Postconditions: what we check

• send · aws-lambda-service-error

  error
  WhenAny AWS service error or network failure when calling lambdaClient.send(): function does not exist (ResourceNotFoundException), insufficient permissions (EC2AccessDeniedException, KMSAccessDeniedException), request throttling (TooManyRequestsException), code storage limit exceeded (CodeStorageExceededException), function is too large (RequestTooLargeException), EC2 errors (EC2ThrottledException, EC2UnexpectedException), KMS errors (KMSDisabledException, KMSNotFoundException), ENI limit exceeded (EniLimitReachedException), service unavailable, or any network-level failure (DNS, timeout, connection refused)
  ThrowsLambdaServiceException subclass with error.name set to the specific error code (e.g., "ResourceNotFoundException", "TooManyRequestsException", "EC2ThrottledException"). For network errors, throws a generic Error or SdkClientError with a connection/timeout message.
  Required handlingCaller MUST wrap client.send() in try-catch. All Lambda operations can fail due to network issues, permission problems, function absence, or AWS service outages. Unhandled rejections on InvokeCommand cause silent function invocation failures or application crashes. Note: For InvokeCommand specifically, AWS Lambda does NOT throw for application errors within the invoked function — instead it returns a non-null FunctionError field in the response. The try-catch required by this contract covers only network/service errors, not function execution errors. Minimum handling: try { const response = await lambdaClient.send(new InvokeCommand({ FunctionName: functionArn, Payload: Buffer.from(JSON.stringify(payload)) })); if (response.FunctionError) { throw new Error(`Function error: ${response.FunctionError}`); } return response.Payload; } catch (error) { if (error instanceof LambdaServiceException) { console.error(`Lambda error [${error.name}]: ${error.message}`); } else { console.error('Network error:', error); } throw error; }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[1][2][3][4]
• send · aws-lambda-invoke-function-error-unchecked

  error
  WhenInvokeCommand (synchronous RequestResponse invocation) called and response.FunctionError is not checked before using response.Payload. Lambda returns HTTP 200 with FunctionError set to "Handled" or "Unhandled" when the invoked function threw an unhandled exception or timed out — callers must explicitly inspect this field.
  ThrowsDoes NOT throw. This is a silent data loss pattern. Lambda returns HTTP 200 with FunctionError "Handled" or "Unhandled". Caller silently processes an error payload as a success payload, causing downstream data corruption or silent workflow failures.
  Required handlingAfter every synchronous InvokeCommand, check response.FunctionError before using Payload. Not applicable for InvocationType="Event" (async invocations return 202, no FunctionError). const response = await lambdaClient.send(new InvokeCommand({ FunctionName: 'my-function', Payload: Buffer.from(JSON.stringify(payload)), })); if (response.FunctionError) { const errorPayload = JSON.parse(Buffer.from(response.Payload!).toString()); throw new Error(`Lambda function error: ${response.FunctionError} — ${errorPayload.errorMessage}`); } const result = JSON.parse(Buffer.from(response.Payload!).toString());
  costhighin prodsilent failureusers seelost datavisibilitysilent
  Sources[2][3]
• send (InvokeWithResponseStreamCommand) · aws-lambda-stream-no-error-handling

  error
  WhenInvokeWithResponseStreamCommand called without try-catch or .catch() handler. Same error types as InvokeCommand are thrown before streaming begins: ResourceNotFoundException, TooManyRequestsException, EC2AccessDeniedException, KMSAccessDeniedException, InvalidParameterValueException, ServiceException, etc.
  ThrowsLambdaServiceException subclass (same error types as InvokeCommand) thrown when the invocation cannot start. Network errors throw SdkClientError.
  Required handlingCaller MUST wrap in try-catch for pre-stream errors, AND must iterate the EventStream and check InvokeComplete.ErrorCode for post-stream function errors.
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[5]
• send (InvokeWithResponseStreamCommand) · aws-lambda-stream-invokecomplete-errorcode-unchecked

  error
  WhenCaller iterates InvokeWithResponseStreamCommand EventStream but does not check the InvokeComplete event's ErrorCode field. The streaming function may fail after sending partial PayloadChunks, delivering an InvokeComplete event with ErrorCode set. Caller silently processes partial data as a complete successful response.
  ThrowsDoes NOT throw. ErrorCode is delivered in the EventStream's terminal InvokeComplete event. A streaming function can emit PayloadChunk events before failing — callers must check InvokeComplete.ErrorCode even after successfully receiving chunks.
  Required handlingWhen iterating the EventStream, check InvokeComplete event and its ErrorCode field: for await (const event of response.EventStream!) { if (event.PayloadChunk) { yield Buffer.from(event.PayloadChunk.Payload!).toString(); } if (event.InvokeComplete) { if (event.InvokeComplete.ErrorCode) { throw new Error( `Streaming function error: ${event.InvokeComplete.ErrorCode} — ${event.InvokeComplete.ErrorDetails}` ); } } }
  costhighin prodsilent failureusers seelost datavisibilitysilent
  Sources[5]
• waitUntilFunctionActive · aws-lambda-waiter-no-error-handling

  error
  WhenwaitUntilFunctionActive(), waitUntilFunctionActiveV2(), or waitUntilFunctionExists() called without try-catch. Throws Error with name "TimeoutError" when maxWaitTime exceeded and function has not reached Active state; throws generic Error when function enters Failed state (resource provisioning failed); throws LambdaServiceException if polling fails.
  ThrowsError with name "TimeoutError" (from checkExceptions in @smithy/util-waiter) when maxWaitTime exceeded. Generic Error with WaiterResult JSON payload when function reaches Failed state. LambdaServiceException if underlying GetFunctionConfiguration polls fail.
  Required handlingAlways wrap waiter calls in try-catch and handle both timeout and failure states: try { await waitUntilFunctionActiveV2( { client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName } ); } catch (error) { if (error.name === 'TimeoutError') { throw new Error(`Function ${functionName} stuck in Pending state after 5 minutes`); } console.error('Function activation failed:', error.message); throw error; }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[6][1]
• waitUntilFunctionUpdated · aws-lambda-update-waiter-no-error-handling

  error
  WhenwaitUntilFunctionUpdated() or waitUntilFunctionUpdatedV2() called without try-catch after UpdateFunctionCodeCommand. Throws TimeoutError on timeout; throws generic Error when LastUpdateStatus reaches Failed (bad ZIP, code size exceeded, invalid handler).
  ThrowsError with name "TimeoutError" when maxWaitTime exceeded. Generic Error with WaiterResult JSON when LastUpdateStatus is "Failed". ResourceConflictException from underlying polls if another update is simultaneously in progress.
  Required handlingWrap in try-catch and distinguish timeout from failed update: try { await waitUntilFunctionUpdatedV2( { client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName } ); } catch (error) { if (error.name === 'TimeoutError') { console.error('Function update did not complete in 5 minutes'); } else { console.error('Function update failed (bad code/config?):', error.message); } throw error; }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[6][1]
• send (CreateFunctionCommand) · aws-lambda-create-no-error-handling

  error
  WhenCreateFunctionCommand sent via lambdaClient.send() without try-catch. Throws ResourceConflictException (409) when a function with the same name already exists, CodeStorageExceededException when account Lambda code storage quota is exceeded, TooManyRequestsException on throttling, InvalidParameterValueException for bad runtime/handler/role, ResourceNotFoundException when IAM role or VPC resources do not exist.
  ThrowsLambdaServiceException subclasses: ResourceConflictException (function already exists), CodeStorageExceededException (75 GB account quota exceeded), TooManyRequestsException (rate limit), InvalidParameterValueException (bad config), ResourceNotFoundException (IAM role/VPC not found).
  Required handlingWrap in try-catch and handle idempotency (ResourceConflictException means function already exists — often safe to continue by updating code instead): try { await lambdaClient.send(new CreateFunctionCommand({ FunctionName: functionName, Runtime: 'nodejs22.x', Role: roleArn, Handler: 'index.handler', Code: { ZipFile: zipBuffer }, })); } catch (error) { if (error.name === 'ResourceConflictException') { await lambdaClient.send(new UpdateFunctionCodeCommand({ ... })); } else if (error.name === 'CodeStorageExceededException') { throw new Error('Lambda code storage quota exceeded — delete old versions'); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[7][1]
• send (UpdateFunctionCodeCommand) · aws-lambda-update-code-no-error-handling

  error
  WhenUpdateFunctionCodeCommand sent via lambdaClient.send() without try-catch. Throws ResourceConflictException (409) when another update is already in progress (UpdateFunctionConfiguration or another UpdateFunctionCode overlapping), PreconditionFailedException (412) when RevisionId parameter doesn't match the current function revision (concurrent deployment race), CodeStorageExceededException (400) when 75 GB account Lambda storage quota is exceeded, ResourceNotFoundException (404) when the function does not exist, TooManyRequestsException (429) on throttling.
  ThrowsLambdaServiceException subclasses: ResourceConflictException (409, update in progress), PreconditionFailedException (412, RevisionId mismatch — concurrent deploy race), CodeStorageExceededException (400, account quota exceeded), ResourceNotFoundException (404, function not found), TooManyRequestsException (429, rate limited). Network errors throw SdkClientError.
  Required handlingWrap in try-catch. Handle ResourceConflictException with retry after waitUntilFunctionUpdated. PreconditionFailedException requires fetching the current RevisionId from GetFunction before retrying. CodeStorageExceededException requires deleting unused versions: try { await lambdaClient.send(new UpdateFunctionCodeCommand({ FunctionName: functionName, ZipFile: zipBuffer, })); await waitUntilFunctionUpdatedV2( { client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName } ); } catch (error) { if (error.name === 'ResourceConflictException') { await waitUntilFunctionUpdatedV2({ client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName }); // Retry update } else if (error.name === 'PreconditionFailedException') { throw new Error(`Deployment race condition — another process is deploying ${functionName}`); } else if (error.name === 'CodeStorageExceededException') { throw new Error('Lambda code storage quota exceeded — delete old function versions'); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[8][1]
• send (UpdateFunctionCodeCommand) · aws-lambda-update-code-precondition-failed

  warning
  WhenUpdateFunctionCodeCommand called with RevisionId parameter that does not match the function's current RevisionId. This is a silent data integrity issue — a concurrent deployment completed between when the RevisionId was fetched and when the update was sent, meaning the caller's deployment would overwrite newer code if allowed. Lambda rejects with PreconditionFailedException to prevent this.
  ThrowsPreconditionFailedException (HTTP 412) with message "The Revision Id provided does not match the latest Revision Id for the Lambda function or alias." error.name is "PreconditionFailedException", $fault is "client".
  Required handlingWhen using RevisionId for safe deployments, catch PreconditionFailedException and re-fetch the current RevisionId before retrying: const fn = await lambdaClient.send(new GetFunctionCommand({ FunctionName: name })); await lambdaClient.send(new UpdateFunctionCodeCommand({ FunctionName: name, ZipFile: zipBuffer, RevisionId: fn.Configuration!.RevisionId, }));
  costlowin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[8]
• send (UpdateFunctionConfigurationCommand) · aws-lambda-update-config-no-error-handling

  error
  WhenUpdateFunctionConfigurationCommand sent via lambdaClient.send() without try-catch. Throws ResourceConflictException (409) when another configuration update is already in progress (common during VPC provisioning which can take over a minute), PreconditionFailedException (412) on RevisionId mismatch, ResourceNotFoundException (404) when function not found, InvalidParameterValueException (400) for bad handler/runtime/role/VPC settings, TooManyRequestsException (429) on throttling.
  ThrowsLambdaServiceException subclasses: ResourceConflictException (409, update in progress — VPC changes take 60+ seconds), PreconditionFailedException (412, concurrent update race), ResourceNotFoundException (404, function not found), InvalidParameterValueException (400, invalid settings), TooManyRequestsException (429, rate limited). Network errors throw SdkClientError.
  Required handlingWrap in try-catch. Always wait for completion with waitUntilFunctionUpdated before chaining another config or code update. ResourceConflictException means another update (possibly VPC provisioning) is still in progress: try { await lambdaClient.send(new UpdateFunctionConfigurationCommand({ FunctionName: functionName, Timeout: 30, MemorySize: 512, Environment: { Variables: { KEY: 'value' } }, })); // Wait for update to complete before invoking or re-updating await waitUntilFunctionUpdatedV2( { client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName } ); } catch (error) { if (error.name === 'ResourceConflictException') { // Another update in progress — wait then retry await waitUntilFunctionUpdatedV2({ client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName }); } else if (error.name === 'InvalidParameterValueException') { throw new Error(`Invalid Lambda config: ${error.message}`); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[9][1]
• waitUntilPublishedVersionActive · aws-lambda-published-version-waiter-no-error-handling

  error
  WhenwaitUntilPublishedVersionActive() called without try-catch after PublishVersionCommand. Throws Error with name "TimeoutError" when maxWaitTime exceeded and the published version has not reached Active state. Throws generic Error when the version reaches Failed state (VPC/EFS provisioning failure). Throws LambdaServiceException if underlying GetFunctionConfiguration polls fail.
  ThrowsError with name "TimeoutError" (from @smithy/util-waiter checkExceptions) when maxWaitTime exceeded. Generic Error with WaiterResult JSON payload when published version reaches Failed state (resource provisioning failed). LambdaServiceException if underlying GetFunctionConfiguration calls fail (permissions, function not found).
  Required handlingAlways wrap in try-catch after PublishVersionCommand in blue/green deploy workflows: try { const published = await lambdaClient.send(new PublishVersionCommand({ FunctionName: functionName, Description: 'v2.0.0 release', })); await waitUntilPublishedVersionActive( { client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName, Qualifier: published.Version } ); // Now safe to update alias to point to published.Version } catch (error) { if (error.name === 'TimeoutError') { throw new Error(`Version ${functionName} stuck in Pending state after 5 minutes`); } throw new Error(`Version activation failed: ${error.message}`); }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[10][6][1]
• send (CreateEventSourceMappingCommand) · aws-lambda-event-source-mapping-no-error-handling

  error
  WhenCreateEventSourceMappingCommand sent via lambdaClient.send() without try-catch. Throws ResourceConflictException (409) when an event source mapping already exists for the same function and event source ARN (not idempotent — repeated calls fail), ResourceNotFoundException (404) when the Lambda function or event source ARN does not exist, InvalidParameterValueException (400) for bad StartingPosition, filter criteria, or batch size, TooManyRequestsException (429) on throttling.
  ThrowsLambdaServiceException subclasses: ResourceConflictException (409, mapping already exists — use UpdateEventSourceMappingCommand to modify), ResourceNotFoundException (404, function or event source not found), InvalidParameterValueException (400, bad StartingPosition/batch size/filter), TooManyRequestsException (429, throttled). Network errors throw SdkClientError.
  Required handlingWrap in try-catch and handle ResourceConflictException as idempotency signal (mapping already exists — may be safe to continue): try { await lambdaClient.send(new CreateEventSourceMappingCommand({ FunctionName: functionName, EventSourceArn: sqsQueueArn, BatchSize: 10, FunctionResponseTypes: ['ReportBatchItemFailures'], })); } catch (error) { if (error.name === 'ResourceConflictException') { // Mapping already exists — idempotent, safe to continue console.info(`Event source mapping already exists for ${functionName}`); } else if (error.name === 'ResourceNotFoundException') { throw new Error(`Function ${functionName} or event source not found`); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[11][1]
• send (AddPermissionCommand) · aws-lambda-add-permission-no-error-handling

  error
  WhenAddPermissionCommand sent via lambdaClient.send() without try-catch. Throws ResourceConflictException (409) when a statement with the same Sid already exists, ResourceNotFoundException (404) when the Lambda function or alias does not exist, PolicyLengthExceededException (400) when the 20 KB function policy size limit is reached (silent failure mode in deploy scripts that re-add statements on every run), PublicPolicyException (400) when the statement would grant public access without a SourceAccount/SourceArn condition (security guardrail), PreconditionFailedException (412) on RevisionId mismatch, InvalidParameterValueException (400) for malformed Principal or Action, TooManyRequestsException (429) on throttling.
  ThrowsLambdaServiceException subclasses: ResourceConflictException (409, Sid already exists — idempotency signal in deploy automation), PolicyLengthExceededException (400, 20 KB policy doc cap exceeded — caller must delete old statements via RemovePermissionCommand), PublicPolicyException (400, would grant public access — must add SourceAccount/SourceArn condition), ResourceNotFoundException (404), PreconditionFailedException (412, RevisionId race), InvalidParameterValueException (400, malformed Principal/Action), TooManyRequestsException (429, throttled). Network errors throw SdkClientError.
  Required handlingWrap in try-catch. Handle ResourceConflictException as idempotency signal (statement with same Sid already exists — safe to continue in deploy automation). Treat PolicyLengthExceededException as a critical operational alert — the function policy must be cleaned up (delete unused Sids via RemovePermissionCommand) before any new permission can be added. Treat PublicPolicyException as a security guardrail — DO NOT bypass by removing the SourceAccount condition; refactor the call to scope access correctly. try { await lambdaClient.send(new AddPermissionCommand({ FunctionName: functionName, StatementId: `apigw-${routeId}`, Action: 'lambda:InvokeFunction', Principal: 'apigateway.amazonaws.com', SourceArn: apiGwArn, })); } catch (error: any) { if (error.name === 'ResourceConflictException') { // Statement Sid already exists — idempotent, safe to continue } else if (error.name === 'PolicyLengthExceededException') { throw new Error(`Lambda function policy on ${functionName} hit 20 KB cap — clean up unused Sids before adding new permissions`); } else if (error.name === 'PublicPolicyException') { throw new Error(`Refusing to grant public access to ${functionName} without SourceAccount/SourceArn condition`); } else if (error.name === 'PreconditionFailedException') { throw new Error(`AddPermission race condition on ${functionName} — RevisionId mismatch`); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[12][13][1]
• send (AddPermissionCommand) · aws-lambda-add-permission-policy-length-exceeded

  warning
  WhenAddPermissionCommand catch block does not specifically handle PolicyLengthExceededException. This is a silent operational failure — once the function policy doc reaches 20 KB, EVERY subsequent AddPermissionCommand call fails identically. Deploy scripts that idempotently re-add statements on every run will start failing across all environments simultaneously with no surface signal beyond the catch-all error log. The policy must be manually cleaned up via RemovePermissionCommand calls — the AddPermission API itself cannot resolve the condition.
  ThrowsPolicyLengthExceededException (HTTP 400) with message "The statement you provided exceeds the function-policy size limit." error.name is "PolicyLengthExceededException", $fault is "client".
  Required handlingCatch error.name === 'PolicyLengthExceededException' specifically and emit a high-severity alert that includes the function name. The caller must enumerate existing Sids via GetPolicyCommand and remove orphaned statements via RemovePermissionCommand before retrying: try { await lambdaClient.send(new AddPermissionCommand({ FunctionName: fn, StatementId: sid, Action: action, Principal: principal, })); } catch (error: any) { if (error.name === 'PolicyLengthExceededException') { const policy = await lambdaClient.send(new GetPolicyCommand({ FunctionName: fn })); // Caller must inspect and prune orphaned Sids before retry throw new Error(`Lambda policy on ${fn} at 20 KB cap; ${policy.Policy?.length} bytes — prune Sids and retry`); } throw error; }
  costmediumin proddegraded serviceusers seedegraded performancevisibilitysilent
  Sources[12][14]
• send (PublishVersionCommand) · aws-lambda-publish-version-no-error-handling

  error
  WhenPublishVersionCommand sent via lambdaClient.send() without try-catch. Throws CodeStorageExceededException (400) when the 75 GB account-wide Lambda code storage quota is exceeded (silent rollout failure — deploys succeed for early functions and start failing once the quota is hit), FunctionVersionsPerCapacityProviderLimitExceededException (400) when the per-capacity-provider version count limit is reached (new in 2026 capacity provider feature), ResourceConflictException (409) when another update is in progress (the publish must wait for waitUntilFunctionUpdated to complete first), PreconditionFailedException (412) when RevisionId or CodeSha256 parameter does not match the current $LATEST (caller's expected code is stale), ResourceNotFoundException (404) when the function does not exist, InvalidParameterValueException (400) for bad Description/RevisionId, TooManyRequestsException (429) on throttling.
  ThrowsLambdaServiceException subclasses: CodeStorageExceededException (400, 75 GB quota), FunctionVersionsPerCapacityProviderLimitExceededException (400, capacity provider version cap), ResourceConflictException (409, update in progress), PreconditionFailedException (412, RevisionId/CodeSha256 mismatch — caller's $LATEST is stale), ResourceNotFoundException (404), InvalidParameterValueException (400), TooManyRequestsException (429). Network errors throw SdkClientError.
  Required handlingWrap in try-catch. Treat CodeStorageExceededException as a deploy-pipeline-stop condition — no new versions can be published until old versions are deleted via DeleteFunctionCommand with Qualifier. Treat PreconditionFailedException as a stale- $LATEST signal — re-fetch via GetFunctionCommand before retrying. Always chain a waitUntilPublishedVersionActive after publish before shifting traffic: try { const published = await lambdaClient.send(new PublishVersionCommand({ FunctionName: functionName, Description: 'v2.0.0 release', RevisionId: currentRevisionId, })); await waitUntilPublishedVersionActive( { client: lambdaClient, maxWaitTime: 300 }, { FunctionName: functionName, Qualifier: published.Version } ); } catch (error: any) { if (error.name === 'CodeStorageExceededException') { throw new Error('Lambda 75 GB code storage quota exceeded — delete old versions before publishing'); } else if (error.name === 'FunctionVersionsPerCapacityProviderLimitExceededException') { throw new Error(`Capacity provider version limit reached for ${functionName} — delete old versions`); } else if (error.name === 'PreconditionFailedException') { throw new Error(`Publish race condition on ${functionName} — $LATEST has been updated since RevisionId was fetched`); } else if (error.name === 'ResourceConflictException') { throw new Error(`Publish failed — concurrent UpdateFunctionCode in progress on ${functionName}`); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[10][14][1]
• send (CreateFunctionUrlConfigCommand) · aws-lambda-function-url-no-error-handling

  error
  WhenCreateFunctionUrlConfigCommand sent via lambdaClient.send() without try-catch. Throws ResourceConflictException (409) when a Function URL config already exists for the function/alias (only ONE Function URL per function-or-alias is allowed — repeated calls in deploy automation always fail), ResourceNotFoundException (404) when the function or alias does not exist, InvalidParameterValueException (400) for invalid AuthType / Cors config (e.g. AllowOrigins=["*"] combined with AllowCredentials=true is rejected), TooManyRequestsException (429) on throttling.
  ThrowsLambdaServiceException subclasses: ResourceConflictException (409, Function URL already exists — use UpdateFunctionUrlConfigCommand instead), ResourceNotFoundException (404, function/alias not found), InvalidParameterValueException (400, bad AuthType or Cors config), TooManyRequestsException (429, throttled). Network errors throw SdkClientError.
  Required handlingWrap in try-catch. Treat ResourceConflictException as idempotency signal in deploy automation (Function URL already exists — switch to UpdateFunctionUrlConfigCommand). When using AuthType="NONE", explicitly log/audit the public exposure so security reviews can catch it: if (authType === 'NONE') { console.warn(`SECURITY: creating PUBLIC Function URL for ${functionName} (no AWS_IAM auth)`); } try { await lambdaClient.send(new CreateFunctionUrlConfigCommand({ FunctionName: functionName, AuthType: authType, Cors: { AllowOrigins: ['https://app.example.com'], AllowMethods: ['POST'] }, })); } catch (error: any) { if (error.name === 'ResourceConflictException') { // Function URL already exists — switch to update await lambdaClient.send(new UpdateFunctionUrlConfigCommand({ FunctionName: functionName, AuthType: authType, })); } else if (error.name === 'ResourceNotFoundException') { throw new Error(`Function ${functionName} not found — create it before adding a Function URL`); } else if (error.name === 'InvalidParameterValueException') { throw new Error(`Invalid Function URL config for ${functionName}: ${error.message}`); } else { throw error; } }
  costmediumin prodimmediate exceptionusers seeservice unavailablevisibilityvisible
  Sources[15][16][1]

Sources

Every postcondition cites at least one of these. Grouped by source type; numbered to match the footnotes above.

Research notes

Curator notes from SOURCES.md captured when the profile was written so you can verify the reasoning, not just the rules.