Function
Function is the Schema for the Functions API. Provides a Lambda Function resource. Lambda allows you to trigger execution of code in response to events in AWS, enabling serverless backend solutions. The Lambda Function itself includes source code and runtime configuration.
TypeMR
Providerprovider-aws-lambda
Grouplambda.aws.upbound.io
Scopecluster
Versionv1beta1

1apiVersion: lambda.aws.upbound.io/v1beta1

2kind: Function

apiVersion
string
kind
string
metadata
object
spec
object

FunctionSpec defines the desired state of Function

deletionPolicy
string
forProvider
required
object

(No description available)

architectures
array

Instruction set architecture for your Lambda function. Valid values are ["x86_64"] and ["arm64"]. Default is ["x86_64"]. Removing this attribute, function's architecture stay the same.

codeSigningConfigArn
string
deadLetterConfig
array

Configuration block. Detailed below.

targetArn
string
description
string
environment
array

Configuration block. Detailed below.

variables
object
ephemeralStorage
array

The amount of Ephemeral storage(/tmp) to allocate for the Lambda Function in MB. This parameter is used to expand the total amount of Ephemeral storage available, beyond the default amount of 512MB. Detailed below.

size
number
fileSystemConfig
array

Configuration block. Detailed below.

arn
string
arnRef
object

Reference to a AccessPoint in efs to populate arn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
arnSelector
object

Selector for a AccessPoint in efs to populate arn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
localMountPath
string
handler
string
imageConfig
array

Configuration block. Detailed below.

command
array

Parameters that you want to pass in with entry_point.

entryPoint
array

Entry point to your application, which is typically the location of the runtime executable.

workingDirectory
string
imageUri
string
kmsKeyArn
string
kmsKeyArnRef
object

Reference to a Key in kms to populate kmsKeyArn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
kmsKeyArnSelector
object

Selector for a Key in kms to populate kmsKeyArn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
layers
array

List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. See Lambda Layers

memorySize
number
packageType
string
publish
boolean
region
required
string
replaceSecurityGroupsOnDestroy
boolean
replacementSecurityGroupIdRefs
array

References to SecurityGroup in ec2 to populate replacementSecurityGroupIds.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
replacementSecurityGroupIdSelector
object

Selector for a list of SecurityGroup in ec2 to populate replacementSecurityGroupIds.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
replacementSecurityGroupIds
array

List of security group IDs to assign to orphaned Lambda function network interfaces upon destruction. replace_security_groups_on_destroy must be set to true to use this attribute.

reservedConcurrentExecutions
number
role
string
roleRef
object

Reference to a Role in iam to populate role.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
roleSelector
object

Selector for a Role in iam to populate role.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
runtime
string
s3Bucket
string
s3BucketRef
object

Reference to a Bucket in s3 to populate s3Bucket.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
s3BucketSelector
object

Selector for a Bucket in s3 to populate s3Bucket.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
s3Key
string
s3ObjectVersion
string
skipDestroy
boolean
snapStart
array

Snap start settings block. Detailed below.

applyOn
string
sourceCodeHash
string
tags
object
timeout
number
tracingConfig
array

Configuration block. Detailed below.

mode
string
vpcConfig
array

Configuration block. Detailed below.

securityGroupIdRefs
array

References to SecurityGroup in ec2 to populate securityGroupIds.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
securityGroupIdSelector
object

Selector for a list of SecurityGroup in ec2 to populate securityGroupIds.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
securityGroupIds
array

List of security group IDs associated with the Lambda function.

subnetIdRefs
array

References to Subnet in ec2 to populate subnetIds.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
subnetIdSelector
object

Selector for a list of Subnet in ec2 to populate subnetIds.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
subnetIds
array

List of subnet IDs associated with the Lambda function.

initProvider
object

THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.

architectures
array

Instruction set architecture for your Lambda function. Valid values are ["x86_64"] and ["arm64"]. Default is ["x86_64"]. Removing this attribute, function's architecture stay the same.

codeSigningConfigArn
string
deadLetterConfig
array

Configuration block. Detailed below.

targetArn
string
description
string
environment
array

Configuration block. Detailed below.

variables
object
ephemeralStorage
array

The amount of Ephemeral storage(/tmp) to allocate for the Lambda Function in MB. This parameter is used to expand the total amount of Ephemeral storage available, beyond the default amount of 512MB. Detailed below.

size
number
fileSystemConfig
array

Configuration block. Detailed below.

arn
string
arnRef
object

Reference to a AccessPoint in efs to populate arn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
arnSelector
object

Selector for a AccessPoint in efs to populate arn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
localMountPath
string
handler
string
imageConfig
array

Configuration block. Detailed below.

command
array

Parameters that you want to pass in with entry_point.

entryPoint
array

Entry point to your application, which is typically the location of the runtime executable.

workingDirectory
string
imageUri
string
kmsKeyArn
string
kmsKeyArnRef
object

Reference to a Key in kms to populate kmsKeyArn.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
kmsKeyArnSelector
object

Selector for a Key in kms to populate kmsKeyArn.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
layers
array

List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. See Lambda Layers

memorySize
number
packageType
string
publish
boolean
replaceSecurityGroupsOnDestroy
boolean
replacementSecurityGroupIdRefs
array

References to SecurityGroup in ec2 to populate replacementSecurityGroupIds.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
replacementSecurityGroupIdSelector
object

Selector for a list of SecurityGroup in ec2 to populate replacementSecurityGroupIds.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
replacementSecurityGroupIds
array

List of security group IDs to assign to orphaned Lambda function network interfaces upon destruction. replace_security_groups_on_destroy must be set to true to use this attribute.

reservedConcurrentExecutions
number
role
string
roleRef
object

Reference to a Role in iam to populate role.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
roleSelector
object

Selector for a Role in iam to populate role.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
runtime
string
s3Bucket
string
s3BucketRef
object

Reference to a Bucket in s3 to populate s3Bucket.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
s3BucketSelector
object

Selector for a Bucket in s3 to populate s3Bucket.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
s3Key
string
s3ObjectVersion
string
skipDestroy
boolean
snapStart
array

Snap start settings block. Detailed below.

applyOn
string
sourceCodeHash
string
tags
object
timeout
number
tracingConfig
array

Configuration block. Detailed below.

mode
string
vpcConfig
array

Configuration block. Detailed below.

securityGroupIdRefs
array

References to SecurityGroup in ec2 to populate securityGroupIds.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
securityGroupIdSelector
object

Selector for a list of SecurityGroup in ec2 to populate securityGroupIds.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
securityGroupIds
array

List of security group IDs associated with the Lambda function.

subnetIdRefs
array

References to Subnet in ec2 to populate subnetIds.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
subnetIdSelector
object

Selector for a list of Subnet in ec2 to populate subnetIds.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
subnetIds
array

List of subnet IDs associated with the Lambda function.

managementPolicies
array

THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md

providerConfigRef
object

ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
publishConnectionDetailsTo
object

PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.

configRef
object

SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
metadata
object

Metadata is the metadata for connection secret.

annotations
object
labels
object
type
string
name
required
string
writeConnectionSecretToRef
object

WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other.

name
required
string
namespace
required
string
status
object

FunctionStatus defines the observed state of Function.

atProvider
object

(No description available)

architectures
array

Instruction set architecture for your Lambda function. Valid values are ["x86_64"] and ["arm64"]. Default is ["x86_64"]. Removing this attribute, function's architecture stay the same.

arn
string
codeSigningConfigArn
string
deadLetterConfig
array

Configuration block. Detailed below.

targetArn
string
description
string
environment
array

Configuration block. Detailed below.

variables
object
ephemeralStorage
array

The amount of Ephemeral storage(/tmp) to allocate for the Lambda Function in MB. This parameter is used to expand the total amount of Ephemeral storage available, beyond the default amount of 512MB. Detailed below.

size
number
fileSystemConfig
array

Configuration block. Detailed below.

arn
string
localMountPath
string
handler
string
id
string
imageConfig
array

Configuration block. Detailed below.

command
array

Parameters that you want to pass in with entry_point.

entryPoint
array

Entry point to your application, which is typically the location of the runtime executable.

workingDirectory
string
imageUri
string
invokeArn
string
kmsKeyArn
string
lastModified
string
layers
array

List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. See Lambda Layers

memorySize
number
packageType
string
publish
boolean
qualifiedArn
string
qualifiedInvokeArn
string
replaceSecurityGroupsOnDestroy
boolean
replacementSecurityGroupIds
array

List of security group IDs to assign to orphaned Lambda function network interfaces upon destruction. replace_security_groups_on_destroy must be set to true to use this attribute.

reservedConcurrentExecutions
number
role
string
runtime
string
s3Bucket
string
s3Key
string
s3ObjectVersion
string
signingJobArn
string
signingProfileVersionArn
string
skipDestroy
boolean
snapStart
array

Snap start settings block. Detailed below.

applyOn
string
optimizationStatus
string
sourceCodeHash
string
sourceCodeSize
number
tags
object
tagsAll
object
timeout
number
tracingConfig
array

Configuration block. Detailed below.

mode
string
version
string
vpcConfig
array

Configuration block. Detailed below.

securityGroupIds
array

List of security group IDs associated with the Lambda function.

subnetIds
array

List of subnet IDs associated with the Lambda function.

vpcId
string
conditions
array

Conditions of the resource.

lastTransitionTime
required
string
message
string
reason
required
string
status
required
string
type
required
string
Discover the building blocks for your internal cloud platform.
© 2026 Upbound, Inc.
Solutions
Learn
Company
Community
More