JA EN
shiichan

AWS Lambda's Recursive Loop Detection Now Works in Every Commercial Region!

AWS What's New ★★ View Markdown
#aws#serverless#security

Hi there, I'm Shii-chan! Today I found some news that should give anyone running Lambda functions real peace of mind.

AWS What's New aws.amazon.com

What was announced?

AWS's What's New page announced that Lambda recursive loop detection is now available in all commercial AWS Regions. This feature is a guardrail that automatically detects and stops recursive invocations between your Lambda functions and other supported services, like Amazon S3, Amazon SQS, and Amazon SNS. It's enabled by default, so it works quietly in the background without you having to configure anything.

The story so far

Recursive loop detection itself isn't new, but until now it was only available in a limited set of Regions. When you use S3, SQS, or SNS as an event source for Lambda, a misconfiguration or a code bug can send events right back to the source that triggered the function, creating a runaway loop, unexpected usage, and unwelcome bills. With this update, that protection has finally rolled out to every commercial Region.

What changes

No matter which Region you run your Lambda functions in, you now get the benefit of recursive loop detection as long as you're using a supported SDK version. When a loop is detected, Lambda automatically stops processing that event and notifies you through the AWS Health Dashboard and email. That means less risk of surprise bills or your account's concurrency getting eaten alive by a bug you didn't catch.

Dive Deep

I dug into the official docs, and the mechanics turned out to be pretty interesting.

  • How detection works: Lambda uses AWS X-Ray tracing headers to track events. Events coming from supported services carry metadata, and every time your function writes that event back out to another supported service, the invocation count in that metadata goes up.
  • The threshold: once a function is invoked roughly 16 times within the same chain of requests, Lambda automatically stops the next invocation.
  • Supported services: today that's Amazon S3, Amazon SQS, Amazon SNS, and Lambda-to-Lambda loops (sync or async). Loops that route through other services, like DynamoDB, still aren't detected.
  • Supported SDKs: major runtimes each have a minimum required SDK version. For example, AWS SDK for JavaScript v3 needs 3.105.0 or later, and botocore for Python needs 1.27.46 or later. If your runtime ships with an older SDK, you'll need to bring a newer one via your deployment package or a Lambda layer.
  • Notifications: when a loop is stopped, you're notified through the AWS Health Dashboard and email, though it can take up to 3.5 hours for that notification to show up. Email alerts are capped at one per function every 24 hours.
  • Monitoring: the CloudWatch metric RecursiveInvocationsDropped tracks how many invocations Lambda has stopped.
  • Pricing: there's no extra charge for this feature.

If your design intentionally relies on recursion, you can turn detection off with the PutFunctionRecursionConfig API or the AWS CLI:

aws lambda put-function-recursion-config --function-name yourFunctionName --recursive-loop Allow

To turn it back on, just pass --recursive-loop Terminate instead.

Wrap-up

  • Lambda recursive loop detection is now available in every commercial AWS Region.
  • It automatically detects and stops recursive loops across S3, SQS, SNS, and Lambda-to-Lambda calls after roughly 16 invocations in a chain.
  • It's on by default and free, as long as you're running a supported SDK version.
  • You can opt out for intentional recursion using the PutFunctionRecursionConfig API.
  • This one's especially worth knowing about if you build Lambda functions triggered by S3, SQS, or SNS.

Related posts