Functions Component

Deploys one or more serverless functions from a single component definition. Each function item gets its own dedicated execution identity (IAM role / service account) — permissions are never shared between functions. Code is loaded from a storage bucket, allowing you to manage deployable artifacts independently of the infrastructure config.

Each entry in the functions array defines one deployed function.

codeStorage and codePath are set once at the component level and shared by all function items. references at the component level (app-db, transactional-email) apply to all functions; item-level references are merged in for that function only.

When a function component has links, the plugin automatically injects environment variables into all Lambda functions in the group. The variable name is derived from the target component name: convert to UPPER_SNAKE_CASE and append a suffix.

Target component name → replace - with _ → UPPERCASE → append suffix:

• {NAME}_ARN — injected for most link types
• FUNCTION_{NAME} — for FUNCTION_TO_FUNCTION links (no _ARN suffix)
• {NAME}_USER_POOL_ID — only for authentication links
• {NAME}_CLIENT_ID — only for authentication links

Individual functions can also define their own links array. These inject env vars only into that specific function (in addition to the component-level link vars):

This injects SPECIAL_DB_ARN only into special-handler.

When multiple sources define the same variable, later sources override earlier ones:

1. Component-level link env vars (auto-injected from links array)
2. Group-level environment from providerSettings
3. Per-function environment from the function definition
4. Per-function link env vars

Add a schedule to a function item to invoke it on a time cadence. The plugin provisions an EventBridge (CloudWatch Events) rule named {application}-{item.name}-schedule, points it at the function, and grants events.amazonaws.com permission to invoke it. No schedule means the function is deployed unchanged (invoked only by its other triggers, if any).

The schedule value is a standard EventBridge schedule expression:

• Rate — rate(value unit), where value is a positive integer and unit is minute(s), hour(s), or day(s). The unit must be singular when the value is 1 and plural otherwise, e.g. rate(1 day), rate(5 minutes), rate(2 hours).
• Cron — cron(minutes hours day-of-month month day-of-week year) (six fields), e.g. cron(0 12 * * ? *) for 12:00 UTC daily.

serverless:validate checks the expression shape before any cloud call; AWS performs the authoritative validation at deploy time.

Functions can declare a permissions array to grant IAM access to resource types that don't exist in the configuration. This is useful when a function needs to create, manage, or interact with resources dynamically (e.g., creating S3 buckets, managing DNS records).

If a function does not define its own permissions, it inherits from the component level:

In this example, reader gets database:read and database:write from the component level, while writer uses its own permissions array (which overrides the component level).

Use references at the component level for access shared by all functions, or at the individual function item level for per-function access control. Both levels can be combined — a function's effective permissions are the union of component-level and item-level references.