View a markdown version of this page

Best practices for Lambda MicroVMs - AWS Lambda
Application designPerformanceSecurityCost optimizationMonitoring

Best practices for Lambda MicroVMs

Follow these best practices to build reliable, cost-effective, and secure applications with AWS Lambda MicroVMs.

Application design

Design your application to work well with MicroVM snapshots and lifecycle hooks:

  • Use lifecycle hooks – Implement /run for post-run initialization, /suspend for graceful cleanup, /resume for connection re-establishment, and /terminate for data flushing.

  • Handle snapshot re-use – Generate UUIDs, secrets, and random values in the /run hook, not during image build. Use CSPRNGs for all random number generation.

  • Design for resume – Validate all network connections and cached state in the /resume hook. AWS SDK connections typically recover automatically, but custom connections may not.

Performance

Optimize MicroVM performance with the following practices:

  • Right-size your MicroVM – Choose the smallest MicroVM size that meets your CPU, memory, and bandwidth requirements. Bandwidth scales with configured memory.

  • Minimize snapshot size – Keep your application footprint small to reduce run and resume times. Remove build-time dependencies and temporary files before the image snapshot is captured.

  • Use suspend/resume for latency-sensitive workloads – Keep frequently-used environments in suspended state to quickly resume execution.

Security

Follow these practices to secure your MicroVM workloads:

  • Rotate auth tokens – Generate short-lived tokens (15–30 minutes). Implement token refresh logic in your client before expiry.

  • Scope tokens to specific ports – Use the allowedPorts parameter to limit token scope to only the ports your application uses.

  • Use VPC egress for sensitive traffic – Route traffic to databases and internal APIs through a VPC egress connector rather than the public internet.

  • Apply least-privilege IAM – Separate build roles (image creation) from execution roles (runtime). Grant minimum required permissions.

Cost optimization

Reduce costs with the following strategies:

  • Configure idle policies – Set maxIdleDurationSeconds to suspend idle MicroVMs automatically. Suspended MicroVMs do not incur compute charges.

  • Set maximumDurationInSeconds – Prevent runaway costs by setting a hard termination time on every MicroVM.

  • Terminate unused MicroVMs – Do not leave MicroVMs running indefinitely. Use suspendedDurationSeconds to auto-terminate after extended idle periods.

  • Tag resources – Use tags on MicroVM images for cost allocation and reporting in AWS Cost Explorer.

  • Right-size your MicroVMs – Start with the smallest baseline that meets your performance needs. You can burst to 4x baseline during peak activity without re-provisioning.

  • Clean up unused images – Delete MicroVM image versions you no longer need to reduce storage costs.

Monitoring

Monitor your MicroVMs effectively:

  • Review stateReason – When MicroVMs terminate unexpectedly, the get-microvm response includes a stateReason with the reason for the unexpected failure.