Serverless Functions: From Development to Production

Serverless functions let you run code without managing servers. Pay only for execution time, scale automatically, and focus on business logic.

AWS Lambda Basics#

import { APIGatewayProxyHandler, APIGatewayProxyResult } from 'aws-lambda';

export const handler: APIGatewayProxyHandler = async (event) => {
  try {
    const body = JSON.parse(event.body || '{}');

    const result = await processData(body);

    return {
      statusCode: 200,
      headers: {
        'Content-Type': 'application/json',
        'Access-Control-Allow-Origin': '*',
      },
      body: JSON.stringify(result),
    };
  } catch (error) {
    console.error('Error:', error);

    return {
      statusCode: 500,
      body: JSON.stringify({ error: 'Internal server error' }),
    };
  }
};

// Typed handler helper
function createHandler<T, R>(
  fn: (input: T, event: APIGatewayProxyEvent) => Promise<R>
): APIGatewayProxyHandler {
  return async (event) => {
    try {
      const input = JSON.parse(event.body || '{}') as T;
      const result = await fn(input, event);

      return {
        statusCode: 200,
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(result),
      };
    } catch (error) {
      if (error instanceof ValidationError) {
        return {
          statusCode: 400,
          body: JSON.stringify({ error: error.message }),
        };
      }

      console.error('Unhandled error:', error);
      return {
        statusCode: 500,
        body: JSON.stringify({ error: 'Internal server error' }),
      };
    }
  };
}

// Usage
interface CreateUserInput {
  email: string;
  name: string;
}

export const createUser = createHandler<CreateUserInput, User>(async (input) => {
  const validated = createUserSchema.parse(input);
  return userService.create(validated);
});

Vercel Serverless Functions#

// api/users/[id].ts
import type { VercelRequest, VercelResponse } from '@vercel/node';

export default async function handler(
  req: VercelRequest,
  res: VercelResponse
) {
  const { id } = req.query;

  switch (req.method) {
    case 'GET':
      const user = await getUser(id as string);
      return res.json(user);

    case 'PUT':
      const updated = await updateUser(id as string, req.body);
      return res.json(updated);

    case 'DELETE':
      await deleteUser(id as string);
      return res.status(204).end();

    default:
      res.setHeader('Allow', ['GET', 'PUT', 'DELETE']);
      return res.status(405).end(`Method ${req.method} Not Allowed`);
  }
}

Vercel Edge Functions#

// app/api/geo/route.ts
import { NextRequest } from 'next/server';

export const runtime = 'edge';

export async function GET(request: NextRequest) {
  const country = request.geo?.country || 'Unknown';
  const city = request.geo?.city || 'Unknown';

  return Response.json({
    country,
    city,
    message: `Hello from ${city}, ${country}!`,
  });
}

// Edge function with streaming
export async function POST(request: NextRequest) {
  const body = await request.json();

  const stream = new ReadableStream({
    async start(controller) {
      for await (const chunk of generateResponse(body.prompt)) {
        controller.enqueue(new TextEncoder().encode(chunk));
      }
      controller.close();
    },
  });

  return new Response(stream, {
    headers: {
      'Content-Type': 'text/event-stream',
      'Cache-Control': 'no-cache',
    },
  });
}

Cold Start Optimization#

// Initialize outside handler for connection reuse
import { PrismaClient } from '@prisma/client';

// Reused across invocations
const prisma = new PrismaClient();

export const handler = async (event: APIGatewayProxyEvent) => {
  // Connection already established
  const users = await prisma.user.findMany();
  return { statusCode: 200, body: JSON.stringify(users) };
};

// Lazy initialization
let dbConnection: Database | null = null;

async function getDb(): Promise<Database> {
  if (!dbConnection) {
    dbConnection = await createConnection();
  }
  return dbConnection;
}

// Provisioned concurrency for critical functions
// serverless.yml
/*
functions:
  api:
    handler: handler.main
    provisionedConcurrency: 5
*/

Environment and Secrets#

// Use environment variables
const config = {
  dbUrl: process.env.DATABASE_URL!,
  apiKey: process.env.API_KEY!,
  environment: process.env.NODE_ENV || 'development',
};

// Validate at startup
function validateEnv() {
  const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];

  for (const key of required) {
    if (!process.env[key]) {
      throw new Error(`Missing required environment variable: ${key}`);
    }
  }
}

// AWS Secrets Manager for sensitive data
import { SecretsManager } from '@aws-sdk/client-secrets-manager';

const secretsManager = new SecretsManager({});
let cachedSecrets: Record<string, string> | null = null;

async function getSecrets(): Promise<Record<string, string>> {
  if (cachedSecrets) return cachedSecrets;

  const response = await secretsManager.getSecretValue({
    SecretId: process.env.SECRET_ID,
  });

  cachedSecrets = JSON.parse(response.SecretString!);
  return cachedSecrets;
}

Request Validation#

import { z } from 'zod';

const createOrderSchema = z.object({
  customerId: z.string().uuid(),
  items: z.array(
    z.object({
      productId: z.string(),
      quantity: z.number().min(1),
    })
  ).min(1),
  shippingAddress: z.object({
    street: z.string(),
    city: z.string(),
    country: z.string(),
    postalCode: z.string(),
  }),
});

export const createOrder = createHandler(async (event) => {
  const body = JSON.parse(event.body || '{}');

  // Validate input
  const result = createOrderSchema.safeParse(body);

  if (!result.success) {
    return {
      statusCode: 400,
      body: JSON.stringify({
        error: 'Validation failed',
        details: result.error.flatten(),
      }),
    };
  }

  const order = await orderService.create(result.data);

  return {
    statusCode: 201,
    body: JSON.stringify(order),
  };
});

Error Handling#

class AppError extends Error {
  constructor(
    message: string,
    public statusCode: number = 500,
    public code?: string
  ) {
    super(message);
    this.name = 'AppError';
  }
}

class NotFoundError extends AppError {
  constructor(resource: string) {
    super(`${resource} not found`, 404, 'NOT_FOUND');
  }
}

class ValidationError extends AppError {
  constructor(message: string) {
    super(message, 400, 'VALIDATION_ERROR');
  }
}

// Error handling wrapper
function withErrorHandling(
  handler: (event: APIGatewayProxyEvent) => Promise<any>
): APIGatewayProxyHandler {
  return async (event) => {
    try {
      const result = await handler(event);
      return {
        statusCode: 200,
        body: JSON.stringify(result),
      };
    } catch (error) {
      console.error('Error:', error);

      if (error instanceof AppError) {
        return {
          statusCode: error.statusCode,
          body: JSON.stringify({
            error: error.message,
            code: error.code,
          }),
        };
      }

      return {
        statusCode: 500,
        body: JSON.stringify({
          error: 'Internal server error',
          code: 'INTERNAL_ERROR',
        }),
      };
    }
  };
}

Middleware Pattern#

type Middleware = (
  handler: APIGatewayProxyHandler
) => APIGatewayProxyHandler;

// CORS middleware
const cors: Middleware = (handler) => async (event, context, callback) => {
  const response = await handler(event, context, callback);

  if (response && typeof response === 'object') {
    return {
      ...response,
      headers: {
        ...response.headers,
        'Access-Control-Allow-Origin': '*',
        'Access-Control-Allow-Methods': 'GET,POST,PUT,DELETE,OPTIONS',
        'Access-Control-Allow-Headers': 'Content-Type,Authorization',
      },
    };
  }

  return response;
};

// Auth middleware
const requireAuth: Middleware = (handler) => async (event, context, callback) => {
  const token = event.headers.Authorization?.replace('Bearer ', '');

  if (!token) {
    return {
      statusCode: 401,
      body: JSON.stringify({ error: 'Unauthorized' }),
    };
  }

  try {
    const user = await verifyToken(token);
    (event as any).user = user;
    return handler(event, context, callback);
  } catch {
    return {
      statusCode: 401,
      body: JSON.stringify({ error: 'Invalid token' }),
    };
  }
};

// Compose middleware
function compose(...middlewares: Middleware[]): Middleware {
  return (handler) =>
    middlewares.reduceRight((h, middleware) => middleware(h), handler);
}

// Usage
export const handler = compose(cors, requireAuth)(async (event) => {
  const user = (event as any).user;
  return { message: `Hello ${user.name}` };
});

Testing Serverless Functions#

import { handler } from './handler';

describe('createUser handler', () => {
  it('creates user with valid input', async () => {
    const event = {
      body: JSON.stringify({
        email: 'test@example.com',
        name: 'Test User',
      }),
      headers: { 'Content-Type': 'application/json' },
    } as APIGatewayProxyEvent;

    const response = await handler(event, {} as any, () => {});

    expect(response.statusCode).toBe(201);
    const body = JSON.parse(response.body);
    expect(body.email).toBe('test@example.com');
  });

  it('returns 400 for invalid input', async () => {
    const event = {
      body: JSON.stringify({ email: 'invalid' }),
      headers: {},
    } as APIGatewayProxyEvent;

    const response = await handler(event, {} as any, () => {});

    expect(response.statusCode).toBe(400);
  });
});

Deployment#

# serverless.yml
service: my-api

provider:
  name: aws
  runtime: nodejs18.x
  region: us-east-1
  environment:
    DATABASE_URL: ${ssm:/my-app/database-url}

functions:
  api:
    handler: dist/handler.main
    events:
      - httpApi:
          path: /{proxy+}
          method: any
    memorySize: 512
    timeout: 10

plugins:
  - serverless-esbuild

Best Practices#

Performance:
✓ Initialize outside handler
✓ Use connection pooling
✓ Keep functions small
✓ Set appropriate timeouts

Security:
✓ Validate all inputs
✓ Use secrets manager
✓ Implement proper auth
✓ Set least-privilege IAM

Cost:
✓ Optimize memory settings
✓ Use provisioned concurrency wisely
✓ Monitor execution duration
✓ Clean up resources

Conclusion#

Serverless functions simplify deployment and scaling. Focus on cold start optimization, proper error handling, and security. Test locally with tools like SAM or serverless-offline before deploying.

Share this article