AWS rolled out Lambda MicroVMs in June 2026, and it changes the calculus for anyone building interactive, multi-tenant, or AI-agent workloads on serverless infrastructure. Instead of the stateless, sub-15-minute request-response model that has defined Lambda since 2014, MicroVMs give each user or job a dedicated, VM-isolated compute environment that can hold state for up to eight hours, suspend when idle, and resume in a snapshot-based near-instant restart. If you have ever needed to run untrusted code, spin up a per-user sandbox, or host an AI coding agent without provisioning EC2 fleets, this is the primitive AWS built for that job.
This tutorial walks through the full setup: prerequisites, IAM permissions, building a MicroVM image, launching and connecting to sessions, configuring idle and suspend policies, wiring up private networking, and automating deployment with CI/CD. By the end you will have a working multi-tenant sandbox deployed on AWS Lambda MicroVMs, plus the troubleshooting playbook for when things go sideways. Total build time runs 90 to 120 minutes for a first-time setup, including AWS account configuration.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Are AWS Lambda MicroVMs, and Why They Matter Now
According to AWS, “Lambda MicroVMs is a serverless compute primitive that combines VM-level isolation, near-instant launch and resume, and state persistence across interactions.” Under the hood it runs on Firecracker, the open source virtualization technology AWS built for Lambda and Fargate. AWS says “Lambda MicroVMs are powered by Firecracker, the same lightweight virtualization technology that has powered over 15 trillions of monthly Lambda function invocations.” That track record matters: this isn’t an experimental hypervisor, it’s the same isolation layer that already runs the bulk of AWS’s serverless traffic, repackaged so you can provision a dedicated microVM per user or per job instead of per function.
The distinction from standard Lambda functions is the lifecycle model. A normal Lambda function is stateless and short-lived; it spins up, handles a request, and either gets frozen or torn down. Lambda MicroVMs flips that: each microVM is launched from a pre-initialized Firecracker snapshot (the “MicroVM image”), keeps full memory and disk state alive for up to eight hours, and can be suspended and resumed on demand without losing that state. AWS frames the pitch directly: “You can now give each user or job their own compute environment to securely run code without managing virtualization infrastructure or choosing between isolation, speed, and state retention.”
The use cases AWS is targeting are telling: interactive development platforms, vulnerability scanning and security testing tools, data analytics platforms that need to preserve a working session, CI/CD and developer productivity tooling, and — explicitly — AI coding assistants and agent sandboxes. On that last point, the AWS Compute Blog is blunt about the moment this launched into: “You can now give each user or job their own execution environment to securely run just-in-time code – either user or AI generated – without managing virtualization infrastructure or choosing between isolation, speed, and state retention.” As AI agents increasingly write and execute their own code, teams need a way to run that code somewhere it cannot touch anything else — and that’s the gap Lambda MicroVMs fills.
Prerequisites: Tools, Versions, and Permissions
Before you start, confirm you have the following in place. None of this is optional — the MicroVMs API surface is new enough that an outdated CLI will throw confusing “unknown command” errors that have nothing to do with your actual configuration.
- An AWS account with billing enabled and a supported region selected (Lambda MicroVMs rolled out to major commercial regions first; check the AWS Region table in the console before you build)
- AWS CLI v2, updated to the latest release — run
aws --versionand confirm you’re on a 2026 build before continuing - Docker Desktop or Docker Engine 24+ installed locally, since MicroVM images are built from a Dockerfile
- An IAM user or role with permissions to create IAM policies, S3 buckets, and invoke the
lambda-microvmsandlambda-coreAPI namespaces - Python 3.12 (the runtime AWS demonstrates in its own reference examples) or another runtime packaged into your own container image
- An S3 bucket in the same region as your MicroVM deployment, for staging build artifacts
- Basic familiarity with Firecracker’s isolation model — you don’t need to run Firecracker yourself, but understanding that each session gets a dedicated kernel, memory space, and disk will help the configuration steps make sense
If you’ve already deployed serverless workloads with AWS SAM, most of this will feel familiar — the packaging and IAM patterns are close cousins. The lifecycle management (suspend, resume, terminate) is the genuinely new surface area.
Lambda MicroVMs vs Standard Lambda vs Firecracker vs EC2
Before committing engineering time, it’s worth knowing exactly what you’re trading off against the alternatives. Standard Lambda functions are cheaper and simpler for short, stateless tasks. Raw Firecracker on self-managed EC2 gives you full control but means you own the orchestration layer AWS just built for you. Here’s how the options line up for isolated, session-based workloads.
| Option | Isolation model | Max session length | State persistence | Ops overhead |
|---|---|---|---|---|
| Lambda MicroVMs | Dedicated Firecracker VM per session | Up to 8 hours (28,800s) | Full memory + disk across suspend/resume | None — AWS manages lifecycle |
| Standard Lambda function | Shared execution environment, reused across invocations | 15 minutes per invocation | None between invocations (stateless) | None — fully managed |
| Self-managed Firecracker on EC2 | Dedicated Firecracker VM, self-orchestrated | Unlimited (you control it) | Full, if you build the snapshot/restore logic | High — you own scheduling, scaling, patching |
| AWS Fargate task | Dedicated container, not VM-isolated by default | Unlimited | Ephemeral unless backed by external storage | Moderate — task definitions, scaling policies |
| Dedicated EC2 instance | Full VM, but often multi-tenant at the app layer | Unlimited | Full, persistent by default | High — patching, capacity planning, idle cost |
The practical takeaway: reach for Lambda MicroVMs when you need per-user or per-job VM isolation with session state, but you don’t want to run the orchestration yourself. If your workload is genuinely stateless and finishes in under 15 minutes, a standard Lambda function — or a comparison of AWS Lambda against Azure Functions and GCP Cloud Functions — is still the cheaper, simpler call.
Step 1: Configure the AWS CLI and Verify Region Support
Start by confirming your CLI is current and your credentials are scoped correctly. Lambda MicroVMs is a distinct API namespace, so an old cached CLI binary is one of the most common early blockers.
aws --version
# aws-cli/2.x or higher required
aws configure --profile microvms-tutorial
# AWS Access Key ID: ****
# AWS Secret Access Key: ****
# Default region name: us-east-1
# Default output format: json
aws lambda-microvms help --profile microvms-tutorial
# Confirms the lambda-microvms command namespace is available in your CLI buildIf the last command errors with “Invalid choice: ‘lambda-microvms'”, your CLI predates the MicroVMs launch. Reinstall the AWS CLI v2 from the official installer rather than patching an existing install — partial upgrades are a frequent source of missing subcommands.
Step 2: Create IAM Roles for Build Time and Execution Time
Lambda MicroVMs separates permissions into two roles: one used when you build and publish a MicroVM image, and one assumed at runtime by each launched session. Keeping these separate is deliberate — it means a compromised session can’t turn around and republish a poisoned image. Create the execution role first.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"lambda-microvms:RunMicroVM",
"lambda-microvms:SuspendMicroVM",
"lambda-microvms:ResumeMicroVM",
"lambda-microvms:TerminateMicroVM",
"lambda-microvms:GetMicroVMStatus"
],
"Resource": "arn:aws:lambda-microvms:us-east-1:ACCOUNT_ID:microvm-image/tutorial-sandbox-*"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:us-east-1:ACCOUNT_ID:log-group:/aws/lambda-microvms/*"
}
]
}Scope the Resource field to your actual image name pattern rather than using a wildcard across all MicroVM images in the account. This one change is the single biggest lever you have against a misconfigured sandbox affecting workloads it shouldn’t touch — the same least-privilege discipline covered in our guide to securing LLM apps against the OWASP Top 10 applies directly here, since AI-generated code running inside a MicroVM is functionally an untrusted input.
Step 3: Write the Dockerfile That Defines Your MicroVM Image
MicroVM images are built from a standard Dockerfile, which AWS then converts into a pre-initialized Firecracker snapshot. This is where you install your runtime and any libraries your sandboxed workload needs. AWS’s own reference examples build on a minimal Amazon Linux 2023 base.
FROM public.ecr.aws/lambda/microvms:al2023-minimal
RUN dnf install -y python3.12 python3.12-pip && \
dnf clean all
COPY requirements.txt /app/requirements.txt
RUN pip3.12 install --no-cache-dir -r /app/requirements.txt
COPY app/ /app/
WORKDIR /app
# The session process — kept alive across suspend/resume cycles
CMD ["python3.12", "session_server.py"]A minimal requirements.txt for a data-analytics or AI-agent sandbox typically includes pandas, numpy, fastapi, uvicorn, and boto3. Keep the image lean — every package you add increases build time and image size, and image size is one of the levers that affects how fast a suspended session resumes.
Step 4: Package and Upload Your Build Artifacts to S3
Zip your application files and stage them in an S3 bucket in the same region as your target deployment. Cross-region artifact references are a common source of silent build failures — the create-microvm-image call will accept the reference but then fail asynchronously during the build step.
zip -r app-bundle.zip app/ requirements.txt Dockerfile
aws s3 mb s3://microvms-tutorial-artifacts-ACCOUNT_ID --region us-east-1
aws s3 cp app-bundle.zip \
s3://microvms-tutorial-artifacts-ACCOUNT_ID/builds/tutorial-sandbox-v1.zip \
--profile microvms-tutorialStep 5: Build the MicroVM Image
Now call create-microvm-image, pointing it at the S3 artifact and your build-time IAM role. This step compiles your Dockerfile into a Firecracker snapshot — the same snapshot mechanism that gives Lambda MicroVMs its near-instant startup, since a snapshot boots dramatically faster than a cold kernel init.
aws lambda-microvms create-microvm-image \
--image-name tutorial-sandbox \
--source-s3-bucket microvms-tutorial-artifacts-ACCOUNT_ID \
--source-s3-key builds/tutorial-sandbox-v1.zip \
--build-role-arn arn:aws:iam::ACCOUNT_ID:role/microvm-build-role \
--baseline-memory-mb 2048 \
--baseline-vcpu 1 \
--profile microvms-tutorial
# Poll build status
aws lambda-microvms get-microvm-image-status \
--image-name tutorial-sandbox \
--profile microvms-tutorialBaseline resources of 2 GB memory and 1 vCPU are AWS’s documented default for this workload class, with vertical scaling up to 4x that baseline (8 GB / 4 vCPU) available automatically during peak periods within a session. Build times vary with image complexity; expect a few minutes for a lean Python image and longer for anything pulling in heavier data-science dependencies.
Step 6: Launch a MicroVM Session and Connect to It
Once the image status reports as available, launch a session with run-microvm. Each launched microVM gets a dedicated HTTPS endpoint and JWE-based per-tenant authentication, so a session for user A is not reachable using user B’s credentials, even if both are running on the same underlying image.
aws lambda-microvms run-microvm \
--image-name tutorial-sandbox \
--session-id user-8842-session-1 \
--execution-role-arn arn:aws:iam::ACCOUNT_ID:role/microvm-execution-role \
--idle-policy '{"maxIdleDurationSeconds":900,"autoResumeEnabled":true}' \
--maximum-duration-in-seconds 28800 \
--profile microvms-tutorial
# Response includes a dedicated endpoint, e.g.:
# {
# "sessionId": "user-8842-session-1",
# "endpoint": "https://user-8842-session-1.microvm.lambda.aws/",
# "status": "RUNNING"
# }Connect to that endpoint over HTTPS exactly as you would any other web service. From the client’s perspective, this looks like talking to a normal API — the VM boundary and Firecracker isolation are invisible at the protocol level, which is the point.
Step 7: Handle State Inside the Session
Because memory and disk state persist across suspend and resume, your session server can hold in-process state the way a long-running application would — something a stateless Lambda function was never designed to do. Here’s a minimal FastAPI session server that keeps a working dataset in memory between requests.
from fastapi import FastAPI
import pandas as pd
app = FastAPI()
session_state = {"dataset": None, "requests_handled": 0}
@app.post("/load")
def load_dataset(source_url: str):
session_state["dataset"] = pd.read_csv(source_url)
return {"rows": len(session_state["dataset"])}
@app.post("/query")
def query_dataset(expression: str):
if session_state["dataset"] is None:
return {"error": "no dataset loaded"}
session_state["requests_handled"] += 1
result = session_state["dataset"].query(expression)
return {"matches": len(result), "requests_handled": session_state["requests_handled"]}
@app.get("/health")
def health():
return {"status": "ok", "requests_handled": session_state["requests_handled"]}Notice there’s no external database call to preserve session_state between requests — that persistence is handled by the microVM’s own memory snapshot across suspend/resume. That’s the core value proposition versus a Fargate task backed by Redis: one less moving part, and one less thing that can drift out of sync with the compute layer.
Step 8: Configure Idle, Suspend, and Resume Policies
Idle policy tuning is where most of your ongoing cost control happens. A session that never suspends bills continuously; a session that suspends too aggressively adds resume latency to every user interaction after a short pause. Three settings control this behavior: maxIdleDurationSeconds (how long to wait before auto-suspending), suspendedDurationSeconds (how long a suspended session’s snapshot is retained before automatic termination), and autoResumeEnabled (whether an incoming request automatically wakes a suspended session).
aws lambda-microvms suspend-microvm \
--session-id user-8842-session-1 \
--profile microvms-tutorial
aws lambda-microvms resume-microvm \
--session-id user-8842-session-1 \
--profile microvms-tutorial
aws lambda-microvms terminate-microvm \
--session-id user-8842-session-1 \
--profile microvms-tutorialFor interactive tools where a user might step away for coffee, a maxIdleDurationSeconds around 600-900 with auto-resume enabled is a reasonable starting point. For AI agent sandboxes that run in tight loops with no human pause, you may want idle suspension disabled entirely and rely on the hard 28,800-second maximum duration as your cost ceiling instead.
Step 9: Wire Up Private Networking With the Lambda Network Connector
By default, MicroVM sessions reach the public internet directly. If your sandbox needs to query an internal database, call a private API, or otherwise stay inside a VPC boundary, attach a Lambda Network Connector instead of relying on public egress.
aws lambda-core create-network-connector \
--connector-name tutorial-sandbox-vpc-link \
--vpc-id vpc-0123456789abcdef0 \
--subnet-ids subnet-0a1b2c3d4e,subnet-0f1e2d3c4b \
--security-group-ids sg-0987654321fedcba \
--profile microvms-tutorialAttach the resulting connector ID to your run-microvm call and public internet access is replaced by whatever routes your VPC’s route tables define. This is the same architectural pattern used in most EKS Auto Mode deployments that need to keep workload traffic off the public internet — the networking primitives differ, but the “private by default, explicit egress” philosophy carries over directly.
Step 10: Add Lifecycle Hooks for Credential Refresh
Because a session can live for hours and get suspended and resumed multiple times, any short-lived credentials it holds (STS tokens, database connection strings) will go stale mid-session. AWS provides lifecycle hooks specifically for this — code that runs automatically on session startup and again on every resume, so you can refresh credentials and re-establish external connections without the client noticing a gap.
def on_resume():
"""Called automatically by the MicroVM runtime after every resume event."""
global db_connection
fresh_creds = boto3.client("sts").assume_role(
RoleArn="arn:aws:iam::ACCOUNT_ID:role/microvm-execution-role",
RoleSessionName="resume-refresh"
)
db_connection = reconnect_with_credentials(fresh_creds["Credentials"])
print("Session resumed, credentials refreshed")Skipping this step is one of the most common causes of sessions that work perfectly on first launch and then silently fail after their first suspend/resume cycle — the process is alive, but every downstream call it makes is using an expired token.
Step 11: Automate Builds and Deploys With CI/CD
Once the manual flow works, wire it into a pipeline so every merge to your main branch rebuilds and republishes the MicroVM image automatically. A GitHub Actions workflow covers the build-artifact-upload-create-image sequence in one job.
name: deploy-microvm-image
on:
push:
branches: [main]
jobs:
build-and-publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::ACCOUNT_ID:role/github-actions-microvm-deploy
aws-region: us-east-1
- name: Package application
run: zip -r app-bundle.zip app/ requirements.txt Dockerfile
- name: Upload to S3
run: |
aws s3 cp app-bundle.zip \
s3://microvms-tutorial-artifacts-ACCOUNT_ID/builds/tutorial-sandbox-${{ github.sha }}.zip
- name: Build MicroVM image
run: |
aws lambda-microvms create-microvm-image \
--image-name tutorial-sandbox \
--source-s3-bucket microvms-tutorial-artifacts-ACCOUNT_ID \
--source-s3-key builds/tutorial-sandbox-${{ github.sha }}.zip \
--build-role-arn arn:aws:iam::ACCOUNT_ID:role/microvm-build-roleUse OIDC-based role assumption (as shown above) rather than long-lived access keys stored as repository secrets — the same guidance that applies to any CI/CD pipeline touching production AWS credentials.
Step 12: Monitor Sessions With CloudWatch
MicroVM sessions emit logs to a dedicated log group namespace. A CloudWatch Logs Insights query is the fastest way to spot sessions that are stuck, suspending too frequently, or burning peak-scaling resources longer than expected.
fields @timestamp, sessionId, eventType, durationSeconds
| filter @logStream like /tutorial-sandbox/
| filter eventType in ["SUSPEND", "RESUME", "PEAK_SCALE"]
| stats count(*) as eventCount by sessionId, eventType
| sort eventCount desc
| limit 20Sessions with an unusually high PEAK_SCALE count relative to their total request volume are worth a closer look — that pattern usually points to a memory leak or an unbounded cache inside the session process rather than genuine load.
Complete Working Project: A Multi-Tenant AI Code Sandbox
Putting the steps above together, here’s the shape of a complete, working project: a multi-tenant sandbox that spins up an isolated MicroVM per user session, runs an AI-generated code snippet inside it, and tears the session down after the result is returned.
- Dockerfile — Python 3.12 base image with a restricted execution shim that captures stdout/stderr and enforces a wall-clock timeout per snippet
- IAM roles — a build role scoped to
create-microvm-imageonly, and a per-tenant execution role scoped to a single session ID pattern - API layer — a lightweight orchestrator (a standard Lambda function or small Fargate service works fine here) that calls
run-microvmwhen a user submits code, streams the result back, then callssuspend-microvmafter a configurable idle window - Networking — a Lambda Network Connector attached so the sandbox can reach an internal package mirror but nothing else on the private network
- Observability — the CloudWatch Logs Insights query above, plus a CloudWatch alarm on
TerminateMicroVMfailures so orphaned sessions get flagged instead of quietly running out the 8-hour clock - Cleanup job — a scheduled EventBridge rule that calls
terminate-microvmon any session past its expected lifetime, as a backstop against orchestrator bugs
This pattern — orchestrator function plus per-tenant MicroVM plus a cleanup backstop — generalizes to most of the use cases AWS is targeting with this launch: developer sandboxes, data-analytics notebooks, and vulnerability-scanning tools all follow the same shape, with the actual session server code swapped out.
Cost Breakdown: What Lambda MicroVMs Actually Cost
AWS bills Lambda MicroVMs across three dimensions rather than the simple per-invocation model of standard Lambda: per-second compute (split between baseline and peak usage), snapshot storage and operations, and standard data transfer rates. Critically, suspended MicroVMs incur no compute charges — you pay storage-only rates while a session sits idle, which is the mechanism that makes long-lived, low-traffic sessions economically viable in the first place.
| Cost dimension | What drives it | How to control it |
|---|---|---|
| Baseline compute | Per-second charge for the configured baseline (default 2 GB / 1 vCPU) while a session is active | Right-size baseline memory/vCPU to your actual workload rather than over-provisioning |
| Peak compute | Additional per-second charge when a session scales up to 4x baseline during load spikes | Profile your workload to confirm it genuinely needs burst headroom before enabling it |
| Snapshot storage | Storage rate applied to suspended session snapshots (memory + disk state) | Tune suspendedDurationSeconds so abandoned sessions terminate instead of parking indefinitely |
| Snapshot operations | Charges tied to suspend/resume snapshot writes and reads | Avoid overly aggressive idle timeouts that cause frequent suspend/resume churn |
| Data transfer | Standard AWS data transfer rates for traffic in and out of each session’s endpoint | Route internal traffic through a Network Connector rather than round-tripping over the public internet |
AWS has not published flat per-second unit prices for MicroVMs the way it has for standard Lambda GB-seconds, so budget for a pilot phase where you measure actual baseline-vs-peak time split and snapshot churn on your specific workload before committing to a production rollout. Teams already running a AWS Well-Architected Framework review should treat idle-policy tuning as a first-class cost-optimization line item, not an afterthought.
5 Common Pitfalls When Adopting Lambda MicroVMs
- Treating it like a drop-in Lambda replacement. The stateless, 15-minute execution model of standard Lambda and the stateful, 8-hour session model of MicroVMs solve different problems. Porting a short-lived batch job to MicroVMs just to get “VM isolation” usually adds cost and complexity without a matching benefit.
- Skipping the build-role/execution-role separation. Reusing one IAM role for both build and runtime collapses the security boundary AWS designed the two-role model to enforce, and makes a compromised session capable of republishing images.
- Ignoring credential refresh on resume. Any session expected to run past the lifetime of an STS token needs an explicit resume hook. Without it, sessions “work” on launch and fail silently hours later.
- Leaving idle policies at defaults across wildly different workload types. A 900-second idle timeout tuned for an interactive developer tool will suspend an AI agent mid-loop if applied unchanged to an agent sandbox that has no natural pauses.
- No termination backstop. Relying solely on the 28,800-second maximum duration as your only cleanup mechanism means orphaned sessions from orchestrator bugs run (and bill) for up to eight hours before AWS forces them closed. A scheduled cleanup job catches this earlier.
Troubleshooting: 8 Issues and Fixes
| Symptom | Likely cause | Fix |
|---|---|---|
| “Invalid choice: ‘lambda-microvms'” | AWS CLI predates the MicroVMs launch | Reinstall AWS CLI v2 from the official installer, don’t patch in place |
create-microvm-image hangs at “BUILDING” | Cross-region S3 artifact reference | Confirm the S3 bucket and target MicroVM deployment are in the same region |
| Session works, then fails after first suspend/resume | Missing credential-refresh lifecycle hook | Add an on_resume handler that re-assumes the execution role |
| Endpoint returns connection refused | Session server process crashed but MicroVM stayed “RUNNING” | Add a health-check loop and auto-restart logic inside the container entrypoint |
| Unexpectedly high compute bill | Idle policy too permissive, sessions never suspend | Lower maxIdleDurationSeconds and confirm autoResumeEnabled is set appropriately |
| Resume latency feels slow | Oversized image with unnecessary dependencies | Trim the Dockerfile to only what the session process needs at runtime |
| Private database unreachable from session | No Network Connector attached, session using public egress only | Attach a Lambda Network Connector scoped to the target VPC and subnets |
| Sessions accumulate and never terminate | Orchestrator crash before calling terminate-microvm | Add a scheduled EventBridge cleanup rule as a backstop, independent of the orchestrator |
Advanced Tips: Hardening Multi-Tenant Isolation
Once the basic flow is running, a few refinements separate a working prototype from something safe to expose to untrusted users or autonomous AI agents. First, treat every session’s execution role as if the code inside it is hostile by default — AWS’s own framing backs this up: “Lambda MicroVMs provides an isolated compute environment per session, preventing malicious code from affecting other users or the host.” That isolation guarantee covers the VM boundary; it does not cover what happens if you hand a session overly broad IAM permissions or open network egress.
Second, apply the same threat-modeling discipline you’d use for any system executing untrusted or AI-generated code — the OWASP Top 10 injection and access-control categories map directly onto sandbox design even though MicroVMs is infrastructure, not application code. Third, if your sandbox needs to run at meaningfully lower cost per session at scale, evaluate whether ARM-based baseline configurations make sense once AWS documents that support — teams already migrating workloads to Graviton5 should keep an eye on MicroVMs’ architecture support as it matures. Finally, log every RunMicroVM, SuspendMicroVM, and TerminateMicroVM call to a centralized audit trail separate from application logs — lifecycle events are the layer you’ll need first during an incident review, and they’re easy to lose if they’re mixed into general application logging.
The Security Model: JWE Auth, Snapshot Boundaries, and What’s Actually Isolated
It’s worth being precise about what “VM-level isolation” actually buys you, because the term gets used loosely elsewhere in cloud infrastructure. A container gives you namespace and cgroup isolation at the kernel level — the workloads share a host kernel, and a kernel exploit can, in principle, cross that boundary. A Firecracker microVM gives each session its own kernel, its own memory space, and its own virtual disk, running on top of KVM. That’s a materially stronger boundary, and it’s why AWS reaches for it when the workload is explicitly “run code I don’t fully trust” rather than “run my own microservice.”
Authentication is handled per-session through JWE (JSON Web Encryption) tokens rather than a shared API key or a single IAM role reused across tenants. Each session’s dedicated HTTPS endpoint only accepts requests carrying that session’s token, which means a leaked or replayed credential from one user’s sandbox has no path to another user’s session, even if both sessions are running on identical images and sitting on the same underlying host hardware. That per-tenant boundary is the piece that makes multi-tenant SaaS products viable on top of MicroVMs — you’re not relying on application-layer access control alone to keep tenants apart, the platform enforces it below your code.
What isolation does not cover is equally important. The Firecracker boundary protects the host and other sessions from a compromised session — it does not restrict what a session can do to resources it’s explicitly been given access to. If your execution role grants broad S3 access, or your Network Connector routes to your entire VPC instead of a scoped subnet, a hostile or buggy piece of AI-generated code running inside a perfectly isolated microVM can still exfiltrate data or hit internal services it was never meant to reach. The VM boundary is necessary but not sufficient; IAM scoping and network segmentation are still doing real work, which is why Steps 2 and 9 above are not optional hardening — they’re the other half of the security model.
Why AWS Built This Now: The AI Agent Execution Problem
Lambda MicroVMs didn’t appear in a vacuum. Through 2025 and into 2026, AI coding agents moved from writing suggestions a human reviews before running, to autonomously generating and executing code as part of a task loop — searching for a bug, writing a fix, running the test suite, iterating. That shift created a concrete infrastructure gap: where does an agent’s self-generated code actually run? Running it on the same host as the orchestrating application is a non-starter from a security standpoint. Spinning up a full EC2 instance per agent task is slow and expensive at the scale agent platforms operate at. Standard Lambda functions are stateless and time-boxed in a way that doesn’t fit an agent that needs to hold a working directory, an open terminal session, or accumulated context across many tool calls in a single task.
MicroVMs sits directly in that gap: fast enough to launch that it doesn’t add noticeable latency to an agent’s first action, isolated enough that AI-generated code can’t touch anything outside its own sandbox, and stateful enough that an agent’s session survives idle gaps between tool calls without losing its working state. AWS’s own product messaging leans into this explicitly, naming AI coding assistants and agent sandboxes as a headline use case rather than an afterthought. If your organization is building or operating agent tooling — whether that’s an internal developer-productivity agent or a customer-facing AI feature that executes code on a user’s behalf — this is the first AWS-native primitive purpose-built for that exact execution boundary, rather than a general-purpose compute service retrofitted to the job.
How Lambda MicroVMs Fits Your Broader Cloud Architecture
Lambda MicroVMs is not a wholesale replacement for the rest of your cloud computing stack — it’s a new tool for a specific gap: workloads that need VM-grade isolation with session state, without the operational weight of running Firecracker or a full hypervisor layer yourself. Teams running Kubernetes for long-lived services should still lean on patterns like EKS Auto Mode for that class of workload, and reach for MicroVMs specifically when the requirement is per-tenant isolation for interactive or AI-driven sessions. If your organization already has strong secrets-management discipline in place — see our walkthrough on securing Kubernetes secrets — extending that same rigor to MicroVM execution roles is a natural next step rather than a new discipline to build from scratch.
Frequently Asked Questions
What is the maximum session length for an AWS Lambda MicroVM?
Up to 28,800 seconds, or eight hours, per AWS’s documented maximum duration setting. Sessions can be suspended and resumed multiple times within that window without losing state.
How is Lambda MicroVMs different from a standard Lambda function?
Standard Lambda functions are stateless and capped at 15 minutes per invocation, with execution environments reused opportunistically across requests. Lambda MicroVMs gives each session a dedicated Firecracker VM with persistent memory and disk state across suspend and resume cycles, for up to eight hours.
Do I need to run Firecracker myself to use Lambda MicroVMs?
No. AWS manages the Firecracker layer entirely — you build a Dockerfile, AWS converts it into a MicroVM image (a pre-initialized Firecracker snapshot), and AWS handles launch, suspend, resume, and scaling.
What happens to my costs while a session is suspended?
Suspended MicroVMs incur no compute charges. You pay storage-only rates for the retained snapshot until the session resumes or the suspendedDurationSeconds window expires and the session terminates.
Can Lambda MicroVMs run inside a private VPC?
Yes, by attaching a Lambda Network Connector via the lambda-core create-network-connector API, scoped to your VPC, subnets, and security groups. Without a connector, sessions default to public internet access.
What runtimes does Lambda MicroVMs support?
Because MicroVM images are built from a Dockerfile, any runtime you can containerize is supported. AWS’s own reference documentation demonstrates Python 3.12, but the architecture is runtime-agnostic.
Is Lambda MicroVMs designed for running AI-generated code?
Yes — AWS explicitly names AI coding assistants and agent sandboxes among the primary use cases for this launch, alongside interactive development platforms and vulnerability-scanning tools.
How much can a session scale during peak load?
Up to 4x the configured baseline resources. With the documented default baseline of 2 GB memory and 1 vCPU, that means bursts up to roughly 8 GB and 4 vCPU within the same session.
Can I use Lambda MicroVMs for multi-tenant SaaS isolation, not just AI agents?
Yes. AWS lists interactive development platforms and data-analytics platforms with session preservation alongside AI agent sandboxes as primary use cases, and the per-session JWE authentication model is specifically designed to keep tenants isolated from each other on shared infrastructure, independent of whether the workload involves AI at all.
What’s the difference between suspending a session and terminating it?
Suspending preserves the full memory and disk snapshot at storage-only billing rates, and the session can resume with state intact, either automatically on the next request or manually via resume-microvm. Terminating discards the session permanently — there is no resume path afterward, so termination should be reserved for sessions you’re confident are finished, with suspension as the default for anything that might come back.
Related Coverage
- AWS Global Accelerator Game Server Setup: 12 Steps [2026]
- AWS Systems Manager Azure Setup: 12 Steps, 90 Min [2026]
- Palworld Cloud Server Setup: 12 Steps, No Ports [2026]
- Sunshine and Moonlight on AWS G7: 12 Steps, 90 Min [2026]
- EKS Auto Mode Setup: 12 Steps, 90 Minutes [2026]
