Functions

Functions run short request/response code without you managing servers. Package a zip, register it, allow its identity to call other Cloud services, then invoke it from Gateway, Events, or skippr functions invoke. Use this for HTTP handlers and event-driven work. Long-running VMs are not a product yet.

Status: Preview. See the API action reference for the full command list.

Before you start

Get an access token with skippr login. See Cloud User Directory.
Ensure your own policy allows the functions and objects actions used below.
Create an artifact bucket by following Objects.

1. Package and upload

This Node example accepts a JSON payload and returns it:

// index.js
exports.handler = (event) => ({
  ok: true,
  received: event
});

Package it, calculate the required lowercase SHA-256, and upload it to a function-artifacts bucket. Creating the bucket is CLI, Terraform, CDKTF TypeScript, or CDKTF Python. Uploading the zip is a data-plane call. For provider credentials and the shared cloud provider block, see Terraform and CDKTF.

bash

zip -j hello.zip index.js
export FUNCTION_SHA256="$(shasum -a 256 hello.zip | awk '{print $1}')"

CLITerraformCDKTF TypeScriptCDKTF Python

bash

skippr objects create-bucket --bucket function-artifacts
skippr objects put-object --bucket function-artifacts --key hello.zip --content-type application/zip

hcl

resource "cloud_object_bucket" "artifacts" {
  bucket = "function-artifacts"
}

import { CloudProvider, CloudObjectBucket } from "@skippr/provider-cloud";

const cloud = new CloudProvider(this, "cloud", { region: "eu-central-1" });

new CloudObjectBucket(this, "artifacts", {
  bucket: "function-artifacts",
  provider: cloud,
});

python

from skippr_cdktf import CloudProvider, CloudObjectBucket

cloud = CloudProvider(self, "cloud", region="eu-central-1")

CloudObjectBucket(
    self,
    "artifacts",
    bucket="function-artifacts",
    provider=cloud,
)

After the bucket exists, upload the zip with skippr objects put-object --bucket function-artifacts --key hello.zip --content-type application/zip.

2. Register

CLITerraformCDKTF TypeScriptCDKTF Python

bash

skippr functions register-function --input - <<JSON
{
  "name": "hello",
  "packageType": "Zip",
  "runtime": "cloud.nodejs",
  "handler": "index.handler",
  "concurrencyLimit": 10,
  "timeoutSeconds": 30,
  "memoryMb": 256,
  "code": {
    "bucket": "function-artifacts",
    "key": "hello.zip",
    "sha256": "${FUNCTION_SHA256}"
  }
}
JSON

hcl

resource "cloud_function" "hello" {
  name              = "hello"
  package_type      = "Zip"
  runtime           = "cloud.nodejs"
  handler           = "index.handler"
  concurrency_limit = 10
  code_bucket       = cloud_object_bucket.artifacts.bucket
  code_key          = "hello.zip"
  code_sha256       = filebase64sha256("hello.zip")
}

import { CloudFunction } from "@skippr/provider-cloud";

new CloudFunction(this, "hello", {
  name: "hello",
  packageType: "Zip",
  runtime: "cloud.nodejs",
  handler: "index.handler",
  concurrencyLimit: 10,
  codeBucket: "function-artifacts",
  codeKey: "hello.zip",
  codeSha256: process.env.FUNCTION_SHA256!,
  provider: cloud,
});

python

import os
from skippr_cdktf import CloudFunction

CloudFunction(
    self,
    "hello",
    name="hello",
    package_type="Zip",
    runtime="cloud.nodejs",
    handler="index.handler",
    concurrency_limit=10,
    code_bucket="function-artifacts",
    code_key="hello.zip",
    code_sha256=os.environ["FUNCTION_SHA256"],
    provider=cloud,
)

Registration returns status: "Active" and creates workload principal fn/hello.

3. Authorize the function

The function's workload principal has no Cloud API permissions until you attach a policy. This example allows it to read one table action:

bash

skippr auth create-policy --input - <<JSON
{
  "policyId": "hello-data",
  "policy": "permit (principal == Cloud::Principal::\"fn/hello\", action == Cloud::Action::\"tables:GetItem\", resource);",
  "attachedTo": ["workload:fn/hello"]
}
JSON

Grant only the actions the handler calls. Environment values can be plain strings or { "SecretId": "…" }; secret references are resolved at cold start under this workload identity.

4. Invoke

This is a complete synchronous invoke:

bash

skippr functions invoke --input - <<JSON
{
  "functionName": "hello",
  "payload": "{\"name\":\"Ada\"}"
}
JSON

The response is { "statusCode": 200, "payload": "<handler response>" }. payload is a string on both the request and response. A Gateway FUNCTION route unwraps that envelope: callers receive the payload as the HTTP body.

Zip or Image

	Zip	Image
Source	Object reference: `bucket`, `key`, `sha256`	OCI `uri` with optional `sha256` pin
Runtime	Required	Omit it
Handler	Required	Defined by the image
Supported Zip runtimes	`cloud.rust`, `cloud.nodejs`, `cloud.python`, `cloud.go`	Not applicable
Materialization	Verified and extracted from objects	Pulled and converted when registered or updated

Image registration uses this shape:

json

{
  "name": "image-worker",
  "packageType": "Image",
  "image": {
    "uri": "ghcr.io/example/image-worker@sha256:<digest>"
  },
  "concurrencyLimit": 10,
  "memoryMb": 512
}

Do not include runtime for an Image function.

Operations by task

Deploy and update

Operation	Use it to
`RegisterFunction`	Create or replace a function definition. Re-register keeps the existing workload identity unless you bind `PrincipalId`.
`UpdateFunctionCode`	Replace only the Zip object or Image URI
`UpdateFunctionConfiguration`	Change handler, runtime, concurrency, timeout, memory, environment, or identity. Binding a key requires `PrincipalId` and `AccessKeyId` together.
`UpdateFunction`	Configuration-only alias

Invoke and trigger

Operation	Use it to
`Invoke`	Wait for the handler response
`InvokeAsync`	Enqueue an invocation and receive HTTP 202
`CreateEventSourceMapping`	Poll a queue ARN and invoke the function with each message

Only queue event-source ARNs are supported in Preview. Function URLs are coming soon.

Inspect and remove

Operation	Use it to
`GetFunction`	Read one function definition and workload identity
`ListFunctions`	List functions with `maxResults` from 1 to 100
`DeleteFunction`	Delete the function definition

Limits and runtime contract

Limit or default	Value
Zip compressed size	50 MiB
Zip uncompressed size	250 MiB
Zip entries	10,000
Default concurrency	10
Default timeout	30 seconds
Default memory	256 MiB
List page size	1–100

The function artifact SHA-256 is verified before execution. Zip paths are validated during extraction. A public invoke-payload limit is not yet specified; do not assume another functions product's limit.

Errors

Errors use a JSON code and message.

Code or status	Meaning
`ResourceNotFoundException`	The function does not exist
`ValidationException`	Invalid package type, runtime, artifact, fields, or queue mapping
`TooManyRequestsException` / `429`	The function's concurrency limit is reached
`ConflictException` / `409`	A concurrent update raced; retry the register or update
`Unhandled`	The runtime or handler failed
`401` / `403`	Missing authentication or a policy denial

Functions ​

Before you start ​

1. Package and upload ​

2. Register ​

3. Authorize the function ​

4. Invoke ​

Zip or Image ​

Operations by task ​

Deploy and update ​

Invoke and trigger ​

Inspect and remove ​

Limits and runtime contract ​

Errors ​

Related ​

Functions

Before you start

1. Package and upload

2. Register

3. Authorize the function

4. Invoke

Zip or Image

Operations by task

Deploy and update

Invoke and trigger

Inspect and remove

Limits and runtime contract

Errors

Related