TL;DR
- AWS Lambda Web Functions are a Lambda function type that runs a standard HTTP server listening on a port, so a framework such as Express, Fastify or Hono deploys with no adapter layer in front of it.
- AWS shipped them in October 2026 as a second function type alongside event functions, on the same Firecracker isolation, and its weekly roundup of 19 October 2026 counts three form factors with MicroVMs.
- The concurrency ceiling is the headline number: up to 128 concurrent requests share one execution environment, the default is 64, and the endpoint also caps requests per second so excess traffic receives HTTP 429 with no queue behind it.
- Billing meters requests, consumed memory and CPU time: in the post's own demo a hashing loop burns about 1.5 seconds of CPU and the chart falls back to near zero while the process keeps waiting.
- The measured sample gives the ceiling operational context: 300 streaming requests with up to 200 open, one environment peaking at 59 connections, five environments in use, and about 4.8 seconds of CPU across 484 requests.
- Plan around the launch limits: Node.js 24 on Arm64 only, 2 vCPUs and 2 GB per environment, no session affinity, so sessions and state belong in a store outside the function.
AWS published Exploring AWS Lambda Web Functions for building web applications on 13 October 2026, signed by Julian Wood, Kim Wendt and Samrat Karak. The premise is a change in what a Lambda function is. For a decade the unit of code was a handler that received an event; a Web Function is a process that listens on a port, which is what lets an ordinary framework run inside Lambda untouched.
The deployment story is deliberately small. One command, or CloudFormation, builds the code, creates the function, creates an endpoint with an HTTPS domain, and returns a live URL. It also creates an execution role and a versioned S3 bucket that CLI-deployed functions in the region share.
A port listener replaces the event handler
The difference matters at the boundary. An event function is invoked, runs, and freezes; a web function stays alive as a process and keeps answering, and the post is explicit about what that enables: response streaming that holds a connection open, background work outside the main request path, and frameworks that were written for a server process, which is what a web function now provides.
Endpoints carry the routing. Each one has a domain, an authentication type and routing rules, and revisions are immutable snapshots of code plus configuration, so a rollback is a routing change to an earlier revision. The authentication choice is a single field: a public endpoint where the application handles OAuth, JWT or a session cookie itself, or an IAM endpoint where Lambda validates SigV4 on single-region endpoints and SigV4a on multi-region ones.
Concurrency is the number that changes the bill
The setting that matters most is per-environment concurrency: as many as 128 simultaneous requests handled by one execution environment, with a default of 64. Lambda adds environments as an existing one approaches its limit and removes them when traffic falls, and the endpoint carries its own requests-per-second cap. Traffic above that cap receives HTTP 429 and queues nowhere.
Read that as a shedding policy with a scaling side. For a small team, a hard 429 with a documented cap makes the shedding rule explicit; an unbounded queue can turn a slow dependency into a timeout cascade. The cap also protects what sits behind the function, which in most applications is a database with its own connection limit.
What the sample run measured
The post puts the ceiling into operational context: it runs 300 streaming requests with up to 200 open at once and then queries the platform logs for the result. One environment peaked at 59 connections, near the default limit of 64, and the load used five environments in total. Across 484 requests, the whole fleet consumed about 4.8 seconds of CPU.
The comparison is the interesting part. An event function serves one request at a time, as the post states: "An Event Function environment serves one request at a time." Two hundred open streams under that model would occupy up to 200 environments. Under the web model they occupy five, and each environment reports only its own connections because Lambda routes requests independently with no session affinity.
Waiting costs memory, computing costs CPU
The billing model separates three meters: requests, consumed memory, and CPU time. A process that stays alive for minutes pays for the memory it holds and for the CPU it actually uses, and the post demonstrates the split with a deliberate hashing loop: CPU time climbs for about 1.5 seconds and falls back to near zero afterwards while the environment stays up.
That is the argument for keeping a slow backend on Lambda. When a request waits on a database, an external API or an inference call, the wait consumes almost no CPU, so the expensive part of a long-lived connection is memory, and time is cheap. Applications that stream results to a browser fit this shape well, and CPU-bound work does not: a compression job or a local model pays for the compute it uses, and a long-lived environment offers it no discount.
Sessions and state live outside the function
No session affinity is a design constraint with operational consequences. Two requests from the same user can land in different environments, so an in-memory cart, a per-process rate limiter or a cached permission check will behave differently from how it behaved on a server behind a sticky load balancer. State moves to a store the function reaches over the network, and that store becomes the thing to provision, monitor and back up.
The same rule applies to the background work the post mentions. A process that can do work outside the request path is a real capability, and it runs inside an environment that can be removed when traffic falls. Anything that must survive that removal belongs in a durable queue or a database row, which is the same discipline any serverless background job needs.
Cost comparison before a migration usually starts with compute hours, and a runtime that bills CPU time while holding memory rewrites that line item. This is where DevOps pipelines and managed monitoring meet the same question from the deployment side: what the pipeline ships changes what the bill meters.
The launch limits to plan around
At launch the runtime is Node.js 24 on Arm64, each environment gets 2 vCPUs and 2 GB of memory, and functions can reach resources inside a VPC. Multi-region endpoints replicate code and revision configuration to each region and centralise logs in a home region, with one global domain and latency-based routing.
AWS measured that routing from a laptop in the United Kingdom: 16 ms to the London region and 90 ms to the Northern Virginia region on a single-region endpoint. The post labels the pair as single measurements from one location and declines to call it a benchmark, which is the honest way to read them: a direction, with no distribution behind it.
For a team evaluating whether to move a small API onto this, the useful test is narrow. Pick one endpoint that streams, hold a few hundred connections open, read the platform logs for environment count and peak concurrency, and compare CPU seconds with the wall-clock time the requests occupied. That ratio tells you whether the workload belongs here, and it takes an afternoon to measure.
Originally published on the Netics blog.
