avoid circular dep)
+    fn.addToRolePolicy(
+      new iam.PolicyStatement({


Instead of adding in-line policy to the the role, can you try with AWS Managed policy AWSLambdaBasicDurableExecutionRolePolicy.

Policy definition: https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambdaBasicDurableExecutionRolePolicy.html

Example of how to use this policy: https://docs.aws.amazon.com/lambda/latest/dg/durable-getting-started-iac.html

Done — switched to AWSLambdaBasicDurableExecutionRolePolicy managed policy via fn.role.addManagedPolicy(). This also covers CloudWatch Logs, complementing the default AWSLambdaBasicExecutionRole. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T04:57:00Z

+
+## Testing
+
+1. Invoke the durable function (use the published version from the output):


Please be specific that user needs to replace <FunctionName> with the value from deploy output.

Updated — testing instructions now explicitly say to replace and with the values from deploy output, with a concrete example. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T04:57:12Z

+      output.json
+    ```
+
+2. Since the function includes a wait, the initial invocation returns quickly. Check the durable execution status:


Please be specific that user needs to replace <FunctionName> with the value from deploy output.

Same fix as above — both invoke and status-check commands now reference the deploy output values with examples. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T04:59:39Z

@@ -0,0 +1,61 @@
+{
+  "title": "Lambda Durable Functions with Amazon Bedrock",
+  "description": "Use AWS Lambda durable functions to orchestrate a multi-step AI content pipeline with Amazon Bedrock, featuring automatic checkpointing and failure recovery.",


The description needs to be 150 char or less.

Trimmed to 128 characters. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T05:01:25Z

@@ -0,0 +1,61 @@
+{
+  "title": "Lambda Durable Functions with Amazon Bedrock",


AWS Lambda durable functions with Amazon Bedrock

Updated to match. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T05:02:27Z

@@ -0,0 +1,97 @@
+# Lambda Durable Functions with Amazon Bedrock


AWS Lambda durable functions with Amazon Bedrock

Updated to match. Fixed in 7a68a28.

biswanathmukherjee · 2026-04-21T05:57:28Z

+      --cli-binary-format raw-in-base64-out \
+      output.json
+    ```
+


I tried this:

aws lambda invoke \ --function-name LambdaDurableBedrockStack-DurableBedrockFn3CE0D50D-FF9phCg6tiT9 \ --qualifier 1 \ --payload '{"topic": "Serverless AI workflows with Lambda durable functions"}' \ --cli-binary-format raw-in-base64-out \ output.json

got this error:

aws: [ERROR]: An error occurred (ResourceNotFoundException) when calling the Invoke operation: Function not found: arn:aws:lambda:us-east-1:123456789012:function:LambdaDurableBedrockStack-DurableBedrockFn3CE0D50D-FF9phCg6tiT9:1 Additional error details: Type: User

Then I tried this:

aws lambda invoke \ --function-name arn:aws:cloudformation:us-east-1:123456789012:stack/LambdaDurableBedrockStack/703aed20-3d3f-11f1-8f52-0affe2f2e12f \ --qualifier 1 \ --payload '{"topic": "Serverless AI workflows with Lambda durable functions"}' \ --cli-binary-format raw-in-base64-out \ output.json

Got this error:

aws: [ERROR]: An error occurred (ValidationException) when calling the Invoke operation: 1 validation error detected: Value 'arn:aws:cloudformation:us-east-1:123456789012:stack/LambdaDurableBedrockStack/703aed20-3d3f-11f1-8f52-0affe2f2e12f' at 'functionName' failed to satisfy constraint: Member must satisfy regular expression pattern: (arn:(aws[a-zA-Z-]*)?:lambda:)?((eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_\.]+)(:(\$LATEST(\.PUBLISHED)?|[a-zA-Z0-9-_]+))? zsh: command not found: --qualifier

Please provide clearer instruction for testing.

Fixed -- the stack now publishes a Lambda version (CfnVersion) and exports FunctionVersion in outputs. README rewritten with explicit instructions to use FunctionName and FunctionVersion from cdk deploy output. Fixed in 7a68a28.

- Scope Bedrock InvokeModel to inference-profile and foundation-model ARNs instead of wildcard - Replace inline durable execution policy with AWSLambdaBasicDurableExecutionRolePolicy managed policy - Publish a Lambda version via CfnVersion for qualified invocation - Add FunctionVersion output for testing instructions - Fix README title, clarify testing with explicit placeholder replacement - Trim example-pattern.json description to 128 chars

NithinChandranR-AWS · 2026-04-21T07:03:34Z

Hello Bishwajit,

Thank you for taking time and reviewing. Appreciate it.

I've updated each of the comments. Please help review this.

NithinChandranR-AWS · 2026-04-24T03:36:55Z

Hi @biswanathmukherjee — just a gentle follow-up. I've addressed all 9 review comments in commit 7a68a28:

Scoped Bedrock IAM to specific inference profile ARN + foundation-model/*
Replaced inline durable execution policy with AWSLambdaBasicDurableExecutionRolePolicy managed policy
Trimmed example-pattern.json description to 128 chars
Rewrote testing instructions with explicit output references and CfnVersion

Would you be able to take another look when you get a chance? Thank you!

Replace inline durable execution policy (wildcard resources) with the AWS managed policy for least-privilege IAM, matching the approach recommended in PR aws-samples#3053 review feedback.

New serverless pattern - lambda-durable-bedrock-cdk

e997591

julianwood assigned biswanathmukherjee and julianwood Apr 17, 2026

NithinChandranR-AWS mentioned this pull request Apr 17, 2026

New pattern submission #3057

Open

biswanathmukherjee requested changes Apr 21, 2026

View reviewed changes

NithinChandranR-AWS requested a review from biswanathmukherjee April 23, 2026 17:02

NithinChandranR-AWS mentioned this pull request Apr 24, 2026

feat(typescript): add 3 Bedrock CDK examples (durable, streaming, S3 Vectors) aws-samples/aws-cdk-examples#1266

Open


		## Testing

		1. Invoke the durable function (use the published version from the output):

		@@ -0,0 +1,61 @@
		{
		"title": "Lambda Durable Functions with Amazon Bedrock",

		@@ -0,0 +1,97 @@
		# Lambda Durable Functions with Amazon Bedrock

Conversation

NithinChandranR-AWS commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New Serverless Pattern: Lambda Durable Functions with Amazon Bedrock

Description

Architecture

Key Features

Framework / Language

Testing

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NithinChandranR-AWS commented Apr 21, 2026

Uh oh!

NithinChandranR-AWS commented Apr 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

NithinChandranR-AWS commented Apr 17, 2026 •

edited

Loading