User guide

FunctionPilot is a web console for the AWS Lambda functions your organization has connected. Open the portal URL your administrator gave you and sign in with your company account. You see the functions an administrator granted you, across AWS accounts and Regions, and what you may do with each one depends on your permissions:

Buttons for actions you can't take are greyed out, and their tooltip says why. Some features depend on your organization's plan (Starter, Team, Business or Enterprise); a feature the plan doesn't include shows a plan badge, for example Team or Business. This guide notes the plan next to each such feature.

The top bar has Functions, Findings, My tests and, for administrators, Administration. Press Ctrl K (⌘K on a Mac) anywhere to jump to a function or page. The footer has a theme switch (System, Light, Dark).

#Functions

The home page is one table of every function you can see, in every connected account and Region.

Screenshot

#Timeframe

Choose 15m, 1h, 3h, 12h, 24h, 3d, 7d, 14d or 30d, or Custom for a start and end of your own. The Starter plan allows ranges up to 7 days; Team and above up to 30 days. Every number in the table covers the whole timeframe. The timeframe is part of the page's link, so a link you share opens on the same range.

#Columns

Choose Columns to show or hide columns and Reset columns to go back to the defaults. Max, Max concurrency, Timeout, Arch and Code size are hidden by default. Comfortable and Compact change the row height. Your columns and density are remembered in this browser.

#Totals, sorting and filters

• Totals. The tiles above the table, and the first row of the table, total the functions that match your search and filters: functions, invocations, errors, error rate, throttles and the estimated cost. The average duration total is weighted by invocations.
• Sort by any column by choosing its heading; choose it again to reverse the order.
• Search (/) matches names, descriptions and runtimes. Press Enter in the search box to open the first match.
• Filters: Account, Region and Runtime (with counts), and the chips Has errors, Deprecated runtime and No invocations. Clear filters resets them.
• Export CSV downloads the rows that match, in the current order, with the visible columns.
• Keyboard: ↑ and ↓ (or j and k) move through rows, Enter opens one. Ctrl or ⌘ with a click opens a function in a new tab.

#Freshness and Refresh

FunctionPilot shares CloudWatch numbers between everyone in your organization, so a team opening the table at once costs one CloudWatch request, not one each. Next to Refresh, Updated n min ago says when the oldest numbers on the page were fetched from AWS; "refreshing" means newer numbers are on their way.

• How long numbers are reused depends on the timeframe: 1 minute for ranges up to an hour, 5 minutes by default up to 24 hours (your administrator can change this), 15 minutes up to 14 days and 30 minutes for 30 days. A custom range that ended in the past doesn't change, so it is kept longer.
• With Auto-refresh on (the default), the page reads the numbers again every few minutes while the tab is visible, and stops while it is hidden.
• Refresh asks CloudWatch again, unless the numbers are less than 30 seconds old.

#Notices above the table

Screenshot

• "n Region could not be loaded" names the account, Region and the AWS error. The table shows everything else; choose Try again.
• "Metrics for some functions in ... are not loaded yet. Refresh to load the rest." In a Region with many functions, FunctionPilot returns what it has before the request times out. Those functions show not loaded in the metric columns and aren't counted in the totals until you choose Refresh in the notice.
• A Region with more than 2,000 functions shows only the first 2,000, and says so.

#Function page

Open a function from the table, the command palette or a link. The header shows the account, Region, runtime, architecture and memory, with Test, Logs, Copy ARN and AWS console (opens the function in the AWS Lambda console, where you sign in to AWS separately).

#Overview

Screenshot

• Charts on one timeframe: invocations, errors and throttles; duration (average, p50, p95, p99, maximum); concurrency; and, when the function has them, iterator age, asynchronous event age, dead-letter and destination delivery failures. Choose a version or alias to chart it alone, and Table under a chart to see its numbers.
• Recent invocations (needs logs): the latest invocations from the function's REPORT log lines, with duration, billed duration, memory used and the init duration of cold starts. Choose a request id to see all of that request's logs.
• Key configuration, Triggers (event source mappings with their state and last result, and the function URL, in red when it is public) and Destinations (on success, on failure, dead-letter queue, retries and maximum event age).

#Configuration

Screenshot

Readable cards for the general settings, environment variables, execution role, network and storage, monitoring and logging, runtime and layers, function URL, asynchronous invocation, the resource-based policy (statements that allow anyone are flagged public) and tags.

• Environment variables. Names are always shown. Whether you see the values is an administrator setting: people with edit (the default), everyone who can view the function, or administrators only. Shown values are masked until you choose Reveal or Show values.
• Edit (edit, Team and above, on a connection with the Full access level) changes memory, timeout, ephemeral storage, the description and environment variables. Saving the variables replaces all of them; the editor shows how much of Lambda's 4 KB limit you use. If someone else changed the function since you opened it, the save is refused rather than overwriting their change. Changes apply to $LATEST.
• Download code (edit, Team and above, zip functions) downloads the deployment package through a short-lived link. Downloads are audited.

#Versions and aliases

Screenshot

Aliases show their routing as a split bar. With manage (Team and above, on a connection with the Full access level) you can Publish version (freeze the current code and configuration of $LATEST as a numbered version), Create alias, edit an alias (including a weighted second version) and delete one.

#Concurrency

Reserved concurrency, with the account's limit and how much is already reserved in the Region, and the provisioned concurrency of each version or alias (shown, not changed). With manage (Team and above) you can set or remove reserved concurrency.

#Test workbench

The Test tab (needs invoke, and a connection with the Operate or Full access level) runs events against the function and keeps what happened.

Screenshot

• Event JSON. Write the event, or insert one from Template: API Gateway REST (v1 proxy), API Gateway HTTP API (v2) or function URL, Application Load Balancer, SQS, SNS, S3 object created, EventBridge, DynamoDB stream, Kinesis stream, scheduled event and the Cognito pre sign-up trigger. The editor checks the JSON as you type (line and column of any error) and has Format and Minify. Events up to 256 KiB.
• Version or alias: $LATEST, a version or an alias.
• Invocation: Synchronous (waits for the response and the last 4 KB of logs), Asynchronous (queues the event; no response or logs) or Dry run (checks you may invoke the function without running it).
• Run (or Ctrl+Enter, ⌘+Enter).

The result shows the status (and the function error, if any), a Cold start badge with the init duration when the run started a new execution environment, the duration, the billed duration and the round trip, memory used against the memory size, the version that ran, the request id, the response (the first 64 KiB) and the log output. View full logs for this request opens the log explorer on that request.

#Saved tests

Save an event to run it again later; there is no limit of 10 events per function as in the Lambda console. Your plan sets how many saved tests each person may have.

Screenshot

• Private (the default): only you and administrators see it.
• Public (Team and above): everyone who can invoke the function can see it and run it, including its payload and its runs. Don't put secrets or real customer data in a public test. Only the owner or an administrator can change, rename or delete it.

The side panel lists Mine and Shared with you, with the result and time of each test's last run. Save, Save as…, Rename, Make public, Make private and Delete act on the selected test; deleting a test deletes its run history.

#Run history

• Every run of a saved test is kept, with its payload, response, log output and timings: the latest 5 on Starter, 20 on Team, 50 on Business and 100 on Enterprise. The runs of a public test are visible to everyone who can see the test.
• For an unsaved event, tick Save this result to my history to keep that run for 90 days.
• Choose Compare on a stored run to see it side by side with the current result.

My tests in the top bar lists your saved tests across every function, with their last run.

Screenshot

#Logs

The Logs tab (needs logs) shows the function's own CloudWatch log group, including a custom log group set in the function's logging configuration. You never choose a log group.

Screenshot

• Timeframe: as on the Functions page.

• Filter pattern: any CloudWatch Logs filter pattern; Syntax lists examples:

  Pattern	Matches
  timeout	lines containing the word (terms are case-sensitive)
  ERROR Exception	lines containing both
  ?ERROR ?WARN	lines containing either
  "connection reset"	an exact phrase
  ERROR -Retrying	ERROR but not Retrying
  { $.level = "ERROR" }	JSON logs by field
  { $.durationMs > 1000 }	numeric JSON fields
  %5\d\d%	a regular expression

• Levels: the chips ERROR, WARN, INFO and DEBUG narrow the lines to those levels.

• Request id: shows one invocation. A level or request id can't be combined with a JSON, space-delimited or ? (either) pattern; clear one of them.

• Streams: limit the view to some log streams (execution environments).

• Lines are parsed: levels are coloured, request ids are shown as short chips, JSON is pretty-printed, and START, END and REPORT lines are recognised. Load earlier and Load newer page through the timeframe.

• Download: as text, as JSON, or copy to the clipboard.

#Group by invocation

By invocation groups the lines of each request under one row with its duration and memory, and badges for Cold, Error and Running or cut off (the invocation is still running, or some of its lines fall outside the timeframe). Open a row to see its lines.

Screenshot

#Live tail

Turn on Live tail to follow new lines as they arrive (FunctionPilot checks every 2 seconds). When you scroll up, following pauses and counts new lines; Resume following goes back to the latest. The timeframe is fixed while live tail is on.

#Logs Insights

Logs › Logs Insights (Team and above, needs logs) runs CloudWatch Logs Insights queries on the function's log group, which FunctionPilot sets for you.

Screenshot

The Query library has ready queries:

Edit any query or write your own, choose the timeframe and a Row limit (up to 10,000), and Run query (Ctrl+Enter). The status shows records matched, records scanned and bytes scanned; Logs Insights is billed per GB scanned. The same query on the same timeframe is answered from a shared cache for a few minutes; Run again without cache asks CloudWatch again. Stop cancels a running query and Export CSV downloads the results.

#Findings

Findings (Business and above) checks every function you can see, from its configuration, 30 days of metrics and the runtime deprecation dates. Results are refreshed about once an hour.

Screenshot

Search the findings, filter by Kind, and Export CSV. In a Region with very many functions, some detailed checks (function URL and failure destination) may be skipped in one pass; the page says so, and a later refresh completes them.

#Command palette

Press Ctrl K (⌘K on a Mac), or choose Go to… in the top bar, and type part of a function or page name. Results show your recent functions first, then pages and matching functions with their account, Region and runtime. Use ↑ and ↓ to move, Enter to open and Esc to close.

Screenshot

#Your AWS access

If your administrator turned on personal AWS access (Team and above), the top bar has Your AWS access. There you connect your IAM Identity Center session or your IAM user's access keys and work with your own AWS permissions: AWS alone decides what you can do, and CloudTrail records your own identity. Functions from these connections carry a Your AWS access badge in the table. If you sign in to FunctionPilot through IAM Identity Center while this is on, you must connect before you see any function. See Personal AWS access for the steps.

#When something is refused