Lambda contract checklist

Confirm before relying.

Lambda is a seam, not a place to hide a CRM

• Add the function to the instance. An identity policy alone does not let the flow invoke it.
• Return a flat string map or JSON, matching the block. Nested objects fail a string-map block.
• Log the ContactId. The flow log has no Lambda RequestId to join on.
• Default block timeout is 3 seconds. Raise it on purpose, not by hoping.

Setting the Lambda console timeout to 30 seconds and assuming the flow will wait.

The response contract

• Idempotent writes. Retries happen.
• Timeouts in the Lambda console must be higher than the block timeout or you will add a second failure mode.
• Cold starts count against the 8 seconds.
• Secrets stay in the function environment or in Secrets Manager, not in flow attributes.

Returning a Python dict with numbers and lists to a string-map block.

Association, resource policy, and the log that says AccessDenied

• Use an alias, not $LATEST, in production.
• Resource-based policy and identity policy answer different questions.
• VPC-attached functions need a path to their dependency and still must return in time.
• Terraform's association resource is the reviewable form of the console click.

Adding lambda:InvokeFunction to the admin user and retesting the call.