Core Concepts

Understanding Lambda's fundamental concepts will help you make the most of the platform.

Instances
Regions
Storage
Networking
SSH Keys
Snapshots
Firewall
Privacy Zones

Instances

An instance is an isolated compute environment where your applications run.

Instance Lifecycle

States

State	Description	Billing
Creating	Instance is being provisioned	No
Running	Instance is active and accessible	Yes
Stopped	Instance is paused	Storage only
Destroyed	Instance is permanently deleted	No

Instance Types

Lambda offers various instance types optimized for different workloads:

Compute-Optimized (compute-*)

Best for CPU-intensive applications:

Type	vCPU	RAM	Storage	Network	Price/hr
compute-1x	1	2GB	25GB	1Gbps	$0.05
compute-2x	2	4GB	50GB	2Gbps	$0.10
compute-4x	4	8GB	100GB	5Gbps	$0.20
compute-8x	8	16GB	200GB	10Gbps	$0.40
compute-16x	16	32GB	400GB	10Gbps	$0.80

Memory-Optimized (memory-*)

Best for memory-intensive applications:

Type	vCPU	RAM	Storage	Network	Price/hr
memory-2x	2	16GB	50GB	2Gbps	$0.15
memory-4x	4	32GB	100GB	5Gbps	$0.30
memory-8x	8	64GB	200GB	10Gbps	$0.60
memory-16x	16	128GB	400GB	10Gbps	$1.20

Storage-Optimized (storage-*)

Best for I/O-intensive applications:

Type	vCPU	RAM	Storage	IOPS	Price/hr
storage-2x	2	8GB	500GB	10K	$0.20
storage-4x	4	16GB	1TB	20K	$0.40
storage-8x	8	32GB	2TB	40K	$0.80

GPU-Enabled (gpu-*)

Best for ML/AI workloads:

Type	GPU	vCPU	RAM	Storage	Price/hr
gpu-1x	1x A100	8	64GB	500GB	$2.50
gpu-2x	2x A100	16	128GB	1TB	$5.00
gpu-4x	4x A100	32	256GB	2TB	$10.00

Regions

A region is a geographic location where your instance runs.

Available Regions

Code	Location	Latency (US West)	Status
us-west-1	California, USA	-	✓
us-east-1	Virginia, USA	~70ms	✓
eu-west-1	Ireland	~140ms	✓
eu-central-1	Frankfurt, Germany	~160ms	✓
ap-southeast-1	Singapore	~180ms	✓
ap-northeast-1	Tokyo, Japan	~100ms	✓
ap-south-1	Mumbai, India	~220ms	✓
sa-east-1	São Paulo, Brazil	~200ms	✓

Choosing a Region

Considerations:

Latency: Choose closest to your users
Compliance: Some regions for specific regulations (GDPR, etc.)
Availability: Check region status before deploying critical workloads
Pricing: Pricing is consistent across regions

Region Features

All regions support:

✓ Secure enclaves (SGX or SEV)
✓ Same instance types
✓ Same pricing
✓ Same privacy guarantees
✓ Cross-region networking

Storage

Lambda provides encrypted, high-performance storage for your instances.

Storage Types

Root Volume

Automatically created with every instance
Contains OS and system files
Size depends on instance type
Encrypted at rest
Persists when instance is stopped
Deleted when instance is destroyed

Data Volumes

Additional storage you can attach
Independent lifecycle from instances
Can be attached/detached dynamically
Fully encrypted
Snapshots available
Can be resized online

Storage Features

┌─────────────────────────────────────┐
│        Your Application             │
└───────────┬─────────────────────────┘
            │
            ▼
┌─────────────────────────────────────┐
│     Encrypted File System           │
│  (Your Encryption Key Required)     │
└───────────┬─────────────────────────┘
            │
            ▼
┌─────────────────────────────────────┐
│       NVMe SSD Storage              │
│   (Hardware-Level Encryption)       │
└─────────────────────────────────────┘

Creating Data Volumes

Via Dashboard:

Go to Dashboard → Volumes
Click "Create Volume"
Configure:
- Name: my-data
- Size: 100 GB
- Region: us-west-1
Click "Create"
Attach to instance: Click volume → "Attach" → Select instance

Via CLI:

# Create a 100GB volume
lambda create volume \
  --name my-data \
  --size 100GB \
  --region us-west-1

# Attach to instance
lambda attach volume vol_abc123 --instance inst_xyz789

# Inside instance, mount it
sudo mkfs.ext4 /dev/vdb
sudo mount /dev/vdb /mnt/data

Pricing

Resource	Price
Root volume	Included in instance price
Data volume	$0.10/GB/month
Snapshot	$0.05/GB/month
I/O operations	Free (no per-operation charges)

Networking

Lambda provides private, isolated networking with optional public internet access.

Network Architecture

              Internet
                 │
                 ▼
      ┌────────────────────────┐
      │    Load Balancer       │
      │   (Optional, Public)   │
      └──────────┬─────────────┘
                 │
                 ▼
      ┌───────────────────────┐
      │   Firewall Rules      │
      │  (You Control Access) │
      └──────────┬────────────┘
                 │
                 ▼
      ┌───────────────────────┐
      │   Your Instance       │
      │ (Private Network)     │
      └───────────────────────┘

IP Addresses

Public IP

Assigned to each instance by default
Static (doesn't change unless you release it)
Used for internet access
Can be disabled for completely private instances

Private IP

Used for instance-to-instance communication
Never exposed to internet
Free inter-instance traffic
Supports VPN connections

Networking Commands

# List network interfaces
lambda network list inst_abc123

# Assign static IP
lambda network assign-ip inst_abc123

# Enable private networking
lambda network create-vpc \
  --name my-private-network \
  --cidr 10.0.0.0/16

# Add instance to VPC
lambda network attach inst_abc123 --vpc vpc_xyz789

Bandwidth

Instance Type	Bandwidth	Data Transfer Cost
compute-1x/2x	1-2 Gbps	Free
compute-4x/8x	5-10 Gbps	Free
compute-16x+	10 Gbps	Free

Lambda doesn't charge for data transfer (egress is free)

SSH Keys

SSH keys are used to securely authenticate to your instances.

Key Management

# Generate a new SSH key
ssh-keygen -t ed25519 -C "lambda-access"

# Add key to Lambda
lambda ssh-keys add \
  --name my-laptop \
  --file ~/.ssh/id_ed25519.pub

# List keys
lambda ssh-keys list

# Remove key
lambda ssh-keys remove key_abc123

Best Practices

Use Strong Keys: ED25519 or RSA 4096-bit
One Key Per Device: Don't share keys across multiple machines
Rotate Regularly: Update keys every 90 days
Use SSH Agent: Never copy private keys to instances
Backup Keys: Store encrypted backups of private keys

Connecting

# Using default key
ssh lambda@203.0.113.42

# Specify key
ssh -i ~/.ssh/my-key lambda@203.0.113.42

# Using Lambda CLI (automatic)
lambda ssh inst_abc123

Snapshots

Snapshots are point-in-time backups of your instances or volumes.

Snapshot Lifecycle

Creating Snapshots

# Snapshot entire instance
lambda snapshot create inst_abc123 \
  --name "before-update" \
  --description "Pre-deployment backup"

# Snapshot specific volume
lambda snapshot create vol_xyz789 \
  --name "data-backup"

# List snapshots
lambda snapshot list

# Restore from snapshot
lambda create instance \
  --from-snapshot snap_abc123 \
  --name restored-instance

Snapshot Features

Incremental: Only changes since last snapshot are stored
Encrypted: Snapshots maintain encryption
Cross-Region: Copy snapshots to other regions
Versioned: Keep multiple snapshots with automatic cleanup

Automation

# Schedule daily snapshots
lambda snapshot schedule inst_abc123 \
  --frequency daily \
  --time "02:00 UTC" \
  --retain 7

# Schedule weekly snapshots
lambda snapshot schedule inst_abc123 \
  --frequency weekly \
  --day sunday \
  --retain 4

Firewall

Lambda's firewall controls network access to your instances.

Default Rules

By default:

✓ All outbound traffic allowed
✗ All inbound traffic blocked (except SSH on port 22)

Firewall Rules

# Allow HTTP traffic
lambda firewall allow inst_abc123 \
  --port 80 \
  --protocol tcp \
  --source 0.0.0.0/0

# Allow HTTPS traffic
lambda firewall allow inst_abc123 \
  --port 443 \
  --protocol tcp \
  --source 0.0.0.0/0

# Allow from specific IP
lambda firewall allow inst_abc123 \
  --port 3000 \
  --source 203.0.113.0/24

# List rules
lambda firewall list inst_abc123

# Remove rule
lambda firewall remove inst_abc123 --rule rule_abc123

Common Configurations

Web Server

lambda firewall allow inst_abc123 --port 80 --source 0.0.0.0/0
lambda firewall allow inst_abc123 --port 443 --source 0.0.0.0/0

Database Server (Private)

# Allow only from your app server
lambda firewall allow inst_db123 \
  --port 5432 \
  --source 10.0.1.0/24

Development Server

# Allow only from your IP
lambda firewall allow inst_abc123 \
  --port 3000 \
  --source $(curl -s ifconfig.me)/32

Privacy Zones

Privacy Zones define boundaries of encrypted, isolated workspaces.

What Are Privacy Zones?

Privacy Zones are logical groupings of instances that share:

Network isolation
Encryption policies
Access controls
Audit boundaries

Creating Privacy Zones

# Create zone
lambda zone create \
  --name production \
  --encryption-level maximum \
  --audit-enabled true

# Add instance to zone
lambda zone add-instance zone_abc123 --instance inst_xyz789

# List zones
lambda zone list

# Zone info
lambda zone info zone_abc123

Encryption Levels

Level	Description	Use Case
Standard	Disk encryption, TLS	General workloads
High	+ Memory encryption (SEV)	Sensitive data
Maximum	+ Secure enclaves (SGX)	Highly regulated

Inter-Zone Communication

By default, zones are isolated. To enable communication:

lambda zone peer zone_prod123 --with zone_staging456

Next Steps

Now that you understand the core concepts:

Think Lambda, Think Privacy

Core Concepts

On this page