AWS Lambda

AWS Lambda is the AWS serverless compute service. Polysync uses the official AWS SDK for .NET v4 (AWSSDK.Lambda and AWSSDK.SecurityToken) to list functions, invoke them with a JSON event payload, parse output parameters from the response, and surface a direct link to the AWS Lambda console for monitoring.

Required attributes

• Region — the AWS region containing the Lambda function (e.g., us-east-1, ap-southeast-2). All Lambda API calls are region-scoped.

Optional platform-level defaults

• Invocation Type — RequestResponse (synchronous, default), Event (asynchronous fire-and-forget), or DryRun (validation only).
• Qualifier — a Lambda version number or alias (e.g., PROD, 1). Omit to invoke $LATEST.

Both can be overridden per Polysync Job. Precedence: job override → platform default → RequestResponse (no qualifier).

Authentication methods

• Web Identity Federation ⭐ (recommended for Polysync SaaS) — Polysync exchanges its Microsoft Entra ID workload identity token for short-lived AWS credentials via sts:AssumeRoleWithWebIdentity. No long-lived secrets stored. Required attributes: Role ARN.
  • In AWS, create an IAM Identity Provider (OIDC) trusting Polysync's Entra ID issuer (https://login.microsoftonline.com/<polysync-tenant-id>/v2.0) with audience sts.amazonaws.com.
  • Create an IAM role whose trust policy allows sts:AssumeRoleWithWebIdentity from that provider with a condition on the Polysync workload identity's sub/oid claim.
• Access Key — Provide Access Key Id, Secret Access Key, and optionally Session Token. Simplest, but the secret must be rotated and stored in a Secret Vault.
• Assume Role — Provide a bootstrap Access Key Id and Secret Access Key, plus the Role ARN to assume. The bootstrap user only needs sts:AssumeRole on the target role; the assumed role holds the Lambda permissions.
• Instance Profile — Uses the host EC2/ECS instance profile. Only viable when Polysync is deployed inside AWS.

IAM permissions checklist

The role / user used to call Lambda must hold (at minimum):

• lambda:ListFunctions — discover available functions.
• lambda:GetFunction — read function metadata (name, description, qualifier).
• lambda:InvokeFunction — invoke functions (scope to specific function ARNs in production).

Plus any IAM permissions the Lambda execution role needs to access downstream AWS services (defined on the Lambda's role, not the Polysync caller).

Supported jobs

• AWS Lambda Function — invokes a Lambda function with a JSON event payload built from Polysync parameters, and (for synchronous invocations) populates output parameters from the response.

Troubleshooting

• Web Identity Federation InvalidIdentityToken — check that the IAM Identity Provider's thumbprint matches login.microsoftonline.com, the audience is sts.amazonaws.com, and the role trust policy allows the Polysync workload identity's sub / oid.
• AccessDeniedException on listing functions — the caller is missing lambda:ListFunctions in the target region.