aws-lambda-managed-instances — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited aws-lambda-managed-instances (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run Lambda functions on current-generation EC2 instances in your account while AWS manages provisioning, patching, scaling, routing, and load balancing. Combines Lambda's developer experience with EC2's pricing and hardware options.
For standard Lambda development, see aws-lambda skill. For SAM/CDK deployment, see aws-serverless-deployment skill.
| Signal | LMI is a strong fit | Standard Lambda is better |
|---|---|---|
| Traffic | Steady, predictable, 50M+ req/mo | Bursty, unpredictable, long idle |
| Cost | Duration-heavy spend at scale | Low or sporadic invocations |
| Cold starts | Unacceptable (LMI eliminates for provisioned capacity; scale-out may have brief delays) | Tolerable or mitigated by SnapStart |
| Compute | Latest CPUs, specific families, high network bandwidth | Standard Lambda memory/CPU sufficient |
| Isolation | Dedicated EC2 instances in your account, full VPC control | Shared Firecracker micro-VMs acceptable |
| Scale-to-zero | Not needed (execution environments always running) | Required (pay nothing when idle) |
| Code readiness | Thread-safe (Node.js/Java/.NET) or any Python code | Non-thread-safe Node.js/Java/.NET, expensive to change |
Gather these signals before recommending:
/tmp paths? Per-invocation DB connections?REQUIRED: Present a cost comparison before recommending LMI. Compare at minimum:
| Scenario | When it wins |
|---|---|
| Lambda on-demand | Low volume, bursty traffic |
| LMI on-demand | High volume, steady traffic |
Rule of thumb: LMI becomes cost-competitive when your Lambda spend exceeds ~$1,000/month with steady traffic.
For discount analysis (Savings Plans, Reserved Instances), refer users to the AWS Pricing Calculator and references/cost-comparison.md for formulas and worked examples. Discount recommendations require workload-specific forecasting beyond this skill's scope.
Instance families (~450 types): C-series (compute, .xlarge+), M-series (general, .large+), R-series (memory, .large+). ARM (Graviton) for best price-performance.
Memory-to-vCPU ratios: 2:1 (compute), 4:1 (general, default), 8:1 (memory). Min 2 GB, max 32 GB.
Multi-concurrency defaults/vCPU: Node.js 64, Java 32, .NET 32, Python 16.
Scaling: MinExecutionEnvironments (default 3), MaxVCpuCount (default 400), TargetResourceUtilization.
See references/configuration-guide.md for decision trees and detailed tuning.
Review code for concurrency safety. LMI runs multiple invocations concurrently per execution environment, but the model differs by runtime:
/tmp conflicts and memory sizing (per-process × concurrency).Common issues (all runtimes): shared /tmp paths, per-invocation DB connections. Thread-safety issues (Node.js/Java/.NET only): mutable globals, non-thread-safe libs.
See references/thread-safety.md for the review checklist and references/migration-patterns.md for runtime-specific before/after code.
See references/infrastructure-setup.md for CLI commands and SAM templates.
/tmp and memory for Python)/tmp usage under max concurrency/tmp paths without request-unique naming| Resource | Limit |
|---|---|
| Memory | 2 GB min, 32 GB max |
| Concurrency/vCPU | 64 (Node.js), 32 (Java/.NET), 16 (Python) |
| Instance lifespan | ~12 hours (auto-replaced by Lambda) |
| EE lifespan | ~4 hours (auto-replaced by Lambda) |
| Runtimes | Node.js, Java, .NET, Python |
| Instance families | C (.xlarge+), M (.large+), R (.large+) |
| Scaling | Doubles within 5 min without throttles |
| Issue | Cause | Fix |
|---|---|---|
| 429 throttles | Traffic exceeds scaling speed | Increase MinExecutionEnvironments or lower TargetResourceUtilization |
| Function stuck PENDING | Provisioning instances | Wait; check VPC/IAM config |
| Architecture mismatch | Function ≠ capacity provider arch | Align both to same architecture |
| Cannot terminate instances | Managed by capacity provider | Delete capacity provider instead |
| Race conditions | Code not thread-safe | See references/thread-safety.md |
See references/troubleshooting.md for detailed resolution steps.
REQUIRED: AWS credentials configured on the host machine.
Verify access: Run aws sts get-caller-identity
Currently available: us-east-1, us-east-2, us-west-2, ap-northeast-1, eu-west-1. Expanding to all commercial regions soon.
Check the Lambda Managed Instances documentation for the latest regional availability.
Default: TypeScript
Override: "use Python" → Python, "use JavaScript" → JavaScript. When not specified, ALWAYS use TypeScript.
Default: CDK
Override: "use SAM" → SAM YAML, "use CloudFormation" → CloudFormation YAML. When not specified, ALWAYS use CDK.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.