Account Concurrency Limit: 1,000 (default, adjustable via quota increase)
  ├── Function A (Reserved Concurrency: 200) ← isolated slice
  ├── Function B (Reserved Concurrency: 50)  ← isolated slice
  └── Unreserved Pool: 750                   ← shared by all other functions

// ❌ Mid-level: no Reserved Concurrency on any function
// What happens during a batch job at 3am:
// BatchETL function spins up 900 concurrent executions (large SQS batch)
// → Unreserved pool: 1000 - 0 reserved = 1000 available
// → BatchETL consumes 900 → only 100 remaining in the pool
// → PaymentProcessor API gets traffic spike → needs 150 concurrent executions
// → 50 invocations receive 429 ThrottleException
// → API Gateway returns 502 to clients
// → Payment failures — not because PaymentProcessor is broken

// ✅ Senior: Reserved Concurrency isolates critical paths
// After setting Reserved Concurrency:
// PaymentProcessor:    Reserved = 200 (guaranteed, isolated from ALL other functions)
// BatchETL:            Reserved = 100 (caps its own blast radius at 100)
// Unreserved pool:     700 (for everything else)
// Now: BatchETL can never consume more than 100, PaymentProcessor always has 200

// ❌ Misconfiguration: Reserved Concurrency set too low on a scaling function
// A function processing real-time video transcoding:
// Reserved: 10 (engineer thought "10 concurrent jobs is plenty")
// Traffic spike: 200 simultaneous transcoding requests arrive
// → Only 10 can run concurrently — the other 190 get throttled
// → SQS queue backs up, visibility timeouts expire, messages redeliver
// → Cascade: DLQ fills up, operational alarm fires at 2am

// Reserve = guarantee + cap. Set it to the MAXIMUM you want, not the expected baseline.

Minute 0: 3,000 burst quota initialized
Minute 1: +500 → 3,500
Minute 2: +500 → 4,000
Minute 3: +500 → 4,500
Minute 4: +500 → 5,000 (reached target)

// SQS ESM configuration (CDK)
import { SqsEventSource } from 'aws-cdk-lib/aws-lambda-event-sources'
import { Queue } from 'aws-cdk-lib/aws-sqs'

const dlq = new Queue(this, 'ProcessorDLQ', {
  retentionPeriod: Duration.days(14)
})

const queue = new Queue(this, 'OrderQueue', {
  visibilityTimeout: Duration.seconds(300), // Must be >= 6× Lambda timeout
  deadLetterQueue: { queue: dlq, maxReceiveCount: 3 }
})

orderProcessorFn.addEventSource(new SqsEventSource(queue, {
  batchSize: 10,                 // Records per invocation (1–10,000)
  maxBatchingWindow: Duration.seconds(5), // Wait up to 5s to fill batch
  reportBatchItemFailures: true  // Enable partial batch success response
}))

export const handler = async (
  event: AWSLambda.SQSEvent
): Promise<AWSLambda.SQSBatchResponse> => {
  const failures: AWSLambda.SQSBatchItemFailure[] = []

  await Promise.allSettled(
    event.Records.map(async (record) => {
      try {
        const order = JSON.parse(record.body)
        await processOrder(order)
      } catch (err) {
        console.error({ messageId: record.messageId, error: (err as Error).message })
        failures.push({ itemIdentifier: record.messageId })
      }
    })
  )

  // SQS will redeliver only the failed records; successful records are deleted
  return { batchItemFailures: failures }
}

Kinesis Stream with 4 shards (no parallelization):
  Shard 0 → Lambda Instance A  (max 1 concurrent)
  Shard 1 → Lambda Instance B  (max 1 concurrent)
  Shard 2 → Lambda Instance C  (max 1 concurrent)
  Shard 3 → Lambda Instance D  (max 1 concurrent)
  Max concurrent Lambda executions: 4 (bounded by shard count)

At 10,000 records/second across those 4 shards:
  Each Lambda instance processes records sequentially within its shard.
  Adding more records does NOT add more concurrency.
  The only way to increase concurrency: add shards OR increase parallelization factor.

import { KinesisEventSource } from 'aws-cdk-lib/aws-lambda-event-sources'
import { Stream } from 'aws-cdk-lib/aws-kinesis'

processorFn.addEventSource(new KinesisEventSource(stream, {
  batchSize: 100,
  startingPosition: StartingPosition.TRIM_HORIZON,
  parallelizationFactor: 5,     // 5 Lambda instances per shard
  bisectBatchOnFunctionError: true,
  maxRecordAge: Duration.hours(1),
  retryAttempts: 3,
  onFailure: new SqsDestination(dlq)
}))
// With 4 shards × 5 parallelization = 20 max concurrent Lambda instances

Kinesis shard contains: [record 1] [record 2] [MALFORMED record 3] [record 4] [record 5]

Batch attempt 1: Lambda processes [records 1–5] → fails on record 3 → entire batch retried
Batch attempt 2: Lambda processes [records 1–5] → fails on record 3 → entire batch retried
Batch attempt 3: Lambda processes [records 1–5] → fails on record 3 → entire batch retried
...until maxRetryAttempts or maxRecordAge reached

Result without explicit config:
  - maxRetryAttempts default: unlimited retries
  - maxRecordAge default: Kinesis retention (up to 7 days)
  - Shard iterator: BLOCKED — no records beyond record 3 are processed
  - Impact: all events after the malformed record age out unprocessed

// ✅ Complete Kinesis ESM error handling configuration
processorFn.addEventSource(new KinesisEventSource(stream, {
  batchSize: 100,
  startingPosition: StartingPosition.LATEST,

  // CRITICAL: Bisect narrows down the poison pill to a batch of 1
  bisectBatchOnFunctionError: true,
  // How it works: batch of 100 fails → splits into [50] and [50]
  //               failing half retried → splits again → [25] [25]
  //               continues until the single failing record is isolated
  //               isolated record → sent to DLQ → shard continues

  maximumRetryAttempts: 3,               // Don't retry forever
  maximumRecordAgeInSeconds: 3600,       // Drop records older than 1 hour
  onFailure: new SqsDestination(dlq),    // Capture exhausted records for inspection

  reportBatchItemFailures: true          // Only retry individual failed records when supported
}))

# ✅ Container image: use only when zip's 250MB limit is genuinely exhausted
# (e.g., ML inference with model weights embedded, native binaries)
FROM public.ecr.aws/lambda/nodejs20.x:latest

# Copy pre-built artifacts only — don't run npm install in Docker for Lambda
COPY dist/handler.js ${LAMBDA_TASK_ROOT}/
COPY node_modules ${LAMBDA_TASK_ROOT}/node_modules/

CMD ["handler.handler"]

// Example: AWS Lambda Powertools as an internal extension pattern (Node.js)
// Powertools wraps the handler — no external process needed
import { Logger } from '@aws-lambda-powertools/logger'
import { Tracer } from '@aws-lambda-powertools/tracer'

const logger = new Logger({ serviceName: 'order-service' })
const tracer = new Tracer({ serviceName: 'order-service' })

// captureLambdaHandler wraps the handler internally — no separate extension process
export const handler = tracer.captureLambdaHandler(
  async (event: AWSLambda.APIGatewayProxyEvent, context: AWSLambda.Context) => {
    logger.addContext(context)
    logger.info('Processing request', { path: event.path })
    // ...
  }
)

// ✅ Secret caching via Lambda Extension — no direct Secrets Manager API calls
// The extension handles caching with configurable TTL (default: 300s)
async function getSecret(secretId: string): Promise<string> {
  const port = process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT ?? '2773'
  const token = process.env.AWS_SESSION_TOKEN!

  const response = await fetch(
    `http://localhost:${port}/secretsmanager/get?secretId=${encodeURIComponent(secretId)}`,
    { headers: { 'X-Aws-Parameters-Secrets-Token': token } }
  )
  const data = await response.json() as { SecretString: string }
  return data.SecretString
}
// Cache TTL controlled by PARAMETERS_SECRETS_EXTENSION_CACHE_SIZE and
// PARAMETERS_SECRETS_EXTENSION_MAX_CONNECTIONS environment variables

// CDK: per-function Reserved Concurrency with Auto Scaling
import { Function } from 'aws-cdk-lib/aws-lambda'

const paymentFn = new Function(this, 'PaymentProcessor', {
  // ... function config
  reservedConcurrentExecutions: 200, // Guaranteed + capped at 200
})

// For functions with unpredictable traffic, use Application Auto Scaling
// to adjust Provisioned Concurrency dynamically
const target = paymentFn.addAutoScaling({ minCapacity: 5, maxCapacity: 50 })
target.scaleOnUtilization({ utilizationTarget: 0.75 })
// This scales Provisioned Concurrency between 5 and 50 based on utilization
// Reserved Concurrency remains at 200 (the hard ceiling)