aws-lambda-durable-functions — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited aws-lambda-durable-functions (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build resilient multi-step applications and AI workflows that can execute for up to 1 year while maintaining reliable progress despite interruptions.
Before using AWS Lambda durable functions, verify:
aws --version
aws sts get-caller-identitynode --version)python --version. Note that currently only Lambda runtime environments 3.13+ come with the Durable Execution SDK pre-installed. 3.11 is the min supported Python version by the Durable SDK itself, however, you could use OCI to bring your own container image with your own Python runtime + Durable SDK.)sam --version) 1.153.1 or highercdk --version) v2.237.1 or higherDefault: TypeScript
Override syntax:
When not specified, ALWAYS use TypeScript
Default: CDK
Override syntax:
When not specified, ALWAYS use CDK
#### Unsupported Language
#### Unsupported IaC Framework
For TypeScript/JavaScript:
npm install @aws/durable-execution-sdk-js
npm install --save-dev @aws/durable-execution-sdk-js-testingFor Python:
pip install aws-durable-execution-sdk-python
pip install aws-durable-execution-sdk-python-testingLoad the appropriate reference file based on what the user is working on:
TypeScript:
import { withDurableExecution, DurableContext } from '@aws/durable-execution-sdk-js';
export const handler = withDurableExecution(async (event, context: DurableContext) => {
const result = await context.step('process', async () => processData(event));
return result;
});Python:
from aws_durable_execution_sdk_python import durable_execution, DurableContext
@durable_execution
def handler(event: dict, context: DurableContext) -> dict:
result = context.step(lambda _: process_data(event), name='process')
return resultrunInChildContext to group operationscontext.logger (replay-aware)The Python SDK differs from TypeScript in several key areas:
@durable_step decorator + context.step(my_step(args)), or inline context.step(lambda _: ..., name='...'). Prefer the decorator for automatic step naming.context.wait(duration=Duration.from_seconds(n), name='...')ExecutionError (permanent), InvocationError (transient), CallbackError (callback failures)DurableFunctionTestRunner class directly - instantiate with handler, use context manager, call run(input=...)Durable functions require qualified ARNs (version, alias, or $LATEST):
# Valid
aws lambda invoke --function-name my-function:1 output.json
aws lambda invoke --function-name my-function:prod output.json
# Invalid - will fail
aws lambda invoke --function-name my-function output.jsonYour Lambda execution role MUST have the AWSLambdaBasicDurableExecutionRolePolicy managed policy attached. This includes:
lambda:CheckpointDurableExecution - Persist execution statelambda:GetDurableExecutionState - Retrieve execution stateAdditional permissions needed for:
lambda:InvokeFunction on target function ARNslambda:SendDurableExecutionCallbackSuccess and lambda:SendDurableExecutionCallbackFailureWhen writing or reviewing durable function code, ALWAYS check for these replay model violations:
Date.now(), Math.random(), UUID generation, API calls, database queries must all be inside stepscontext.step(), context.wait(), or context.invoke() inside a step function — use context.runInChildContext() insteadcontext.logger for logging (it is replay-aware and deduplicates automatically)When implementing or modifying tests for durable functions, ALWAYS verify:
LocalDurableTestRunner for local testingWrite access is enabled by default. The plugin ships with --allow-write in .mcp.json, so the MCP server can create projects, generate IaC, and deploy on behalf of the user.
Access to sensitive data (like Lambda and API Gateway logs) is not enabled by default. To grant it, add --allow-sensitive-data-access to .mcp.json.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.