New pattern - lambda-managed-instances-bedrock-cdk by NithinChandranR-AWS · Pull Request #3076 · aws-samples/serverless-patterns

NithinChandranR-AWS · 2026-04-24T04:46:37Z

New Serverless Pattern: Lambda Managed Instances + Bedrock (CDK)

Description

Deploys a Lambda function on Managed Instances (EC2-backed compute) that invokes Amazon Bedrock (Claude) for text generation. Demonstrates a real-world Bedrock use case beyond the existing hello-world Managed Instances pattern.

Architecture

User → Lambda Function (on Managed Instances / EC2)
         ├── VPC with private subnets
         ├── CapacityProvider (ARM64 / Graviton)
         └── Bedrock InvokeModel → Claude response

Key Features

EC2-backed Lambda: Runs on dedicated EC2 instances with Graviton ARM64 architecture
VPC integration: Private subnets with NAT Gateway for Bedrock API access
Least-privilege IAM: Bedrock permissions scoped to inference profile ARN
Production-ready: 2048 MB memory (Managed Instances minimum), nodejs24.x runtime, CloudWatch logging

Bugs Found & Fixed During Deploy

Managed Instances require memorySize >= 2048 MB (not the default 128 MB)
Managed Instances require nodejs24.x runtime (not nodejs22.x)
Function architecture: ARM_64 must match CapacityProvider architecture

Deployed & Tested ✅

Deployed to a live AWS account and tested end-to-end. Bedrock (Claude) returned a valid response via Lambda on Managed Instances.

Files

lib/lambda-managed-instances-bedrock-stack.ts — CDK stack
src/index.js — Lambda handler (Bedrock invocation)
example-pattern.json — Pattern metadata
README.md — Full documentation with architecture, deploy, and test instructions

Deploy Lambda on EC2-backed Managed Instances with Bedrock (Claude) integration. Uses CapacityProvider L2 construct with ARM64 architecture, VPC with private subnets, and least-privilege IAM scoped to inference profile ARN. Differentiates from existing hello-world pattern by demonstrating a real-world Bedrock invocation use case on Managed Instances.

NithinChandranR-AWS · 2026-04-30T03:57:21Z

Hi @biswanathmukherjee 👋 Friendly nudge — this pattern is ready for review. Deployed and tested end-to-end on a live AWS account. Would appreciate a look when you have time. Thank you!

NithinChandranR-AWS · 2026-05-08T04:02:08Z

Hi @biswanathmukherjee 👋 This shows Lambda Managed Instances (April 2026 GA) — a brand new compute mode where Lambda runs on customer-chosen EC2 instance types (Graviton). First real-world pattern beyond hello-world. Unique service integration.

NithinChandranR-AWS · 2026-05-18T07:04:46Z

Hi @bfreiberg 👋 — friendly nudge on this pattern. It's been deployed and tested end-to-end on a live AWS account. Happy to address any feedback. Thank you!

parikhudit · 2026-05-26T10:18:32Z

+        actions: ["bedrock:InvokeModel"],
+        resources: [
+          `arn:aws:bedrock:${this.region}:${this.account}:inference-profile/${modelId.valueAsString}`,
+          "arn:aws:bedrock:*::foundation-model/*",
+        ],
+      })
+    );
+


Bedrock IAM resource list is too broad. arn:aws:bedrock:*::foundation-model/* permits InvokeModel against every foundation model in every region.
For the default cross-region inference profile us.anthropic.claude-sonnet-4-20250514-v1:0, scope to the destination regions only.

Good point -- scoped it down to the three US regions that the cross-region inference profile routes to (us-east-1, us-east-2, us-west-2) instead of the wildcard.

parikhudit · 2026-05-26T10:19:07Z

+    capacityProvider.addFunction(fn);
+
+    new cdk.CfnOutput(this, "FunctionName", { value: fn.functionName });
+    new cdk.CfnOutput(this, "FunctionArn", { value: fn.functionArn });


The function will not become ACTIVE on the capacity provider until a version is published. Per https://docs.aws.amazon.com/lambda/latest/dg/lambda-managed-instances-getting-started.html step 5: "To run your function on Lambda Managed Instances, you must publish a version."

Without this, cdk deploy may succeed but aws lambda invoke could return the in-place $LATEST and will not execute on Managed Instances.

You're right -- added fn.currentVersion + a prod alias. Without a published version the function stays on $LATEST and won't actually run on the capacity provider.

parikhudit · 2026-05-26T10:21:15Z

+    });
+
+    const capacityProvider = new lambda.CapacityProvider(this, "CapacityProvider", {
+      capacityProviderName: "bedrock-capacity-provider",


capacityProviderName: "bedrock-capacity-provider" is hardcoded. Capacity-provider names must be unique per account/region (validateCapacityProviderName in the CDK source). The same stack deployed twice in one account will fail. Drop the explicit name (CDK will generate one) or prefix with the stack name.

Makes sense -- dropped the hardcoded name, letting CDK generate a unique one.

parikhudit · 2026-05-26T10:22:48Z

+    const vpc = new ec2.Vpc(this, "ManagedInstancesVpc", {
+      maxAzs: 2,
+      natGateways: 1,
+    });
+


The VPC creates a NAT gateway and Bedrock traffic egresses through it. Adding interface endpoints removes the NAT requirement and keeps Bedrock traffic on the AWS network.
If endpoints are intentionally omitted to keep the example minimal, please call out the NAT trade-off in the README.

Keeping it minimal intentionally -- added a note in the README calling out the NAT trade-off and recommending a Bedrock VPC endpoint for production.

parikhudit · 2026-05-26T10:23:58Z

+const { BedrockRuntimeClient, InvokeModelCommand } = require("@aws-sdk/client-bedrock-runtime");
+
+const client = new BedrockRuntimeClient();
+const MODEL_ID = process.env.MODEL_ID;


If MODEL_ID is unset the handler would proceed with undefined and the SDK call would fail with an opaque ValidationException. Should fail fast at module load?

Agreed -- added a throw at module load so it fails immediately with a clear message instead of a cryptic SDK error.

parikhudit · 2026-05-26T10:25:21Z

+exports.handler = async (event) => {
+  const prompt = event.prompt || "What are the benefits of Lambda Managed Instances?";
+
+  const res = await client.send(


Missing exception handling in case of failed SDK calls

parikhudit · 2026-05-26T10:27:14Z

+## Architecture
+
+```
+User → Lambda Function (on Managed Instances / EC2)
+         ├── VPC with private subnets
+         ├── CapacityProvider (ARM64)
+         └── Bedrock InvokeModel → Claude response
+```


Folder structure is not architecture

Fair -- replaced with a proper flow diagram showing Client → Lambda (Managed Instances) → Bedrock.

parikhudit · 2026-05-26T10:27:33Z

+```bash
+aws lambda invoke \
+  --function-name managed-instances-bedrock-cdk \
+  --payload '{"prompt":"Explain Lambda Managed Instances in 3 sentences"}' \
+  --cli-binary-format raw-in-base64-out \
+  output.json && cat output.json | python3 -m json.tool
+```


If the stack publishes a version (recommended in another comment), this invoke should target the published version

Updated the invoke command to target the prod alias with --qualifier prod.

- Narrowed foundation-model/* wildcard to specific us-east-1/us-east-2/ us-west-2 regions for the default Claude Sonnet inference profile - Added published version + alias (required for Managed Instances execution per docs step 5)

julianwood assigned julianwood and parikhudit Apr 24, 2026

parikhudit reviewed May 26, 2026

View reviewed changes

NithinChandranR-AWS force-pushed the NithinChandranR-AWS-feature-lambda-managed-instances-bedrock-cdk branch from 30b480a to 021c5ee Compare May 26, 2026 10:34

Conversation

NithinChandranR-AWS commented Apr 24, 2026

New Serverless Pattern: Lambda Managed Instances + Bedrock (CDK)

Description

Architecture

Key Features

Bugs Found & Fixed During Deploy

Deployed & Tested ✅

Files

Uh oh!

NithinChandranR-AWS commented Apr 30, 2026

Uh oh!

NithinChandranR-AWS commented May 8, 2026

Uh oh!

NithinChandranR-AWS commented May 18, 2026

Uh oh!

parikhudit May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

parikhudit May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

parikhudit May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

parikhudit May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

parikhudit May 26, 2026 •

edited

Loading

parikhudit May 26, 2026 •

edited

Loading

parikhudit May 26, 2026 •

edited

Loading

parikhudit May 26, 2026 •

edited

Loading