Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

How do I troubleshoot Lambda function failures?

7 minute read
0

When I invoke my AWS Lambda function, it fails and returns an error.

Resolution

To troubleshoot Lambda function failures, use one or more of the AWS services and features listed in this article to find what caused the error. Then, follow the links provided to review the troubleshooting best practices for each issue.

Troubleshoot networking errors

If your function isn't in a virtual private cloud (VPC) and uses a private DNS name to access resources, then you get the following error:

"UnknownHostException Error: getaddrinfo ENOTFOUND"

If your function is in a VPC and then loses internet access or times out, then you get the following error:

"connect ETIMEDOUT 176.32.98.189:443 Task timed out after 10.00 seconds"

If the VPC that your function is in reaches its elastic network interface limit, then you get the following error:

"ENILimitReachedException: The elastic network interface limit was reached for the function's VPC"

If the Transmission Control Protocol (TCP) connection drops, then you get the following error:

"Connection reset by peer ECONNRESET ECONNREFUSED"

To troubleshoot Lambda networking errors, complete the following steps:

1. Confirm that there's a valid network path to the endpoint that your function tried to reach for your Amazon Virtual Private Cloud (Amazon VPC). For more information, see Giving Lambda functions access to resources in an Amazon VPC.

2. Confirm that your function has access to the internet. For more information, see How do I give internet access to a function that's connected to an Amazon VPC? Also, see How do I troubleshoot Lambda function "ETIMEDOUT" errors?

3. To troubleshoot DNS resolution issues, make sure that you configure the VPC for private resource access. If you don't use AWS provided DNS, then use an Amazon Elastic Compute Cloud (Amazon EC2) instance. Use the Amazon EC2 instance to confirm that the custom provided DHCP option resolves DNS name correctly. For more information, see How do I troubleshoot partial or intermittent DNS failures related to Amazon VPC?

Note: If you can't determine why your function code didn't reach a public endpoint after you reviewed your VPC configuration, then turn on VPC Flow Logs. VPC Flow Logs allow you to see all the network traffic that flows to and from a VPC. VPC Flow Logs also allows you to determine why requests are denied or didn't route. For more information, see Troubleshoot networking issues in Lambda.

Troubleshoot permission errors

If the security permissions for your Lambda deployment package are incorrect, then you get one of the following errors:

  • "EACCES: permission denied, open '/var/task/index.js"
  • "cannot load such file – function"
  • "[Errno 13] Permission denied: '/var/task/function.py"

The Lambda runtime requires permission to read the files in your deployment package. Lambda requires 644 permissions for non-executable files rw-r--r-- and 755 permissions rwxr-xr-x for directories and executable files. For Linux and macOS, run the chmod command to change permissions in your deployment package:

chmod 644 your-filepath

Note: Change your-filepath to your file path directory.

For more information, see Troubleshoot deployment issues in Lambda.

If your AWS Identity and Access Management (IAM) identities don't have permission to invoke a function, then you receive the following error:

"User: arn:aws:iam::123456789012:user/developer is not authorized to perform: lambda:InvokeFunction on resource: my-function"

Review your Lambda log file entries in AWS CloudTrail. The requester that makes calls to Lambda must have the required IAM permissions to invoke your function. To grant the required permissions, update your Lambda function permissions.

For more information, see Logging Lambda API calls using CloudTrail, Troubleshooting Lambda identity and access, and IAM: lambda:InvokeFunction not authorized.

Troubleshoot code errors

The following are Lambda code-related errors:

  • "Unable to marshal response: Object of type AttributeError is not JSON serializable"
  • "Issue: The AWS SDK included on the runtime is not the latest version"
  • "(Node.js) Function returns before code finishes executing"
  • "KeyError"

To troubleshoot Lambda code errors, complete the following steps:

1. Review your Amazon CloudWatch Logs for Lambda.

Use CloudWatch to view all logs generated by your function's code and find potential issues. For more information, see Sending Lambda function logs to CloudWatch Logs. For details on function logging, see the following Lambda function logging instructions for the programming language that you use:

2. Use AWS X-Ray to find code performance bottlenecks. If your Lambda function uses downstream AWS resources, microservices, databases, or HTTP web APIs, then use X-Ray to troubleshoot code performance issues. For more information, see Visualize Lambda function invocations using X-Ray.

3. Confirm that your function's deployment package can import required dependencies. Follow the Lambda deployment packages instructions for the programming language that you use:

4. For code deployed as a container image, confirm that you installed the runtime interface client and deployed the image correctly. Follow the container image instructions for the programming language that you use:

Troubleshoot throttling errors

If your function gets throttled, you get the following error:

"Rate exceeded 429 TooManyRequestsException"

To troubleshoot Lambda throttling errors, review your CloudWatch metrics for Lambda. For more information, see Using CloudWatch metrics with Lambda.

Key metrics to review:

  • ConcurrentExecutions
  • UnreservedConcurrentExecutions
  • Throttles
  • Duration

Note: If requests to invoke your function arrive faster than it can scale or exceed your concurrency limit, then requests fail with a 429 throttling error. For more information, see Understanding Lambda function scaling. Also, How do I troubleshoot Lambda function "Rate exceeded" and "TooManyRequestsException" throttling errors?

Troubleshoot Invoke API 500 and 502 errors

If your invoke request fails, then you get one of the following 500 or 502 server-side errors:

  • "InvalidRuntimeException"
  • "InvalidSecurityGroupIDException"
  • "InvalidZipFileException"
  • "KMSAccessDeniedException"
  • "KMSNotFoundException"
  • "You have exceeded the maximum limit for Hyperplane ENIs for your account"
  • "SubnetIPAddressLimitReachedException"

To troubleshoot Lambda Invoke API 500 and 502 errors, follow the instructions in How do I troubleshoot Lambda HTTP 500 and HTTP 502 status code errors? For a list of errors with descriptions, see Errors in the Lambda invoke API reference.

Troubleshoot container image errors

If you use container images and there's an issue with a container image, then you get one of the following errors:

  • "errorType: Runtime.InvalidEntrypoint"
  • "Error: You are using an AWS CloudFormation template, and your container ENTRYPOINT is being overridden with a null or empty value."

To troubleshoot Lambda container image errors, follow the instructions in Troubleshoot invocation issues in Lambda.

Related information

Monitoring, debugging, and troubleshooting Lambda functions

Understanding retry behavior in Lambda

Topics
Compute
Tags
AWS Lambda
Language
English
AWS OFFICIALUpdated 3 months ago
2 Comments

If you are wondering what service can be used to troubleshoot lambda functions then here it is -AWS X-Ray can be used to troubleshoot AWS Lambda functions. It helps you trace requests as they travel through your application, identify bottlenecks, and understand dependencies by providing detailed information about the requests processed by your Lambda functions. Additionally, Amazon CloudWatch can be used for logging and monitoring metrics to gain further insights into function performance and issues.

replied 2 years ago

This article was reviewed and updated on 2026-07-15.

AWS
EXPERT

replied 3 months ago

Relevant content