A better Lambda console, in your own AWS account.
Cloud Certainty FunctionPilot gives your engineers one place to see, test and debug every AWS Lambda function across your AWS accounts and Regions: a table with the metrics the console leaves out, a test workbench that keeps its tests and results, and logs that never ask for a log group. You decide who may see, test or change which functions, and AWS enforces it. It runs entirely in your AWS account, and nothing leaves it.
ONE CLOUDFORMATION STACK · YOUR ACCOUNT · YOUR IDP · EARLY ACCESS · PLANNED FROM $100 A MONTH
Not on AWS Marketplace yet. Early access by email: [email protected].
[ A ] WHAT THE LAMBDA CONSOLE LACKS, AND WHAT FUNCTIONPILOT ADDS
The Lambda console is good at one function in one Region. Teams with dozens or hundreds of functions across several accounts end up writing scripts, paying for an observability service that receives their telemetry, or handing out console access. FunctionPilot covers the gaps and keeps everything in your account.
Fleet view
The Lambda console:The function list has no metrics and no sorting by them, and shows one Region of one account at a time.
FunctionPilot:One table of every function across your accounts and Regions: invocations, errors, error rate, throttles, duration (average, p95, maximum), peak concurrency and a sparkline, for any timeframe from 15 minutes to 30 days.
Test events
The Lambda console:Ten private test events per function. Sharing needs schema registry permissions, and results are not kept.
FunctionPilot:Saved tests stored in FunctionPilot, private or shared with the team, each with its run history: payload, response, log tail, duration, cold start and memory.
Logs
The Lambda console:You go looking for the log group, and one stream per execution environment makes a request hard to follow.
FunctionPilot:Logs opened from the function, never by log group: filter patterns, level chips, request ids, events grouped by invocation, live tail, and every log line of a test run in one click.
Cold starts
The Lambda console:No metric: init duration only appears in REPORT log lines, and INIT is billed.
FunctionPilot:Every run shows init duration with a cold-start badge, recent invocations flag cold starts, and a ready Logs Insights query finds them.
Runtimes
The Lambda console:Deprecation notices arrive per Region, and you check each account yourself.
FunctionPilot:A deprecation badge on every function in the table, across all your accounts and Regions, from a built-in runtime calendar.
Cost
The Lambda console:No cost per function. Cost Explorer resource data is opt-in, 14 days and for the management account only.
FunctionPilot:An estimated cost per function for any timeframe, from requests and GB-seconds at list prices, labelled as an estimate. Business and above
Configuration
The Lambda console:The resource-based policy is raw JSON, nothing flags a public function URL, and the 4 KB environment limit is not shown.
FunctionPilot:Readable configuration cards, the policy as statements, a red “public” badge on a function URL without auth, and an environment editor with a 4 KB meter that never overwrites someone else’s change.
Access
The Lambda console:Anyone who can open the console sees every function in the account. “Test and read logs of our functions only” means writing IAM by hand.
FunctionPilot:Grants per user or group: view, logs, invoke, edit or manage on functions matched by name patterns such as “orders‑*”, per account and Region, enforced by AWS on every request.
Change history
The Lambda console:“Who changed this function?” means a search in CloudTrail, account by account.
FunctionPilot:CloudTrail in every account names the person on every call FunctionPilot makes, and the audit log records every change and invocation.
[ B ] WHAT YOUR ENGINEERS GET
Find a function, see how it behaves, test it and read its logs, without AWS console access. Users see only the functions they are granted, and actions they may not take are greyed out with the reason.
- Function table
- Every function you may see, across accounts and Regions, with totals and summary tiles. Sort on any column, search, filter by account, Region, runtime or errors, choose columns and export to CSV.
- Function page
- Metric charts on one timeframe, recent invocations with cold starts, triggers and destinations, configuration, the resource policy, versions and aliases with weighted routing.
- Test workbench
- A JSON editor with templates for API Gateway, ALB, SQS, SNS, S3, EventBridge, DynamoDB and Kinesis streams, schedules and Cognito triggers. Run against $LATEST, a version or an alias.
- Saved tests
- Private by default; on Team and above, shared with everyone who may invoke the function. Compare a stored run with the current one.
- Log explorer
- Filter patterns, levels, request ids and pretty JSON, with START, END and REPORT lines recognised, events grouped by invocation, and live tail.
- Logs Insights
- Ready queries on the function’s own log group: errors, cold starts and init duration, slowest invocations, memory headroom, timeouts and grouped error messages. Team and above.
- Changes
- Memory, timeout, ephemeral storage, description, environment variables, versions, aliases and concurrency, for people granted edit or manage. Team and above.
- Function orders-api · eu-west-2
- Qualifier $LATEST
- Status 200
- Duration 182 ms · billed 183 ms
- Init duration 412 ms · cold start
[ C ] WHAT ADMINISTRATORS CONTROL
Connections
This account from the start; other accounts through a spoke role with an external ID, one by one or across an AWS Organization with a StackSet. Each role has an access level: ReadOnly, Operate or Full.
Grants
View, logs, invoke, edit and manage, for users and groups from your identity provider, on function name patterns per account and Region.
Enforced twice
The API checks every grant, and every AWS call runs with credentials that a session policy limits to the granted functions. A grant that would not fit is refused, never widened.
Audit log
Role, connection, grant and settings changes, configuration changes, invocations (without the payload), code downloads and saved tests, with the person and source IP.
Health findings
Deprecated runtimes, functions unused for 30 days, error rates above 5%, throttling, durations near the timeout, public function URLs and async calls without a failure destination. Business and above.
Settings and licence
An admins role, who may see environment values, an IP allowlist on Business and above, and the licence status from AWS License Manager with your plan.
[ D ] GRANTS, OR THE USER’S OWN AWS PERMISSIONS
Each user works one of two ways. Most teams use grants. Where people already have AWS permissions that fit, admins can let them use those instead.
Grants from FunctionPilot
Admins grant view, logs, invoke, edit or manage on function name patterns. FunctionPilot calls AWS through the account’s role, with a session policy that allows exactly the granted functions and actions, and the user’s email as the source identity.
- No AWS identity needed: users sign in through your identity provider
- Grants are checked by the API and enforced again by AWS
- CloudTrail shows the role session with the user’s email
Personal AWS access
Users connect their IAM Identity Center permission sets, approved in their access portal, or their IAM user keys. Then AWS alone decides what they can do: FunctionPilot neither widens nor narrows it, and CloudTrail records their own identity.
- Identity Center: one-hour role credentials from the user’s portal session
- Access keys: exchanged once for temporary credentials; the secret key is never stored, and root keys are refused
- Everything held is encrypted with a KMS key under a context naming the user, and deleted when they disconnect or it expires
How each works, and how to switch it on: personal AWS access and the security overview.
[ E ] RUNS IN YOUR ACCOUNT, FROM LAUNCH TO THE FIRST TEST
- 01
Deploy
Launch one CloudFormation stack in your own account and Region. It is serverless, so it costs close to nothing while nobody is using it.
Stays in your account
Grants, saved tests with their results, cached metrics and the audit log stay in your AWS account. Nothing is sent to Cloud Certainty.
Licensed through AWS
The licence is read from AWS License Manager in your own account. Nothing phones home.
- 02
Sign in
Users sign in through Amazon Cognito with MFA or AWS IAM Identity Center on every plan, or your own SAML or OIDC provider, such as Microsoft Entra ID or Okta, on Team and above.
Only trusted identities
Roles and grants follow the user’s email, so FunctionPilot accepts only emails your directory asserts or has verified.
- 03
Connect accounts
Functions in this account are there from the start. Reach other accounts through a small IAM role you deploy in each, at the access level you choose.
The role is the ceiling
FunctionPilot can never do more in an account than the role there allows. It cannot change IAM, deploy code or delete functions.
- 04
Grant and work
Give teams view, logs, invoke, edit or manage on their functions. They find, test and debug them without AWS console access.
Scoped on every request
Each AWS call runs with credentials that last an hour at most, narrowed by a session policy to the user’s grants.
Every action traced
The user’s email is the source identity of every session, so CloudTrail names the person.
Read the security overview for the detail a security review needs.
[ F ] PLANS AND PRICING
The pricing planned for the AWS Marketplace launch: contract pricing, monthly or 12 months up front. Plans are not priced per user or per function. Prices in US dollars, billed through your AWS bill.
Starter
For a small team that needs the function table, testing and logs.
- AWS accounts
- 3
- Saved tests per user
- 25
- Runs kept per saved test
- 5
- Audit log kept
- 30 days
- Longest time range
- 7 days
Team
Adds shared tests, configuration changes, Logs Insights, your own SAML or OIDC sign-in and personal AWS access.
- AWS accounts
- 10
- Saved tests per user
- 200
- Runs kept per saved test
- 20
- Audit log kept
- 90 days
- Longest time range
- 30 days
Business
Adds health findings, cost estimates per function and the IP allowlist.
- AWS accounts
- 50
- Saved tests per user
- 1,000
- Runs kept per saved test
- 50
- Audit log kept
- 365 days
- Longest time range
- 30 days
Enterprise
Everything in Business, with the highest limits.
- AWS accounts
- Unlimited
- Saved tests per user
- Unlimited
- Runs kept per saved test
- 100
- Audit log kept
- 3,650 days
- Longest time range
- 30 days
| Feature | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Per month | $100 | $250 | $1,000 | $2,500 |
| 12 months | $1,000 | $2,500 | $10,000 | $25,000 |
| AWS accounts | 3 | 10 | 50 | Unlimited |
| Saved tests per user | 25 | 200 | 1,000 | Unlimited |
| Runs kept per saved test | 5 | 20 | 50 | 100 |
| Audit log kept | 30 days | 90 days | 365 days | 3,650 days |
| Longest time range | 7 days | 30 days | 30 days | 30 days |
| Public (shared) saved tests | Not included | Included | Included | Included |
| Configuration, environment, version, alias and concurrency changes | Not included | Included | Included | Included |
| Logs Insights with the query library | Not included | Included | Included | Included |
| SAML and OIDC identity providers | Not included | Included | Included | Included |
| Personal AWS access with users’ own permission sets or IAM user keys | Not included | Included | Included | Included |
| Health findings | Not included | Not included | Included | Included |
| Cost estimates per function | Not included | Not included | Included | Included |
| IP allowlist | Not included | Not included | Included | Included |
Every plan includes
- Function table across accounts and Regions, with metrics for any timeframe, filters and CSV export
- Function pages: metric charts, configuration, resource policy, triggers, versions and aliases
- Test workbench with event templates, and private saved tests with run history
- Log explorer with filter patterns, levels, requests grouped by invocation and live tail
- Connections: this account, and other accounts through a cross-account role
- Per-user and per-group grants: view, logs, invoke, edit, manage
- The user’s email in CloudTrail on every AWS call, and an audit log
- Amazon Cognito sign-in with MFA, and IAM Identity Center
Pricing for the launch
FunctionPilot is in early access and not on AWS Marketplace yet. These are the plans and prices planned for the launch. Once it is listed, you will find it on AWS Marketplace(opens in a new tab). Until then, ask for early access.
Business and Enterprise are add-ons
On the FunctionPilot listing, Team is the base plan. Business is Team plus the Business add-on ($750 a month or $7,500 for 12 months), and Enterprise adds the Enterprise add-on to both ($1,500 a month or $15,000 for 12 months). An add-on on its own grants nothing. Starter is a separate listing, FunctionPilot Starter.
AWS infrastructure is billed by AWS
Lambda, API Gateway, DynamoDB, CloudWatch metric requests and Logs Insights queries run in your account and are billed by AWS as usual. Metrics are cached and shared between users, so a Region with 500 functions costs a few cents to refresh.
Support
Basic support is included. Paid plans with response times, and a fixed-price installation service, are on the support page. Questions about plans: [email protected].
[ G ] QUESTIONS
- Can I use FunctionPilot today?
- It is in early access. It is not on AWS Marketplace yet; email us about your AWS setup and we will set you up ahead of the launch.
- Does any data leave my AWS account?
- No. The stack runs in your account and calls AWS only. The one outside request is an optional daily check for new releases, which reads a public file.
- Can it change or delete my functions?
- Only within the access level of each account’s role and the user’s grants: configuration, versions, aliases and concurrency. It never deploys code or deletes a function.
- What does it cost to run?
- The licence is a monthly or 12-month contract. Lambda, API Gateway, DynamoDB and CloudWatch requests run in your account and are billed by AWS; for a team they are small.
More in the FAQ and the documentation.
Amazon Web Services, AWS, AWS Lambda, Amazon CloudWatch and AWS Marketplace are trademarks of Amazon.com, Inc. or its affiliates. Cloud Certainty FunctionPilot is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.