Frequently asked questions

#What is FunctionPilot?

A better AWS Lambda console that runs entirely in your own AWS account. Your teams see every function across your accounts and Regions in one table with metrics, test functions with shared saved tests and run history, and search logs without hunting for log groups, with per-team grants and an audit log. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing and plans

#How much does it cost?

FunctionPilot is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front, billed through your AWS bill. Plans are not priced per user or per function. See the pricing on the product page for the current prices.

#What does each plan include?

• Every plan has the function table with metrics, the function pages, the test workbench with private saved tests and run history, the log explorer with live tail, connections to other accounts, grants, the audit log, and IAM Identity Center and Cognito sign-in with MFA.
• Team adds public (shared) saved tests, configuration, environment, version, alias and concurrency changes, Logs Insights with the query library, SAML and OIDC identity providers, and personal AWS access.
• Business adds health findings, estimated cost per function, and the IP allowlist.
• Enterprise has the Business features with the highest limits.

#Why do Business and Enterprise appear as add-ons?

On the FunctionPilot listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it is in the contract too, so an add-on bought on its own grants nothing. Starter is a separate listing, FunctionPilot Starter.

#How are AWS accounts counted?

Each distinct AWS account among your connections counts once, the hub account included. When all are in use, new accounts can't be connected; accounts already connected keep working.

#What happens when the contract ends?

FunctionPilot stops working within minutes: every page says a licence is required, and only the licence page works for administrators. All data stays in your account, and subscribing again unlocks it. If AWS License Manager is briefly unreachable, the last active plan keeps working for 72 hours.

#What else do I pay for?

The AWS resources the stack uses in your account are billed to you by AWS as usual. FunctionPilot is serverless, so it costs close to nothing while nobody is using it.

Administrators see the estimated CloudWatch cost of the last 30 days, and what the cache saved, on Administration › Licence and about. Raising Metrics freshness in Settings lowers it further. Reading logs with filter patterns, and the Lambda control plane, cost nothing per call.

#Deployment

#Which AWS Regions are supported?

Any Region with AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-west-2, eu-central-1 and ap-southeast-2. The same template URL works in every Region. The Region you deploy to doesn't limit which Regions' functions you can see: each connection lists the Regions to show.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. See Getting started and the installation guide.

#Does anything run in my VPC?

Only a one-off installer task, for about a minute at install and at each upgrade. It needs outbound HTTPS. Nothing accepts inbound connections, and the rest of the stack is serverless.

#Does it work with many AWS accounts?

Yes. Deploy the spoke role template in each account, or across an AWS Organization with a StackSet. FunctionPilot assumes that role with an external ID, and the role's access level (ReadOnly, Operate or Full) is the upper limit of what it can do there. The function table then shows every account and Region together. See Deploy the spoke role in other accounts. Alternatively, with personal AWS access, people use the accounts their IAM Identity Center permission sets give them, with nothing to deploy in those accounts.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Data and security

#Does any data leave my account?

No. Everything FunctionPilot stores (connections, grants, saved tests and their results, cached metrics and the audit log) stays in your account. Cloud Certainty runs no service in the data path, and FunctionPilot sends no telemetry. The licence check is a read from AWS License Manager in your own account. The only outbound request to us is the optional daily read of a public release manifest, which sends nothing about you; set UpdateChecks to Disabled to turn it off. See the security overview.

#Can users only see what they are granted?

Yes. Users see no functions until an administrator grants them access, by function name pattern, per account and Region. Each request runs with short-lived AWS credentials that a session policy limits to the user's grants, and CloudTrail records the user's email on every call.

#Can users work with their own AWS permissions?

Yes, on Team and above, if you turn it on. People connect their IAM Identity Center session or their IAM user's keys, and AWS decides what they can do, exactly as in the AWS console. See Personal AWS access.

#Can FunctionPilot change my functions' code or delete functions?

No. It can change configuration, environment variables, versions, aliases and reserved concurrency, and only where the connection's access level is Full and the user has the matching grant. It never uploads code or deletes functions.

#How does it compare with the Lambda console?

FunctionPilot doesn't replace the AWS console for everything, and each function page links to it. It covers what teams miss there:

#Upgrades

#How do I install a new release?

Each release is a new template. Update the stack with the new template URL and keep your parameter values. Administrators see a banner when a new release is out. See the upgrading guide and the release notes.

#How do I change plan?

Between Team, Business and Enterprise, no stack update is needed: the new features turn on when the new contract is active. See Changing plan.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. We respond within one business day. Paid support plans with response times are on the support page.

#Does Cloud Certainty have access to my account?

No. We have no access to your account and FunctionPilot doesn't give us any. When you ask for help, you share what you choose, such as an error message or a log line.