AWS Lambda Durable Functions

AWSOfficialPublished by AWS

Skill
Tool integration
Cloud and DevOps
Apache-2.0
Low risk

From the author

Builds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic, and orchestration for long-running executions. Covers the critical replay model, step operations, wait/callback patterns, error handling with saga pattern, testing with LocalDurableTestRunner. Triggers on phrases like lambda durable functions, durable execution, workflow orchestration, state machines, retry/checkpoint patterns, long-running stateful Lambda functions, saga pattern, human-in-the-loop callbacks, reliable serverless applications, context.step, context.wait, context.invoke, context.runInChildContext, withDurableExecution, DurableContext, UnrecoverableInvocationError, durable-execution-sdk, qualified ARN invocation, and durable handler replay.

— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides guidance and patterns for implementing durable, multi-step applications on AWS Lambda. It focuses on the replay model, which allows functions to maintain state across long-running executions—up to one year—by automatically checkpointing progress. The skill covers essential architectural patterns such as the saga pattern for error handling, wait/callback mechanisms for external system integration, and testing strategies using the local test runner. It emphasizes strict adherence to deterministic coding practices required by the replay model to ensure reliable execution.

What it does

Enables state persistence for long-running Lambda functions.
Provides patterns for implementing the saga pattern and compensating transactions.
Supports wait/callback patterns for integrating with external systems.
Offers guidance on testing durable functions locally and in the cloud.
Defines rules for deterministic code to prevent state corruption during replays.
Outlines requirements for qualified ARN invocation and IAM permissions.

When to use it

When building workflows that require execution times longer than standard Lambda timeouts.
When orchestrating multi-step processes that need to maintain state across interruptions.
When implementing reliable, fault-tolerant serverless integrations.
When managing complex state machines or human-in-the-loop approval processes.
When you need automatic retry logic and checkpointing for critical business processes.

Advantages

Resilient execution that survives infrastructure interruptions.
Simplified state management without external databases for simple workflows.
Native support for complex orchestration patterns like sagas and parallel execution.
Built-in replay-aware logging and error handling.
Local testing capabilities to validate complex workflow logic.

Usage examples

“How do I implement a multi-step workflow with a wait period in AWS Lambda?”: The agent provides a code example using context.step for logic and context.wait for the delay, ensuring the execution state is persisted correctly.
“Why is my durable function failing during replay?”: The agent helps diagnose non-deterministic code (like Date.now() or Math.random()) placed outside of steps, which causes state corruption.
“How do I handle errors in a long-running durable function?”: The agent explains the saga pattern and how to implement compensating transactions within steps to roll back state if a step fails.
“What are the requirements for invoking a durable Lambda function?”: The agent clarifies that durable functions must be invoked using a qualified ARN (version, alias, or $LATEST) and provides the corresponding AWS CLI command.

Install

Download the skill as a ZIP:
https://mp-staging.autogineer.com/agent-skills/aws/aws-lambda-durable-functions/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip aws-lambda-durable-functions.zip -d .agents/skills

Documentation by AWS

AWS Lambda durable functions

Build resilient multi-step applications and AI workflows that can execute for up to 1 year while maintaining reliable progress despite interruptions.

Works best with the AWS MCP server but is not required. All AWS interactions in this skill use standard AWS CLI commands that work in any environment with configured AWS credentials.

Critical Rules

Read these before writing any code. Each one is a constraint that will silently break a function if violated.

Durable execution must be enabled at function creation time — it cannot be retrofitted. A new Lambda function must be created with durable execution turned on. Migrate the logic into the new function; do not attempt to install the SDK and wrap the handler of the existing function and expect it to work.
Durable functions must be invoked with a qualified ARN — a specific version, an alias, or the literal $LATEST suffix. An unqualified function name will fail. See the Invocation Requirements section below for examples.
Durable operations cannot be nested. You cannot call context.step(), context.wait(), or context.invoke() from inside another step's callback. Use context.runInChildContext() to group operations instead.
All non-deterministic code must run inside steps. Date.now(), Math.random(), UUID generation, API calls, and database queries outside a step will produce different values on replay and corrupt execution state.
Closure mutations are lost on replay - return values from steps
Side effects outside steps repeat - use context.logger (replay-aware)

When to Load Reference Files

Load the appropriate reference file based on what the user is working on:

Getting started, basic setup, example, ESLint, or Jest setup -> see getting-started.md
Understanding replay model, determinism, or non-deterministic errors -> see replay-model-rules.md
Creating steps, atomic operations, or retry logic -> see step-operations.md
Waiting, delays, callbacks, external systems, or polling -> see wait-operations.md
Parallel execution, map operations, batch processing, or concurrency -> see concurrent-operations.md
Error handling, retry strategies, saga pattern, or compensating transactions -> see error-handling.md
Advanced error handling, timeout handling, circuit breakers, or conditional retries -> see advanced-error-handling.md
Testing, local testing, cloud testing, test runner, or flaky tests -> see testing-patterns.md
Deployment, CloudFormation, CDK, SAM, log groups, deploy, or infrastructure -> see deployment-iac.md
Advanced patterns, GenAI agents, completion policies, step semantics, or custom serialization -> see advanced-patterns.md
troubleshooting, stuck execution, failed execution, debug execution ID, execution history, execution error, why did my execution fail, execution timed out, callback not received, diagnose execution, or root cause execution -> see troubleshooting-executions.md

Quick Reference

Basic Handler Pattern

TypeScript:

import { withDurableExecution, DurableContext } from '@aws/durable-execution-sdk-js';

export const handler = withDurableExecution(async (event, context: DurableContext) => {
  const result = await context.step('process', async () => processData(event));
  return result;
});

Python:

from aws_durable_execution_sdk_python import durable_execution, DurableContext

@durable_execution
def handler(event: dict, context: DurableContext) -> dict:
    result = context.step(lambda _: process_data(event), name='process')
    return result

Python API Differences

The Python SDK differs from TypeScript in several key areas:

Steps: Use @durable_step decorator + context.step(my_step(args)), or inline context.step(lambda _: ..., name='...'). Prefer the decorator for automatic step naming.
Wait: context.wait(duration=Duration.from_seconds(n), name='...')
Exceptions: ExecutionError (permanent), InvocationError (transient), CallbackError (callback failures)
Testing: Use DurableFunctionTestRunner class directly - instantiate with handler, use context manager, call run(input=...)

Invocation Requirements

Durable functions require qualified ARNs (version, alias, or $LATEST):

# Valid
aws lambda invoke --function-name my-function:1 output.json
aws lambda invoke --function-name my-function:live output.json

# Invalid - will fail
aws lambda invoke --function-name my-function output.json

IAM Permissions

Your Lambda execution role MUST have the AWSLambdaBasicDurableExecutionRolePolicy managed policy attached. This includes:

lambda:CheckpointDurableExecution - Persist execution state
lambda:GetDurableExecutionState - Retrieve execution state
CloudWatch Logs permissions

Additional permissions needed for:

Durable invokes: lambda:InvokeFunction on target function ARNs
External callbacks: Systems need lambda:SendDurableExecutionCallbackSuccess and lambda:SendDurableExecutionCallbackFailure

Validation Guidelines

When writing or reviewing durable function code, ALWAYS check for these replay model violations:

Non-deterministic code outside steps: Date.now(), Math.random(), UUID generation, API calls, database queries must all be inside steps
Nested durable operations in step functions: Cannot call context.step(), context.wait(), or context.invoke() inside a step function — use context.runInChildContext() instead
Closure mutations that won't persist: Variables mutated inside steps are NOT preserved across replays — return values from steps instead
Side effects outside steps that repeat on replay: Use context.logger for logging (it is replay-aware and deduplicates automatically)

When implementing or modifying tests for durable functions, ALWAYS verify:

All operations have descriptive names
Tests get operations by NAME, never by index
Replay behavior is tested with multiple invocations
Use LocalDurableTestRunner for local testing

Security Considerations

Checkpoint data encryption: Execution state is persisted automatically. Enable KMS encryption on associated CloudWatch Log Groups to protect checkpointed data at rest.
Sensitive data in step results: Step return values are checkpointed and persisted. Do not return secrets, raw credentials, or PII from steps — store sensitive data in Secrets Manager or SSM Parameter Store and return references instead.
Input validation: Validate and sanitize event payloads at the handler entry point before passing data to steps.
Credential management: Retrieve secrets from AWS Secrets Manager or SSM Parameter Store within steps.
Callback payload validation: Data received via waitForCallback originates from external systems — validate and sanitize before processing.
Logging: Avoid DEBUG log level in non-development environments as it may expose step results and execution state. Enable CloudWatch Logs encryption with KMS.

Resources

Files

ATTRIBUTION.mdAdded by AutoGineer946 B
LICENSELicence file added by AutoGineer9.9 KiB
NOTICELicence file added by AutoGineer67 B
SKILL.md8.9 KiB
references/advanced-error-handling.md4.9 KiB
references/advanced-patterns.md10.4 KiB
references/concurrent-operations.md8.4 KiB
references/deployment-iac.md14.0 KiB
references/error-handling.md10.5 KiB
references/getting-started.md12.6 KiB
references/replay-model-rules.md8.3 KiB
references/step-operations.md8.3 KiB
references/testing-patterns.md17.4 KiB
references/troubleshooting-executions.md8.5 KiB
references/wait-operations.md9.5 KiB

references/troubleshooting-executions.md

Troubleshooting Executions

PROACTIVE AGENT: When users report issues with durable function executions, spawn a specialized troubleshooting agent.

When to Spawn Troubleshooting Agent

Spawn the agent when users mention:

"My execution is stuck"
"Execution failed with ID xyz"
"Debug execution abc123"
"Troubleshoot execution"
"Why is my durable function not completing"
Provide an execution ID and need diagnosis

Agent Instructions

When spawning the troubleshooting agent, provide:

Diagnose durable function execution issue:
- Durable Execution ARN: <durable-execution-arn>
- Region: <region> (infer from ARN)

CRITICAL SAFETY RULES:
- This is READ-ONLY diagnosis
- NEVER call StopDurableExecution or any termination APIs
- NEVER modify execution state
- Only suggest manual remediation if user explicitly requests it

Steps:
0. If the user provides a function name + alias (e.g., my-function:live) instead of a full ARN:
   - Resolve the alias to a version: aws lambda get-alias --function-name <functionName> --name <alias> --region <region> --query 'FunctionVersion' --output text
   - List executions for that function: aws lambda list-durable-executions-by-function --function-name <functionName>:<version> --region <region>
   - Ask the user to identify the execution, or use the most recent one.

1. Fetch the execution history directly:
   Run: aws lambda get-durable-execution-history --durable-execution-arn <durable-execution-arn> --region <region> --include-execution-data
   Note: execution data may contain sensitive information (PII, credentials, business data). Do not display raw step results to users without reviewing content first.

2. If the command succeeds, analyze and provide a user-friendly diagnosis:
   a. Report the execution status (RUNNING/SUCCEEDED/FAILED/STOPPED/TIMED_OUT)
   b. Identify the root cause by looking for these key events in the history:

      **Execution-level failures:**
      - `ExecutionFailed` — entire execution crashed; extract the error and cause fields
      - `ExecutionTimedOut` — the execution exceeded its configured timeout
      - `ExecutionStopped` — execution was manually stopped via StopDurableExecution

      **Context and step failures:**
      - `ContextFailed` — a child context threw an unhandled error; check the parent context for what triggered it
      - `StepFailed` — an individual step failed; includes RetryDetails (CurrentAttempt, NextAttemptDelaySeconds) showing retry state

      **Callback issues:**
      - `CallbackStarted` with a Timeout field — confirms a timeout was registered; correlate with any subsequent `CallbackTimedOut`
      - `CallbackTimedOut` — a timeout fired but may not have been caught by the function code
      - `CallbackFailed` — the callback was resolved with an error

      **Chained invocation failures:**
      - `ChainedInvokeFailed` — a chained (child) durable execution failed
      - `ChainedInvokeTimedOut` — a chained execution exceeded its timeout
      - `ChainedInvokeStopped` — a chained execution was stopped

      **Other signals:**
      - `WaitCancelled` — a scheduled wait was cancelled before completing
      - `InvocationCompleted` with an Error field — the Lambda invocation itself errored (e.g., runtime crash)

      **Diagnosis patterns:**
      - Failed operations: Show the EXACT error message verbatim in a code block
      - Stuck in WAIT_FOR_CALLBACK: Extract callback ID, show how long it's been waiting
      - Timeout: Show which operation was running when timeout occurred
      - Unexpected behavior: Compare operation order with expected flow
   c. Calculate operation durations and timeline
   d. Provide a clear, plain-language explanation of what went wrong and why

3. If the command fails:
   - Execution not found: Tell the user the execution ID may be incorrect or the execution may have been purged. Ask them to verify the ARN.
   - Permissions/network error: check that your caller identity has lambda:GetDurableExecutionHistory on the function ARN.
   - In either case, direct them to the console as a fallback (see step 4)

4. ALWAYS provide a direct link to the Execution Details page in the Lambda console.
   Parse the ARN (arn:<partition>:lambda:<region>:<accountId>:function:<functionName>:<functionVersion>/durable-execution/<executionName>/<invocationId>)
   to extract region, functionName, functionVersion, executionName, and invocationId, then construct:
   https://<region>.console.aws.amazon.com/lambda/home?region=<region>#/functions/<functionName>/versions/<functionVersion>/executions/<executionName>/<invocationId>

   Frame it as: "**[View this execution in the console](<url>)**"

5. Provide specific, actionable next steps based on the diagnosis.

6. If unable to determine the root cause from execution history:
   - Provide the console link (step 4)
   - Offer to fetch the log group and pull relevant logs:
     a. Get the log group:
        aws lambda get-function-configuration --function-name <functionName>:<functionVersion> --region <region> --query 'LoggingConfig.LogGroup'
     b. Query logs filtered by invocation ID (parsed from the ARN):
        aws logs filter-log-events --log-group-name <logGroup> --region <region> --filter-pattern '"<invocationId>"'
     c. If the function uses SDK structured logging (context.logger), query for step-level logs.
        Use execution start time from step 2 as start-time, and execution end time (or current time if still running) as end-time:
        QUERY_ID=$(aws logs start-query --log-group-name <logGroup> --region <region> \
          --start-time <startEpoch> --end-time <endEpoch> \
          --query-string 'fields @timestamp, @message | filter executionName = "<executionName>" | sort @timestamp asc' \
          --query 'queryId' --output text)
        Then poll for results:
        aws logs get-query-results --query-id $QUERY_ID --region <region>
   - If unable to determine the log group, ask the user to check the function's logs

OUTPUT FORMAT:
- Lead with a short summary: "Your execution [status] because [reason]."
- Show the error message verbatim in a code block if one exists.
- Explain what this means in plain language.
- Provide the console link for visual debugging.
- List recommended next steps.

Use jq for JSON parsing if available, otherwise use --query (AWS CLI built-in JMESPath) or python -m json.tool.

Example Usage

User: "My durable function execution abc-123 is stuck on my-function:live in us-west-2"

Agent: [Runs get-durable-execution-history command]
Agent: [Analyzes with jq queries]

Claude: Your execution is **waiting for an external callback** that hasn't arrived yet.

        The operation `wait-for-approval` has been pending since 2026-02-14 (3 days).
        It will time out in 12 hours if no callback is received.

        Callback ID: `xyz789`

        **[View this execution in the console](https://us-west-2.console.aws.amazon.com/lambda/home?region=us-west-2#/functions/my-function/versions/3/executions/abc-123/inv-456)**
        ```
        https://us-west-2.console.aws.amazon.com/lambda/home?region=us-west-2#/functions/my-function/versions/3/executions/abc-123/inv-456
        ```

        **Next steps:**
        1. Check if the approval email was sent to the recipient
        2. Verify the callback ID `xyz789` was included in the email
        3. If you'd like me to help send the callback manually, let me know

User: "Execution def-456 failed on order-processor:live in us-east-1"

Agent: [Runs get-durable-execution-history command]
Agent: [Analyzes with jq queries]

Claude: Your execution **failed** at the `charge-payment` step after 3 retry attempts.

        Error message:
        ```
        PaymentGatewayError: Card declined - insufficient funds (code: card_declined)
        ```

        This means the payment provider rejected the charge. The durable function
        retried 3 times with exponential backoff but the error persisted because
        it's a permanent failure (not a transient network issue).

        **[View this execution in the console](https://us-east-1.console.aws.amazon.com/lambda/home?region=us-east-1#/functions/order-processor/versions/5/executions/def-456/inv-789)**
        ```
        https://us-east-1.console.aws.amazon.com/lambda/home?region=us-east-1#/functions/order-processor/versions/5/executions/def-456/inv-789
        ```

        **Next steps:**
        1. This is a business logic failure, not an infrastructure issue
        2. Consider adding a non-retryable error classification for `card_declined`
        3. Implement a compensation step to release the reserved inventory

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server, Needs a command-line tool, Needs Python

Security

What our scanner noticed· Low risk

Instructions that use the network

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

AWS

Publisher

AWS (Official)

Source

aws/agent-toolkit-for-aws · skills/specialized-skills/serverless-skills/aws-lambda-durable-functions · commit 0a218f8

Licence

Apache License 2.0 (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
NOTICE (added by AutoGineer from NOTICE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-08

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-lambda-durable-functions.zip