Read a function's configuration for the settings that decide its cost and whether it runs at all. Environment variable values are never shown or exported.
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Analyze. Nothing leaves this tab.
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
Every invocation throttled, which is how you switch a function off
{
"FunctionName": "api-handler",
"Runtime": "nodejs22.x",
"Timeout": 10,
"MemorySize": 1024,
"Architectures": ["arm64"],
"ReservedConcurrentExecutions": 0,
"TracingConfig": { "Mode": "Active" },
"DeadLetterConfig": { "TargetArn": "arn:aws:sqs:eu-west-1:111122223333:dlq" }
}Returned in full by every read-only role
{
"FunctionName": "api-handler",
"Runtime": "nodejs22.x",
"Timeout": 10,
"MemorySize": 1024,
"Architectures": ["arm64"],
"Environment": { "Variables": { "DB_PASSWORD": "hunter2" } },
"TracingConfig": { "Mode": "Active" },
"DeadLetterConfig": { "TargetArn": "arn:aws:sqs:eu-west-1:111122223333:dlq" }
}No route to S3, Secrets Manager or anything else without help
{
"FunctionName": "api-handler",
"Runtime": "nodejs22.x",
"Timeout": 10,
"MemorySize": 1024,
"Architectures": ["arm64"],
"VpcConfig": { "SubnetIds": ["subnet-a", "subnet-b"], "SecurityGroupIds": ["sg-1"] },
"TracingConfig": { "Mode": "Active" },
"DeadLetterConfig": { "TargetArn": "arn:aws:sqs:eu-west-1:111122223333:dlq" }
}These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
CPU scales with memory, so a CPU-bound function runs proportionally longer and can cost more at 128 MB than at 1024.
Instead:Measure at several settings. Billing is memory multiplied by duration, so the two often cancel out and the latency does not.
It throttles every invocation. It is how you disable a function, and it looks like a default.
Instead:Remove the setting entirely to use the shared pool.
A VPC-attached function has no route to the internet or to AWS endpoints without NAT or a VPC endpoint, and the symptom is a timeout rather than a network error.
Instead:Use private subnets with a NAT gateway, or add VPC endpoints. Gateway endpoints for S3 and DynamoDB are free.
CPU is allocated in proportion to memory, with one full vCPU at 1,769 MB. A function at 128 MB gets about a fourteenth of a core, which is why raising memory often makes a CPU-bound function cheaper rather than dearer.
Double the memory and halve the duration and the cost is identical, with half the latency. The answer is frequently not the smallest setting, and it is only findable by measuring: AWS Lambda Power Tuning runs the sweep as a state machine.
It is the documented way to disable one, and it is also what a script writes when a variable was empty. Every invocation is throttled. Removing the reservation is not the same as setting it to zero.
It guarantees this function that much and caps it there, and it removes that much from the pool every other function in the region draws on. AWS requires at least 100 to remain unreserved. It is not provisioned concurrency, which is the separate setting that keeps environments warm.
That includes the AWS APIs. Calls to S3, Secrets Manager or Lambda itself hang until the timeout, with no error mentioning networking. A public subnet does not help, because a Lambda network interface has no public address. Private subnets with NAT, or VPC endpoints, are the two answers.
With no dead letter queue and no on-failure destination, the event is gone and the only trace is a metric. A destination carries the response as well as the event, which a dead letter queue does not.
lambda:GetFunctionConfiguration returns them in full, and the console shows them without a reveal step. A secret belongs in Secrets Manager with only its name in the environment, fetched outside the handler so it is cached.