AI 技能AI 插件人工智能【免费下载链接】agentic-awesome-skillsAAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600 agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.项目地址https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills点击查看免费下载导读本文是 AASagentic-awesome-skills技能库中aws-serverless技能的核心参考文档detailed-guide.md的完整展开。该技能被 AAS Core 编目为cloud类目、critical风险等级的专项技能见 skills_index.json目标是指导 Agent 构建生产就绪的 AWS Serverless 应用。读完本文你将掌握 Lambda 处理器规范、API Gateway 集成、SQS/DynamoDB 事件驱动模式、SAM/CDK 双轨部署、冷启动优化以及 7 类生产环境高频陷阱的规避方案同时了解技能本身的安全约束与校验门禁。一、技能定位与使用边界aws-serverless技能的入口文件是 SKILL.md其 frontmatter 声明了名称aws-serverless范围Lambda 函数、API Gateway、DynamoDB、SQS/SNS 事件驱动模式、SAM/CDK 部署、冷启动优化风险等级critical意味着执行前必须完整读取本文档并遵守其中的安全与校验要求来源vibeship-spawner-skillsApache 2.0AAS Core 的目录索引将其归类到cloud大类skills_index.json并声明插件目标同时支持codex与claude两种 Agent 运行时且无需额外安装配置setup.type: none。技能自身明确了三项使用限制见 SKILL.md仅在任务与上述能力范围明确匹配时使用输出不能替代真实环境下的验证、测试与专家评审当缺少必要输入、权限、安全边界或成功标准时应停下来向用户澄清。这些约束提示我们本文是施工图纸而非验收报告——每段代码落地前仍需结合目标环境的 AWS 账号策略做适配。二、设计原则先度量再优化本文档开篇给出了 8 条贯穿全文的设计原则见 detailed-guide.md原则说明内存与超时按需配置先度量再优化不要盲目加大 MemorySize最小化冷启动对延迟敏感的工作负载优先处理冷启动路径Java/.NET 使用 SnapStart通过快照恢复绕开 JVM/CLR 初始化成本简单场景优先 HTTP API优先于 REST API成本与延迟都更优面向失败设计DLQ 重试机制缺一不可保持部署包精简减小包体是冷启动优化的第一优先级用环境变量做配置表名、桶名等不硬编码进代码结构化日志 关联 ID用 requestId 串联调用链支撑 CloudWatch Insights其中内存 CPU是一个容易被忽略的事实Lambda 的 CPU 算力随内存线性增长128 MB 只能拿到约 1/8 vCPU而 1024 MB 以上才能拿到完整 vCPU。这一机制会在后文的冷启动优化模式中反复体现。三、核心模式一Lambda Handler Pattern函数骨架规范适用场景任何 Lambda 函数实现——API 处理器、事件处理器、定时任务。3.1 Node.js 处理器骨架要点是把初始化移出 handler见 detailed-guide.md// handler.js // Initialize outside handler (reused across invocations) const { DynamoDBClient } require(aws-sdk/client-dynamodb); const { DynamoDBDocumentClient, GetCommand } require(aws-sdk/lib-dynamodb); const client new DynamoDBClient({}); const docClient DynamoDBDocumentClient.from(client); // Handler function exports.handler async (event, context) { // Optional: Dont wait for event loop to clear (Node.js) context.callbackWaitsForEmptyEventLoop false; try { // Parse input based on event source const body typeof event.body string ? JSON.parse(event.body) : event.body; // Business logic const result await processRequest(body); // Return API Gateway compatible response return { statusCode: 200, headers: { Content-Type: application/json, Access-Control-Allow-Origin: * }, body: JSON.stringify(result) }; } catch (error) { console.error(Error:, JSON.stringify({ error: error.message, stack: error.stack, requestId: context.awsRequestId })); return { statusCode: error.statusCode || 500, headers: { Content-Type: application/json }, body: JSON.stringify({ error: error.message || Internal server error }) }; } }; async function processRequest(data) { // Your business logic here const result await docClient.send(new GetCommand({ TableName: process.env.TABLE_NAME, Key: { id: data.id } })); return result.Item; }3.2 Python 处理器骨架同样的全局初始化 分层错误处理思路见 detailed-guide.md# handler.py import json import os import logging import boto3 from botocore.exceptions import ClientError # Initialize outside handler (reused across invocations) logger logging.getLogger() logger.setLevel(logging.INFO) dynamodb boto3.resource(dynamodb) table dynamodb.Table(os.environ[TABLE_NAME]) def handler(event, context): try: # Parse input body json.loads(event.get(body, {})) if isinstance(event.get(body), str) else event.get(body, {}) # Business logic result process_request(body) return { statusCode: 200, headers: { Content-Type: application/json, Access-Control-Allow-Origin: * }, body: json.dumps(result) } except ClientError as e: logger.error(fDynamoDB error: {e.response[Error][Message]}) return error_response(500, Database error) except json.JSONDecodeError: return error_response(400, Invalid JSON) except Exception as e: logger.error(fUnexpected error: {str(e)}, exc_infoTrue) return error_response(500, Internal server error) def process_request(data): response table.get_item(Key{id: data[id]}) return response.get(Item) def error_response(status_code, message): return { statusCode: status_code, headers: {Content-Type: application/json}, body: json.dumps({error: message}) }3.3 最佳实践要点客户端在 handler 之外初始化跨热调用复用连接始终返回符合 API Gateway 代理集成格式的响应statusCode/headers/body结构化 JSON 日志便于 CloudWatch Insights 查询错误日志中携带requestIdcontext.awsRequestId支撑跨服务追踪。四、核心模式二API Gateway Integration PatternSAM 定义 双 API 对比适用场景构建由 Lambda 支撑的 REST API或为函数提供 HTTP 端点。4.1 SAM 模板HTTP API 两个函数 DynamoDB以下模板完整定义了资源拓扑见 detailed-guide.md# template.yaml (SAM) AWSTemplateFormatVersion: 2010-09-09 Transform: AWS::Serverless-2016-10-31 Globals: Function: Runtime: nodejs20.x Timeout: 30 MemorySize: 256 Environment: Variables: TABLE_NAME: !Ref ItemsTable Resources: # HTTP API (recommended for simple use cases) HttpApi: Type: AWS::Serverless::HttpApi Properties: StageName: prod CorsConfiguration: AllowOrigins: - * AllowMethods: - GET - POST - DELETE AllowHeaders: - * # Lambda Functions GetItemFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/get.handler Events: GetItem: Type: HttpApi Properties: ApiId: !Ref HttpApi Path: /items/{id} Method: GET Policies: - DynamoDBReadPolicy: TableName: !Ref ItemsTable CreateItemFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/create.handler Events: CreateItem: Type: HttpApi Properties: ApiId: !Ref HttpApi Path: /items Method: POST Policies: - DynamoDBCrudPolicy: TableName: !Ref ItemsTable # DynamoDB Table ItemsTable: Type: AWS::DynamoDB::Table Properties: AttributeDefinitions: - AttributeName: id AttributeType: S KeySchema: - AttributeName: id KeyType: HASH BillingMode: PAY_PER_REQUEST Outputs: ApiUrl: Value: !Sub https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com/prod模板中有几个值得注意的设计决策Globals.Function统一函数运行时、超时、内存与环境变量避免重复声明DynamoDBReadPolicy/DynamoDBCrudPolicy是 SAM 内置的最小权限策略比手写 IAM 更贴合最小权限原则BillingMode: PAY_PER_REQUEST按量计费适合起步阶段免去吞吐量规划。4.2 对应的 Node.js handler路径参数通过event.pathParameters获取404 与 400 分支明确见 detailed-guide.md// src/handlers/get.js const { getItem } require(../lib/dynamodb); exports.handler async (event) { const id event.pathParameters?.id; if (!id) { return { statusCode: 400, body: JSON.stringify({ error: Missing id parameter }) }; } const item await getItem(id); if (!item) { return { statusCode: 404, body: JSON.stringify({ error: Item not found }) }; } return { statusCode: 200, body: JSON.stringify(item) }; };4.3 项目目录结构project/ ├── template.yaml # SAM template ├── src/ │ ├── handlers/ │ │ ├── get.js │ │ ├── create.js │ │ └── delete.js │ └── lib/ │ └── dynamodb.js └── events/ └── event.json # Test events4.4 HTTP API vs REST API 选型文档给出了明确的决策表见 detailed-guide.md维度HTTP APIREST API延迟更低约 10ms 级相对较高成本便宜 50%70%更高功能精简缓存、请求校验、WAF、用量计划、API Key、请求/响应转换适用绝大多数 REST API复杂 API、企业级功能需求结论简单用例默认选 HTTP API只有在需要 WAF 接入、请求验证、API Key 管理或转换能力时才升级到 REST API。五、核心模式三Event-Driven SQS Pattern可靠异步处理适用场景解耦的异步处理、需要重试与 DLQ、批量消费消息。5.1 SAM 模板队列 处理器 DLQ关键配置在VisibilityTimeout与RedrivePolicy上见 detailed-guide.md# template.yaml Resources: ProcessorFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/processor.handler Events: SQSEvent: Type: SQS Properties: Queue: !GetAtt ProcessingQueue.Arn BatchSize: 10 FunctionResponseTypes: - ReportBatchItemFailures # Partial batch failure handling ProcessingQueue: Type: AWS::SQS::Queue Properties: VisibilityTimeout: 180 # 6x Lambda timeout RedrivePolicy: deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn maxReceiveCount: 3 DeadLetterQueue: Type: AWS::SQS::Queue Properties: MessageRetentionPeriod: 1209600 # 14 days配置逻辑VisibilityTimeout 6 × Lambda 超时这里 Lambda 默认 30s队列设为 180s保证函数超时后消息重新可见maxReceiveCount 3消息被消费失败 3 次后进入 DLQMessageRetentionPeriod 1209600 秒14 天DLQ 消息最长保留两周等待人工/自动化处理。5.2 Node.jsReportBatchItemFailures 部分失败处理// src/handlers/processor.js exports.handler async (event) { const batchItemFailures []; for (const record of event.Records) { try { const body JSON.parse(record.body); await processMessage(body); } catch (error) { console.error(Failed to process message ${record.messageId}:, error); // Report this item as failed (will be retried) batchItemFailures.push({ itemIdentifier: record.messageId }); } } // Return failed items for retry return { batchItemFailures }; }; async function processMessage(message) { // Your processing logic console.log(Processing:, message); // Simulate work await saveToDatabase(message); }5.3 Python 等价实现import json import logging logger logging.getLogger() def handler(event, context): batch_item_failures [] for record in event[Records]: try: body json.loads(record[body]) process_message(body) except Exception as e: logger.error(fFailed to process {record[messageId]}: {e}) batch_item_failures.append({ itemIdentifier: record[messageId] }) return {batchItemFailures: batch_item_failures}5.4 最佳实践VisibilityTimeout设为 Lambda 超时的 6 倍使用ReportBatchItemFailures实现批内部分失败避免整批重试拖慢吞吐始终配置 DLQ 兜底毒消息消费逻辑必须幂等重试会导致同一消息被处理多次。六、核心模式四DynamoDB Streams Pattern数据变更驱动适用场景对数据变更的实时响应、跨区域复制、审计日志、通知。6.1 SAM 模板开启流的表 流处理器 失败队列# template.yaml Resources: ItemsTable: Type: AWS::DynamoDB::Table Properties: TableName: items AttributeDefinitions: - AttributeName: id AttributeType: S KeySchema: - AttributeName: id KeyType: HASH BillingMode: PAY_PER_REQUEST StreamSpecification: StreamViewType: NEW_AND_OLD_IMAGES StreamProcessorFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/stream.handler Events: Stream: Type: DynamoDB Properties: Stream: !GetAtt ItemsTable.StreamArn StartingPosition: TRIM_HORIZON BatchSize: 100 MaximumRetryAttempts: 3 DestinationConfig: OnFailure: Destination: !GetAtt StreamDLQ.Arn StreamDLQ: Type: AWS::SQS::Queue配置要点StartingPosition: TRIM_HORIZON表示从最早的未处理记录开始消费MaximumRetryAttempts: 3限制迭代器重试次数DestinationConfig.OnFailure把反复失败的批次投递到 DLQ避免 shard 卡死。6.2 Node.js 处理器按事件类型分派// src/handlers/stream.js exports.handler async (event) { for (const record of event.Records) { const eventName record.eventName; // INSERT, MODIFY, REMOVE // Unmarshall DynamoDB format to plain JS objects const newImage record.dynamodb.NewImage ? unmarshall(record.dynamodb.NewImage) : null; const oldImage record.dynamodb.OldImage ? unmarshall(record.dynamodb.OldImage) : null; console.log(${eventName}: , { newImage, oldImage }); switch (eventName) { case INSERT: await handleInsert(newImage); break; case MODIFY: await handleModify(oldImage, newImage); break; case REMOVE: await handleRemove(oldImage); break; } } }; // Use AWS SDK v3 unmarshall const { unmarshall } require(aws-sdk/util-dynamodb);6.3 StreamViewType 四档选择取值内容KEYS_ONLY仅键属性NEW_IMAGE修改后的整条记录OLD_IMAGE修改前的整条记录NEW_AND_OLD_IMAGES前后都有视图类型决定了流记录携带的数据量直接影响流的写入开销按业务需要最小化选择。七、核心模式五Cold Start Optimization Pattern冷启动优化适用场景延迟敏感应用、面向用户的 API、高流量函数。文档给出了 5 个递进手段见 detailed-guide.md。7.1 压缩部署包收益最大// Use modular AWS SDK v3 imports // GOOD - only imports what you need const { DynamoDBClient } require(aws-sdk/client-dynamodb); const { DynamoDBDocumentClient, GetCommand } require(aws-sdk/lib-dynamodb); // BAD - imports entire SDK const AWS require(aws-sdk); // Dont do this!7.2 Java/.NET 启用 SnapStartResources: JavaFunction: Type: AWS::Serverless::Function Properties: Handler: com.example.Handler::handleRequest Runtime: java21 SnapStart: ApplyOn: PublishedVersions # Enable SnapStart AutoPublishAlias: live7.3 上调内存换取 CPU# More memory more CPU faster init Resources: FastFunction: Type: AWS::Serverless::Function Properties: MemorySize: 1024 # 1GB gets full vCPU Timeout: 307.4 必要时启用预置并发Resources: CriticalFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/critical.handler AutoPublishAlias: live ProvisionedConcurrency: Type: AWS::Lambda::ProvisionedConcurrencyConfig Properties: FunctionName: !Ref CriticalFunction Qualifier: live ProvisionedConcurrentExecutions: 57.5 延迟初始化# GOOD - Lazy initialization _table None def get_table(): global _table if _table is None: dynamodb boto3.resource(dynamodb) _table dynamodb.Table(os.environ[TABLE_NAME]) return _table def handler(event, context): table get_table() # Only initializes on first use # ...7.6 优化优先级减小部署包影响最大Java/.NET 启用 SnapStart增大内存加速初始化延迟重依赖导入预置并发最后手段成本最高八、核心模式六SAM Local Development Pattern本地开发调试适用场景本地开发与测试、调试 Lambda、本地验证 API Gateway。8.1 完整命令流# Install SAM CLI pip install aws-sam-cli # Initialize new project sam init --runtime nodejs20.x --name my-api # Build the project sam build # Run locally sam local start-api # Invoke single function sam local invoke GetItemFunction --event events/get.json # Local debugging (Node.js with VS Code) sam local invoke --debug-port 5858 GetItemFunction # Deploy sam deploy --guided8.2 测试事件样例// events/get.json (test event) { pathParameters: { id: 123 }, httpMethod: GET, path: /items/123 }8.3 VS Code 远程调试配置// .vscode/launch.json (for debugging) { version: 0.2.0, configurations: [ { name: Attach to SAM CLI, type: node, request: attach, address: localhost, port: 5858, localRoot: ${workspaceRoot}/src, remoteRoot: /var/task/src, protocol: inspector } ] }8.4 命令速查命令作用sam build构建 Lambda 部署包sam local start-api本地启动 API Gatewaysam local invoke调用单个函数sam deploy部署到 AWSsam logs追踪 CloudWatch 日志九、核心模式七CDK Serverless Pattern基础设施即代码适用场景超出单个 Lambda 的复杂基础设施、偏好编程语言而非 YAML、需要可复用构造。9.1 TypeScript 栈定义// lib/api-stack.ts import * as cdk from aws-cdk-lib; import * as lambda from aws-cdk-lib/aws-lambda; import * as apigateway from aws-cdk-lib/aws-apigateway; import * as dynamodb from aws-cdk-lib/aws-dynamodb; import { Construct } from constructs; export class ApiStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // DynamoDB Table const table new dynamodb.Table(this, ItemsTable, { partitionKey: { name: id, type: dynamodb.AttributeType.STRING }, billingMode: dynamodb.BillingMode.PAY_PER_REQUEST, removalPolicy: cdk.RemovalPolicy.DESTROY, // For dev only }); // Lambda Function const getItemFn new lambda.Function(this, GetItemFunction, { runtime: lambda.Runtime.NODEJS_20_X, handler: get.handler, code: lambda.Code.fromAsset(src/handlers), environment: { TABLE_NAME: table.tableName, }, memorySize: 256, timeout: cdk.Duration.seconds(30), }); // Grant permissions table.grantReadData(getItemFn); // API Gateway const api new apigateway.RestApi(this, ItemsApi, { restApiName: Items Service, defaultCorsPreflightOptions: { allowOrigins: apigateway.Cors.ALL_ORIGINS, allowMethods: apigateway.Cors.ALL_METHODS, }, }); const items api.root.addResource(items); const item items.addResource({id}); item.addMethod(GET, new apigateway.LambdaIntegration(getItemFn)); // Output API URL new cdk.CfnOutput(this, ApiUrl, { value: api.url, }); } }9.2 CDK 常用命令npm install -g aws-cdk cdk init app --language typescript cdk synth # Generate CloudFormation cdk diff # Show changes cdk deploy # Deploy to AWSCDK vs SAM 的选择当基础设施复杂度超出 Lambda 本身需要自定义资源、跨栈共享、复杂路由时CDK 的编程式抽象和可复用 Construct 更具优势简单场景下 SAM 的声明式 YAML 上手更快。十、Sharp Edges生产环境 7 类高频陷阱该章节是本文档最有实战价值的部分按严重程度组织见 detailed-guide.md。10.1 冷启动 INIT 阶段开始计费2025 年 8 月起严重度HIGH现状自 2025 年 8 月 1 日起AWS 将 INIT 阶段按调用时长计费冷启动直接推高账单可能高出 10%50%受影响最大的是重依赖加载、慢初始化代码、频繁冷启动低流量或并发不足的函数。应对四步度量 INIT 时长——查看 CloudWatch Logs 中的INIT_REPORTINIT_REPORT Init Duration: 423.45 ms降低 INIT 耗时——精简部署包npm prune --production、tree shaking、延迟加载重依赖、使用 SDK v3 模块化导入。Java/.NET 启用 SnapStartResources: JavaFunction: Type: AWS::Serverless::Function Properties: Runtime: java21 SnapStart: ApplyOn: PublishedVersions监控冷启动频率——用自定义指标跟踪let isColdStart true; exports.handler async (event) { if (isColdStart) { console.log(COLD_START); // CloudWatch custom metric here isColdStart false; } // ... };10.2 Lambda 超时配置错误严重度HIGH事实基线默认超时仅 3 秒最大 900 秒。超时会导致函数被强制终止、无优雅退出、静默失败。常见诱因默认超时太短、下游服务变慢、VPC 网络问题、死循环/阻塞操作、S3 下载超过预期。应对超时设为预期时长 缓冲Resources: MyFunction: Type: AWS::Serverless::Function Properties: Timeout: 30 # Seconds (max 900)用context.getRemainingTimeInMillis()感知剩余时间接近超时先保存进度再优雅失败exports.handler async (event, context) { const remainingTime context.getRemainingTimeInMillis(); if (remainingTime 5000) { console.warn(Running low on time, aborting); throw new Error(Insufficient time remaining); } // ... };所有 HTTP 调用必须显式设置超时const response await axios.get(https://api.example.com/data, { timeout: 5000 // 5 seconds });10.3 内存溢出OOM崩溃严重度HIGH事实基线Lambda 超过内存上限会被 AWS 强制终止运行时且不会抛出可捕获异常——表现为日志截断、Max Memory Used触顶、高负载下行为不一致。应对上调内存12810240 MB且内存增大同时带来更多 CPUResources: MyFunction: Type: AWS::Serverless::Function Properties: MemorySize: 1024 # MB (128-10240)大文件改为流式处理避免整文件载入内存// BAD - loads entire file into memory const data await s3.getObject(params).promise(); const content data.Body.toString(); // GOOD - stream processing const { S3Client, GetObjectCommand } require(aws-sdk/client-s3); const s3 new S3Client({}); const response await s3.send(new GetObjectCommand(params)); const stream response.Body; // Process stream in chunks for await (const chunk of stream) { await processChunk(chunk); }使用 Lambda Power Tuning 工具定位最优内存档位。10.4 VPC 内 Lambda 冷启动延迟严重度MEDIUM事实基线VPC 内函数依赖弹性网络接口ENI即使 Hyperplane 大幅改善了 ENI 复用首次冷启动仍有额外开销NAT 网关问题、安全组误配、DNS 慢解析都会加剧。应对校验 VPC 配置安全组放行 443 出站子网覆盖多个可用区Resources: MyFunction: Type: AWS::Serverless::Function Properties: VpcConfig: SecurityGroupIds: - !Ref LambdaSecurityGroup SubnetIds: - !Ref PrivateSubnet1 - !Ref PrivateSubnet2 # Multiple AZs对 AWS 服务调用使用 VPC EndpointGateway 类型而非 NAT GatewayDynamoDBEndpoint: Type: AWS::EC2::VPCEndpoint Properties: ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb VpcId: !Ref VPC RouteTableIds: - !Ref PrivateRouteTable VpcEndpointType: Gateway只在确有必要时挂 VPC访问 RDS/ElastiCache、私有 EC2 或合规要求才需要大多数 AWS 服务无需 VPC 即可访问。10.5 Node.js 事件循环未清空严重度MEDIUM事实基线默认情况下 Lambda 等待 Node.js 事件循环清空才返回。残留的setTimeout/setInterval、悬空数据库连接、未决回调会让函数空转到超时白白计费。应对设置context.callbackWaitsForEmptyEventLoop false数据库连接显式关闭或使用连接池const connection await mysql.createConnection({...}); try { const [rows] await connection.query(SELECT * FROM users); return { statusCode: 200, body: JSON.stringify(rows) }; } finally { await connection.end(); // Always close }10.6 API Gateway 载荷大小限制严重度MEDIUM事实基线REST API 与 HTTP API 请求/响应上限均为 10 MBLambda 同步响应上限 6 MB、异步 256 KB。超出会出现413 Request Entity Too Large或Malformed Lambda proxy response。应对大文件上传用 S3 预签名 URL 直传大响应写入 S3 后返回预签名下载链接const { S3Client, PutObjectCommand } require(aws-sdk/client-s3); const { getSignedUrl } require(aws-sdk/s3-request-presigner); exports.handler async (event) { const s3 new S3Client({}); const command new PutObjectCommand({ Bucket: process.env.BUCKET_NAME, Key: uploads/${Date.now()}.file }); const uploadUrl await getSignedUrl(s3, command, { expiresIn: 300 }); return { statusCode: 200, body: JSON.stringify({ uploadUrl }) }; };10.7 无限循环或递归调用严重度HIGH典型自触发链路S3 触发器写回同一桶、DynamoDB 触发器更新同一张表、SNS 发布回触发自身的主题、Step Functions 错误处理不当。四道防线使用不同的桶/前缀并用前缀过滤触发Events: S3Event: Type: S3 Properties: Bucket: !Ref InputBucket Events: s3:ObjectCreated:* Filter: S3Key: Rules: - Name: prefix Value: uploads/ # Only trigger on uploads/幂等检查跳过已处理文件if (key.startsWith(processed/)) { console.log(Skipping already processed file:, key); continue; }设置保留并发作为熔断器Resources: RiskyFunction: Type: AWS::Serverless::Function Properties: ReservedConcurrentExecutions: 10 # Max 10 parallelCloudWatch 告警兜底InvocationAlarm: Type: AWS::CloudWatch::Alarm Properties: MetricName: Invocations Namespace: AWS/Lambda Statistic: Sum Period: 60 EvaluationPeriods: 1 Threshold: 1000 # Alert if 1000 invocations/min ComparisonOperator: GreaterThanThreshold十一、Validation Checks落地前的自动校验清单文档在交付前提供了一套分级校验规则见 detailed-guide.md可作为代码评审与 Agent 自检的量化标准检查项级别说明硬编码 AWS 凭证ERROR必须改用 IAM 角色或环境变量源码内出现 Secret KeyERROR改用 Secrets Manager 或环境变量IAM 策略过度授权WARNING避免通配权限遵循最小权限Handler 无错误处理WARNING必须加 try/catch 优雅降级缺少callbackWaitsForEmptyEventLoopINFONode.js 建议显式置 false默认 128MB 内存INFO许多负载建议上调超时仅 13 秒WARNING涉及外部调用必须提高未配置 DLQWARNING异步调用必须有死信队列整包导入 AWS SDK v2WARNING改用 SDK v3 模块化导入硬编码 DynamoDB 表名WARNING必须走环境变量这套清单与技能risk: critical的定位一致——它把面向失败设计最小权限配置外置这些原则落成了可机械执行的检查项。十二、协作边界何时转交其他技能当请求超出aws-serverless的范围时文档定义了明确的委托路径见 detailed-guide.md用户需求转交技能GCP Serverlessgcp-cloud-run容器 / Cloud Functions事件Azure Serverlessazure-functions数据库设计postgres-wizardRDS 设计或使用 DynamoDB 模式认证授权auth-specialistCognito、API Gateway authorizers复杂工作流workflow-automationStep Functions、EventBridgeAI 集成llm-architectLambda 调用 Bedrock 或外部 LLM这条映射表是 AAS 技能生态职责边界的典型示例aws-serverless只负责计算编排与事件管道本身数据库、认证、工作流、AI 能力交由更专精的技能承接避免职责重叠与上下文污染。十三、总结本文完整展开了aws-serverless技能的参考文档detailed-guide.md同时在仓库的 skills/aws-serverless/references/detailed-guide.md 存在同源副本覆盖了从设计原则、七种核心模式到七类生产陷阱、十项校验规则与跨技能协作边界的完整闭环。实践时的核心心法可以概括为三句话先度量再优化——INIT 时长、内存水位、冷启动频率都要以 CloudWatch 数据为准不要凭感觉配置面向失败设计——DLQ、重试、幂等、熔断保留并发四件套缺一不可配置外置、权限最小化——环境变量承载配置IAM 策略精确到表/桶这是校验清单里两条 ERROR 规则的直接要求。最后提醒技能自身明确要求输出不能替代环境特定验证见 SKILL.md任何模板落地到具体账号前请结合组织现有的 IAM 基线、网络拓扑与合规要求做最终适配。赞分享AI 技能AI 插件人工智能【免费下载链接】agentic-awesome-skillsAAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600 agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.项目地址https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills点击查看免费下载相关推荐ClawWork 实战产物解析基于 AWS Serverless 的联系表单后端Lambda API Gateway SES TerraformClawWork 实战产物解析基于 AWS Serverless 的联系表单后端Lambda API Gateway SES Terraform人工智能AI 评测AI AgentAgent 评测aws-node-shared-gateway 实战基于 Serverless Framework v4 搭建多个 Lambda 共享的 AWS API Gatewayaws node shared gateway 实战基于 Serverless Framework v4 搭建多个 Lambda 共享的 AWS API Ga示例工程基于 Serverless Framework v4 与 AWS Lambda 的 TypeScript HTTP API 实战指南基于 Serverless Framework v4 与 AWS Lambda 的 TypeScript HTTP API 实战指南 本指南围绕 example示例工程上一篇Claude for Office 清单生成完全指南用 build-manifest.mjs 定制企业级 Office 加载项清单下一篇electron-vue 内置 Vue 插件全解析axios、vue-electron、vue-router、vuex 与 vuex-electron 实战指南创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考 
长河君 · 2026/10/21 11:25:16 · 阅读 1.2k AWS Serverless 生产级实战指南：基于 AAS Core 技能库的 Lambda、API Gateway 与事件驱动模式详解
AI 技能AI 插件人工智能【免费下载链接】agentic-awesome-skillsAAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600 agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.项目地址https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills点击查看免费下载导读本文是 AASagentic-awesome-skills技能库中aws-serverless技能的核心参考文档detailed-guide.md的完整展开。该技能被 AAS Core 编目为cloud类目、critical风险等级的专项技能见 skills_index.json目标是指导 Agent 构建生产就绪的 AWS Serverless 应用。读完本文你将掌握 Lambda 处理器规范、API Gateway 集成、SQS/DynamoDB 事件驱动模式、SAM/CDK 双轨部署、冷启动优化以及 7 类生产环境高频陷阱的规避方案同时了解技能本身的安全约束与校验门禁。一、技能定位与使用边界aws-serverless技能的入口文件是 SKILL.md其 frontmatter 声明了名称aws-serverless范围Lambda 函数、API Gateway、DynamoDB、SQS/SNS 事件驱动模式、SAM/CDK 部署、冷启动优化风险等级critical意味着执行前必须完整读取本文档并遵守其中的安全与校验要求来源vibeship-spawner-skillsApache 2.0AAS Core 的目录索引将其归类到cloud大类skills_index.json并声明插件目标同时支持codex与claude两种 Agent 运行时且无需额外安装配置setup.type: none。技能自身明确了三项使用限制见 SKILL.md仅在任务与上述能力范围明确匹配时使用输出不能替代真实环境下的验证、测试与专家评审当缺少必要输入、权限、安全边界或成功标准时应停下来向用户澄清。这些约束提示我们本文是施工图纸而非验收报告——每段代码落地前仍需结合目标环境的 AWS 账号策略做适配。二、设计原则先度量再优化本文档开篇给出了 8 条贯穿全文的设计原则见 detailed-guide.md原则说明内存与超时按需配置先度量再优化不要盲目加大 MemorySize最小化冷启动对延迟敏感的工作负载优先处理冷启动路径Java/.NET 使用 SnapStart通过快照恢复绕开 JVM/CLR 初始化成本简单场景优先 HTTP API优先于 REST API成本与延迟都更优面向失败设计DLQ 重试机制缺一不可保持部署包精简减小包体是冷启动优化的第一优先级用环境变量做配置表名、桶名等不硬编码进代码结构化日志 关联 ID用 requestId 串联调用链支撑 CloudWatch Insights其中内存 CPU是一个容易被忽略的事实Lambda 的 CPU 算力随内存线性增长128 MB 只能拿到约 1/8 vCPU而 1024 MB 以上才能拿到完整 vCPU。这一机制会在后文的冷启动优化模式中反复体现。三、核心模式一Lambda Handler Pattern函数骨架规范适用场景任何 Lambda 函数实现——API 处理器、事件处理器、定时任务。3.1 Node.js 处理器骨架要点是把初始化移出 handler见 detailed-guide.md// handler.js // Initialize outside handler (reused across invocations) const { DynamoDBClient } require(aws-sdk/client-dynamodb); const { DynamoDBDocumentClient, GetCommand } require(aws-sdk/lib-dynamodb); const client new DynamoDBClient({}); const docClient DynamoDBDocumentClient.from(client); // Handler function exports.handler async (event, context) { // Optional: Dont wait for event loop to clear (Node.js) context.callbackWaitsForEmptyEventLoop false; try { // Parse input based on event source const body typeof event.body string ? JSON.parse(event.body) : event.body; // Business logic const result await processRequest(body); // Return API Gateway compatible response return { statusCode: 200, headers: { Content-Type: application/json, Access-Control-Allow-Origin: * }, body: JSON.stringify(result) }; } catch (error) { console.error(Error:, JSON.stringify({ error: error.message, stack: error.stack, requestId: context.awsRequestId })); return { statusCode: error.statusCode || 500, headers: { Content-Type: application/json }, body: JSON.stringify({ error: error.message || Internal server error }) }; } }; async function processRequest(data) { // Your business logic here const result await docClient.send(new GetCommand({ TableName: process.env.TABLE_NAME, Key: { id: data.id } })); return result.Item; }3.2 Python 处理器骨架同样的全局初始化 分层错误处理思路见 detailed-guide.md# handler.py import json import os import logging import boto3 from botocore.exceptions import ClientError # Initialize outside handler (reused across invocations) logger logging.getLogger() logger.setLevel(logging.INFO) dynamodb boto3.resource(dynamodb) table dynamodb.Table(os.environ[TABLE_NAME]) def handler(event, context): try: # Parse input body json.loads(event.get(body, {})) if isinstance(event.get(body), str) else event.get(body, {}) # Business logic result process_request(body) return { statusCode: 200, headers: { Content-Type: application/json, Access-Control-Allow-Origin: * }, body: json.dumps(result) } except ClientError as e: logger.error(fDynamoDB error: {e.response[Error][Message]}) return error_response(500, Database error) except json.JSONDecodeError: return error_response(400, Invalid JSON) except Exception as e: logger.error(fUnexpected error: {str(e)}, exc_infoTrue) return error_response(500, Internal server error) def process_request(data): response table.get_item(Key{id: data[id]}) return response.get(Item) def error_response(status_code, message): return { statusCode: status_code, headers: {Content-Type: application/json}, body: json.dumps({error: message}) }3.3 最佳实践要点客户端在 handler 之外初始化跨热调用复用连接始终返回符合 API Gateway 代理集成格式的响应statusCode/headers/body结构化 JSON 日志便于 CloudWatch Insights 查询错误日志中携带requestIdcontext.awsRequestId支撑跨服务追踪。四、核心模式二API Gateway Integration PatternSAM 定义 双 API 对比适用场景构建由 Lambda 支撑的 REST API或为函数提供 HTTP 端点。4.1 SAM 模板HTTP API 两个函数 DynamoDB以下模板完整定义了资源拓扑见 detailed-guide.md# template.yaml (SAM) AWSTemplateFormatVersion: 2010-09-09 Transform: AWS::Serverless-2016-10-31 Globals: Function: Runtime: nodejs20.x Timeout: 30 MemorySize: 256 Environment: Variables: TABLE_NAME: !Ref ItemsTable Resources: # HTTP API (recommended for simple use cases) HttpApi: Type: AWS::Serverless::HttpApi Properties: StageName: prod CorsConfiguration: AllowOrigins: - * AllowMethods: - GET - POST - DELETE AllowHeaders: - * # Lambda Functions GetItemFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/get.handler Events: GetItem: Type: HttpApi Properties: ApiId: !Ref HttpApi Path: /items/{id} Method: GET Policies: - DynamoDBReadPolicy: TableName: !Ref ItemsTable CreateItemFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/create.handler Events: CreateItem: Type: HttpApi Properties: ApiId: !Ref HttpApi Path: /items Method: POST Policies: - DynamoDBCrudPolicy: TableName: !Ref ItemsTable # DynamoDB Table ItemsTable: Type: AWS::DynamoDB::Table Properties: AttributeDefinitions: - AttributeName: id AttributeType: S KeySchema: - AttributeName: id KeyType: HASH BillingMode: PAY_PER_REQUEST Outputs: ApiUrl: Value: !Sub https://${HttpApi}.execute-api.${AWS::Region}.amazonaws.com/prod模板中有几个值得注意的设计决策Globals.Function统一函数运行时、超时、内存与环境变量避免重复声明DynamoDBReadPolicy/DynamoDBCrudPolicy是 SAM 内置的最小权限策略比手写 IAM 更贴合最小权限原则BillingMode: PAY_PER_REQUEST按量计费适合起步阶段免去吞吐量规划。4.2 对应的 Node.js handler路径参数通过event.pathParameters获取404 与 400 分支明确见 detailed-guide.md// src/handlers/get.js const { getItem } require(../lib/dynamodb); exports.handler async (event) { const id event.pathParameters?.id; if (!id) { return { statusCode: 400, body: JSON.stringify({ error: Missing id parameter }) }; } const item await getItem(id); if (!item) { return { statusCode: 404, body: JSON.stringify({ error: Item not found }) }; } return { statusCode: 200, body: JSON.stringify(item) }; };4.3 项目目录结构project/ ├── template.yaml # SAM template ├── src/ │ ├── handlers/ │ │ ├── get.js │ │ ├── create.js │ │ └── delete.js │ └── lib/ │ └── dynamodb.js └── events/ └── event.json # Test events4.4 HTTP API vs REST API 选型文档给出了明确的决策表见 detailed-guide.md维度HTTP APIREST API延迟更低约 10ms 级相对较高成本便宜 50%70%更高功能精简缓存、请求校验、WAF、用量计划、API Key、请求/响应转换适用绝大多数 REST API复杂 API、企业级功能需求结论简单用例默认选 HTTP API只有在需要 WAF 接入、请求验证、API Key 管理或转换能力时才升级到 REST API。五、核心模式三Event-Driven SQS Pattern可靠异步处理适用场景解耦的异步处理、需要重试与 DLQ、批量消费消息。5.1 SAM 模板队列 处理器 DLQ关键配置在VisibilityTimeout与RedrivePolicy上见 detailed-guide.md# template.yaml Resources: ProcessorFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/processor.handler Events: SQSEvent: Type: SQS Properties: Queue: !GetAtt ProcessingQueue.Arn BatchSize: 10 FunctionResponseTypes: - ReportBatchItemFailures # Partial batch failure handling ProcessingQueue: Type: AWS::SQS::Queue Properties: VisibilityTimeout: 180 # 6x Lambda timeout RedrivePolicy: deadLetterTargetArn: !GetAtt DeadLetterQueue.Arn maxReceiveCount: 3 DeadLetterQueue: Type: AWS::SQS::Queue Properties: MessageRetentionPeriod: 1209600 # 14 days配置逻辑VisibilityTimeout 6 × Lambda 超时这里 Lambda 默认 30s队列设为 180s保证函数超时后消息重新可见maxReceiveCount 3消息被消费失败 3 次后进入 DLQMessageRetentionPeriod 1209600 秒14 天DLQ 消息最长保留两周等待人工/自动化处理。5.2 Node.jsReportBatchItemFailures 部分失败处理// src/handlers/processor.js exports.handler async (event) { const batchItemFailures []; for (const record of event.Records) { try { const body JSON.parse(record.body); await processMessage(body); } catch (error) { console.error(Failed to process message ${record.messageId}:, error); // Report this item as failed (will be retried) batchItemFailures.push({ itemIdentifier: record.messageId }); } } // Return failed items for retry return { batchItemFailures }; }; async function processMessage(message) { // Your processing logic console.log(Processing:, message); // Simulate work await saveToDatabase(message); }5.3 Python 等价实现import json import logging logger logging.getLogger() def handler(event, context): batch_item_failures [] for record in event[Records]: try: body json.loads(record[body]) process_message(body) except Exception as e: logger.error(fFailed to process {record[messageId]}: {e}) batch_item_failures.append({ itemIdentifier: record[messageId] }) return {batchItemFailures: batch_item_failures}5.4 最佳实践VisibilityTimeout设为 Lambda 超时的 6 倍使用ReportBatchItemFailures实现批内部分失败避免整批重试拖慢吞吐始终配置 DLQ 兜底毒消息消费逻辑必须幂等重试会导致同一消息被处理多次。六、核心模式四DynamoDB Streams Pattern数据变更驱动适用场景对数据变更的实时响应、跨区域复制、审计日志、通知。6.1 SAM 模板开启流的表 流处理器 失败队列# template.yaml Resources: ItemsTable: Type: AWS::DynamoDB::Table Properties: TableName: items AttributeDefinitions: - AttributeName: id AttributeType: S KeySchema: - AttributeName: id KeyType: HASH BillingMode: PAY_PER_REQUEST StreamSpecification: StreamViewType: NEW_AND_OLD_IMAGES StreamProcessorFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/stream.handler Events: Stream: Type: DynamoDB Properties: Stream: !GetAtt ItemsTable.StreamArn StartingPosition: TRIM_HORIZON BatchSize: 100 MaximumRetryAttempts: 3 DestinationConfig: OnFailure: Destination: !GetAtt StreamDLQ.Arn StreamDLQ: Type: AWS::SQS::Queue配置要点StartingPosition: TRIM_HORIZON表示从最早的未处理记录开始消费MaximumRetryAttempts: 3限制迭代器重试次数DestinationConfig.OnFailure把反复失败的批次投递到 DLQ避免 shard 卡死。6.2 Node.js 处理器按事件类型分派// src/handlers/stream.js exports.handler async (event) { for (const record of event.Records) { const eventName record.eventName; // INSERT, MODIFY, REMOVE // Unmarshall DynamoDB format to plain JS objects const newImage record.dynamodb.NewImage ? unmarshall(record.dynamodb.NewImage) : null; const oldImage record.dynamodb.OldImage ? unmarshall(record.dynamodb.OldImage) : null; console.log(${eventName}: , { newImage, oldImage }); switch (eventName) { case INSERT: await handleInsert(newImage); break; case MODIFY: await handleModify(oldImage, newImage); break; case REMOVE: await handleRemove(oldImage); break; } } }; // Use AWS SDK v3 unmarshall const { unmarshall } require(aws-sdk/util-dynamodb);6.3 StreamViewType 四档选择取值内容KEYS_ONLY仅键属性NEW_IMAGE修改后的整条记录OLD_IMAGE修改前的整条记录NEW_AND_OLD_IMAGES前后都有视图类型决定了流记录携带的数据量直接影响流的写入开销按业务需要最小化选择。七、核心模式五Cold Start Optimization Pattern冷启动优化适用场景延迟敏感应用、面向用户的 API、高流量函数。文档给出了 5 个递进手段见 detailed-guide.md。7.1 压缩部署包收益最大// Use modular AWS SDK v3 imports // GOOD - only imports what you need const { DynamoDBClient } require(aws-sdk/client-dynamodb); const { DynamoDBDocumentClient, GetCommand } require(aws-sdk/lib-dynamodb); // BAD - imports entire SDK const AWS require(aws-sdk); // Dont do this!7.2 Java/.NET 启用 SnapStartResources: JavaFunction: Type: AWS::Serverless::Function Properties: Handler: com.example.Handler::handleRequest Runtime: java21 SnapStart: ApplyOn: PublishedVersions # Enable SnapStart AutoPublishAlias: live7.3 上调内存换取 CPU# More memory more CPU faster init Resources: FastFunction: Type: AWS::Serverless::Function Properties: MemorySize: 1024 # 1GB gets full vCPU Timeout: 307.4 必要时启用预置并发Resources: CriticalFunction: Type: AWS::Serverless::Function Properties: Handler: src/handlers/critical.handler AutoPublishAlias: live ProvisionedConcurrency: Type: AWS::Lambda::ProvisionedConcurrencyConfig Properties: FunctionName: !Ref CriticalFunction Qualifier: live ProvisionedConcurrentExecutions: 57.5 延迟初始化# GOOD - Lazy initialization _table None def get_table(): global _table if _table is None: dynamodb boto3.resource(dynamodb) _table dynamodb.Table(os.environ[TABLE_NAME]) return _table def handler(event, context): table get_table() # Only initializes on first use # ...7.6 优化优先级减小部署包影响最大Java/.NET 启用 SnapStart增大内存加速初始化延迟重依赖导入预置并发最后手段成本最高八、核心模式六SAM Local Development Pattern本地开发调试适用场景本地开发与测试、调试 Lambda、本地验证 API Gateway。8.1 完整命令流# Install SAM CLI pip install aws-sam-cli # Initialize new project sam init --runtime nodejs20.x --name my-api # Build the project sam build # Run locally sam local start-api # Invoke single function sam local invoke GetItemFunction --event events/get.json # Local debugging (Node.js with VS Code) sam local invoke --debug-port 5858 GetItemFunction # Deploy sam deploy --guided8.2 测试事件样例// events/get.json (test event) { pathParameters: { id: 123 }, httpMethod: GET, path: /items/123 }8.3 VS Code 远程调试配置// .vscode/launch.json (for debugging) { version: 0.2.0, configurations: [ { name: Attach to SAM CLI, type: node, request: attach, address: localhost, port: 5858, localRoot: ${workspaceRoot}/src, remoteRoot: /var/task/src, protocol: inspector } ] }8.4 命令速查命令作用sam build构建 Lambda 部署包sam local start-api本地启动 API Gatewaysam local invoke调用单个函数sam deploy部署到 AWSsam logs追踪 CloudWatch 日志九、核心模式七CDK Serverless Pattern基础设施即代码适用场景超出单个 Lambda 的复杂基础设施、偏好编程语言而非 YAML、需要可复用构造。9.1 TypeScript 栈定义// lib/api-stack.ts import * as cdk from aws-cdk-lib; import * as lambda from aws-cdk-lib/aws-lambda; import * as apigateway from aws-cdk-lib/aws-apigateway; import * as dynamodb from aws-cdk-lib/aws-dynamodb; import { Construct } from constructs; export class ApiStack extends cdk.Stack { constructor(scope: Construct, id: string, props?: cdk.StackProps) { super(scope, id, props); // DynamoDB Table const table new dynamodb.Table(this, ItemsTable, { partitionKey: { name: id, type: dynamodb.AttributeType.STRING }, billingMode: dynamodb.BillingMode.PAY_PER_REQUEST, removalPolicy: cdk.RemovalPolicy.DESTROY, // For dev only }); // Lambda Function const getItemFn new lambda.Function(this, GetItemFunction, { runtime: lambda.Runtime.NODEJS_20_X, handler: get.handler, code: lambda.Code.fromAsset(src/handlers), environment: { TABLE_NAME: table.tableName, }, memorySize: 256, timeout: cdk.Duration.seconds(30), }); // Grant permissions table.grantReadData(getItemFn); // API Gateway const api new apigateway.RestApi(this, ItemsApi, { restApiName: Items Service, defaultCorsPreflightOptions: { allowOrigins: apigateway.Cors.ALL_ORIGINS, allowMethods: apigateway.Cors.ALL_METHODS, }, }); const items api.root.addResource(items); const item items.addResource({id}); item.addMethod(GET, new apigateway.LambdaIntegration(getItemFn)); // Output API URL new cdk.CfnOutput(this, ApiUrl, { value: api.url, }); } }9.2 CDK 常用命令npm install -g aws-cdk cdk init app --language typescript cdk synth # Generate CloudFormation cdk diff # Show changes cdk deploy # Deploy to AWSCDK vs SAM 的选择当基础设施复杂度超出 Lambda 本身需要自定义资源、跨栈共享、复杂路由时CDK 的编程式抽象和可复用 Construct 更具优势简单场景下 SAM 的声明式 YAML 上手更快。十、Sharp Edges生产环境 7 类高频陷阱该章节是本文档最有实战价值的部分按严重程度组织见 detailed-guide.md。10.1 冷启动 INIT 阶段开始计费2025 年 8 月起严重度HIGH现状自 2025 年 8 月 1 日起AWS 将 INIT 阶段按调用时长计费冷启动直接推高账单可能高出 10%50%受影响最大的是重依赖加载、慢初始化代码、频繁冷启动低流量或并发不足的函数。应对四步度量 INIT 时长——查看 CloudWatch Logs 中的INIT_REPORTINIT_REPORT Init Duration: 423.45 ms降低 INIT 耗时——精简部署包npm prune --production、tree shaking、延迟加载重依赖、使用 SDK v3 模块化导入。Java/.NET 启用 SnapStartResources: JavaFunction: Type: AWS::Serverless::Function Properties: Runtime: java21 SnapStart: ApplyOn: PublishedVersions监控冷启动频率——用自定义指标跟踪let isColdStart true; exports.handler async (event) { if (isColdStart) { console.log(COLD_START); // CloudWatch custom metric here isColdStart false; } // ... };10.2 Lambda 超时配置错误严重度HIGH事实基线默认超时仅 3 秒最大 900 秒。超时会导致函数被强制终止、无优雅退出、静默失败。常见诱因默认超时太短、下游服务变慢、VPC 网络问题、死循环/阻塞操作、S3 下载超过预期。应对超时设为预期时长 缓冲Resources: MyFunction: Type: AWS::Serverless::Function Properties: Timeout: 30 # Seconds (max 900)用context.getRemainingTimeInMillis()感知剩余时间接近超时先保存进度再优雅失败exports.handler async (event, context) { const remainingTime context.getRemainingTimeInMillis(); if (remainingTime 5000) { console.warn(Running low on time, aborting); throw new Error(Insufficient time remaining); } // ... };所有 HTTP 调用必须显式设置超时const response await axios.get(https://api.example.com/data, { timeout: 5000 // 5 seconds });10.3 内存溢出OOM崩溃严重度HIGH事实基线Lambda 超过内存上限会被 AWS 强制终止运行时且不会抛出可捕获异常——表现为日志截断、Max Memory Used触顶、高负载下行为不一致。应对上调内存12810240 MB且内存增大同时带来更多 CPUResources: MyFunction: Type: AWS::Serverless::Function Properties: MemorySize: 1024 # MB (128-10240)大文件改为流式处理避免整文件载入内存// BAD - loads entire file into memory const data await s3.getObject(params).promise(); const content data.Body.toString(); // GOOD - stream processing const { S3Client, GetObjectCommand } require(aws-sdk/client-s3); const s3 new S3Client({}); const response await s3.send(new GetObjectCommand(params)); const stream response.Body; // Process stream in chunks for await (const chunk of stream) { await processChunk(chunk); }使用 Lambda Power Tuning 工具定位最优内存档位。10.4 VPC 内 Lambda 冷启动延迟严重度MEDIUM事实基线VPC 内函数依赖弹性网络接口ENI即使 Hyperplane 大幅改善了 ENI 复用首次冷启动仍有额外开销NAT 网关问题、安全组误配、DNS 慢解析都会加剧。应对校验 VPC 配置安全组放行 443 出站子网覆盖多个可用区Resources: MyFunction: Type: AWS::Serverless::Function Properties: VpcConfig: SecurityGroupIds: - !Ref LambdaSecurityGroup SubnetIds: - !Ref PrivateSubnet1 - !Ref PrivateSubnet2 # Multiple AZs对 AWS 服务调用使用 VPC EndpointGateway 类型而非 NAT GatewayDynamoDBEndpoint: Type: AWS::EC2::VPCEndpoint Properties: ServiceName: !Sub com.amazonaws.${AWS::Region}.dynamodb VpcId: !Ref VPC RouteTableIds: - !Ref PrivateRouteTable VpcEndpointType: Gateway只在确有必要时挂 VPC访问 RDS/ElastiCache、私有 EC2 或合规要求才需要大多数 AWS 服务无需 VPC 即可访问。10.5 Node.js 事件循环未清空严重度MEDIUM事实基线默认情况下 Lambda 等待 Node.js 事件循环清空才返回。残留的setTimeout/setInterval、悬空数据库连接、未决回调会让函数空转到超时白白计费。应对设置context.callbackWaitsForEmptyEventLoop false数据库连接显式关闭或使用连接池const connection await mysql.createConnection({...}); try { const [rows] await connection.query(SELECT * FROM users); return { statusCode: 200, body: JSON.stringify(rows) }; } finally { await connection.end(); // Always close }10.6 API Gateway 载荷大小限制严重度MEDIUM事实基线REST API 与 HTTP API 请求/响应上限均为 10 MBLambda 同步响应上限 6 MB、异步 256 KB。超出会出现413 Request Entity Too Large或Malformed Lambda proxy response。应对大文件上传用 S3 预签名 URL 直传大响应写入 S3 后返回预签名下载链接const { S3Client, PutObjectCommand } require(aws-sdk/client-s3); const { getSignedUrl } require(aws-sdk/s3-request-presigner); exports.handler async (event) { const s3 new S3Client({}); const command new PutObjectCommand({ Bucket: process.env.BUCKET_NAME, Key: uploads/${Date.now()}.file }); const uploadUrl await getSignedUrl(s3, command, { expiresIn: 300 }); return { statusCode: 200, body: JSON.stringify({ uploadUrl }) }; };10.7 无限循环或递归调用严重度HIGH典型自触发链路S3 触发器写回同一桶、DynamoDB 触发器更新同一张表、SNS 发布回触发自身的主题、Step Functions 错误处理不当。四道防线使用不同的桶/前缀并用前缀过滤触发Events: S3Event: Type: S3 Properties: Bucket: !Ref InputBucket Events: s3:ObjectCreated:* Filter: S3Key: Rules: - Name: prefix Value: uploads/ # Only trigger on uploads/幂等检查跳过已处理文件if (key.startsWith(processed/)) { console.log(Skipping already processed file:, key); continue; }设置保留并发作为熔断器Resources: RiskyFunction: Type: AWS::Serverless::Function Properties: ReservedConcurrentExecutions: 10 # Max 10 parallelCloudWatch 告警兜底InvocationAlarm: Type: AWS::CloudWatch::Alarm Properties: MetricName: Invocations Namespace: AWS/Lambda Statistic: Sum Period: 60 EvaluationPeriods: 1 Threshold: 1000 # Alert if 1000 invocations/min ComparisonOperator: GreaterThanThreshold十一、Validation Checks落地前的自动校验清单文档在交付前提供了一套分级校验规则见 detailed-guide.md可作为代码评审与 Agent 自检的量化标准检查项级别说明硬编码 AWS 凭证ERROR必须改用 IAM 角色或环境变量源码内出现 Secret KeyERROR改用 Secrets Manager 或环境变量IAM 策略过度授权WARNING避免通配权限遵循最小权限Handler 无错误处理WARNING必须加 try/catch 优雅降级缺少callbackWaitsForEmptyEventLoopINFONode.js 建议显式置 false默认 128MB 内存INFO许多负载建议上调超时仅 13 秒WARNING涉及外部调用必须提高未配置 DLQWARNING异步调用必须有死信队列整包导入 AWS SDK v2WARNING改用 SDK v3 模块化导入硬编码 DynamoDB 表名WARNING必须走环境变量这套清单与技能risk: critical的定位一致——它把面向失败设计最小权限配置外置这些原则落成了可机械执行的检查项。十二、协作边界何时转交其他技能当请求超出aws-serverless的范围时文档定义了明确的委托路径见 detailed-guide.md用户需求转交技能GCP Serverlessgcp-cloud-run容器 / Cloud Functions事件Azure Serverlessazure-functions数据库设计postgres-wizardRDS 设计或使用 DynamoDB 模式认证授权auth-specialistCognito、API Gateway authorizers复杂工作流workflow-automationStep Functions、EventBridgeAI 集成llm-architectLambda 调用 Bedrock 或外部 LLM这条映射表是 AAS 技能生态职责边界的典型示例aws-serverless只负责计算编排与事件管道本身数据库、认证、工作流、AI 能力交由更专精的技能承接避免职责重叠与上下文污染。十三、总结本文完整展开了aws-serverless技能的参考文档detailed-guide.md同时在仓库的 skills/aws-serverless/references/detailed-guide.md 存在同源副本覆盖了从设计原则、七种核心模式到七类生产陷阱、十项校验规则与跨技能协作边界的完整闭环。实践时的核心心法可以概括为三句话先度量再优化——INIT 时长、内存水位、冷启动频率都要以 CloudWatch 数据为准不要凭感觉配置面向失败设计——DLQ、重试、幂等、熔断保留并发四件套缺一不可配置外置、权限最小化——环境变量承载配置IAM 策略精确到表/桶这是校验清单里两条 ERROR 规则的直接要求。最后提醒技能自身明确要求输出不能替代环境特定验证见 SKILL.md任何模板落地到具体账号前请结合组织现有的 IAM 基线、网络拓扑与合规要求做最终适配。赞分享AI 技能AI 插件人工智能【免费下载链接】agentic-awesome-skillsAAS Core is the local, agent-first control plane for complete catalog discovery, agent-owned selection, stack validation, and planning, backed by 2,600 agentic skills. Includes CLI, local MCP, catalog, plugins, and Workbench.项目地址https://gitcode.com/GitHub_Trending/an/agentic-awesome-skills点击查看免费下载相关推荐ClawWork 实战产物解析基于 AWS Serverless 的联系表单后端Lambda API Gateway SES TerraformClawWork 实战产物解析基于 AWS Serverless 的联系表单后端Lambda API Gateway SES Terraform人工智能AI 评测AI AgentAgent 评测aws-node-shared-gateway 实战基于 Serverless Framework v4 搭建多个 Lambda 共享的 AWS API Gatewayaws node shared gateway 实战基于 Serverless Framework v4 搭建多个 Lambda 共享的 AWS API Ga示例工程基于 Serverless Framework v4 与 AWS Lambda 的 TypeScript HTTP API 实战指南基于 Serverless Framework v4 与 AWS Lambda 的 TypeScript HTTP API 实战指南 本指南围绕 example示例工程上一篇Claude for Office 清单生成完全指南用 build-manifest.mjs 定制企业级 Office 加载项清单下一篇electron-vue 内置 Vue 插件全解析axios、vue-electron、vue-router、vuex 与 vuex-electron 实战指南创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考