AWS Lambda

Trestle invokes selected Lambda functions asynchronously from committed event jobs. User code never executes in the Trestle process.

Credentials

TRESTLE_AWS_REGION=us-east-1
TRESTLE_AWS_ACCESS_KEY=...
TRESTLE_AWS_SECRET_KEY=...

Use a narrowly scoped IAM principal permitted to invoke only the configured function ARNs. Credentials remain process configuration and are represented in the dashboard only as configured or missing.

Target policy

Each target must be an AWS Lambda ARN whose embedded region matches its configured region. Trestle constructs the official regional HTTPS endpoint and signs the request with SigV4.

Acceptance versus completion

Lambda's 202 Accepted confirms provider acceptance, not successful function completion. Trestle marks the invocation job delivered at acceptance. Function logs, destinations or callbacks must report application completion separately.

Idempotency

The envelope includes a stable invocation ID. Functions must deduplicate it because at-least-once job recovery can repeat an accepted request after an ambiguous failure.