To make a human-in-the-loop Lambda durable function safe to resume, keep orchestration deterministic, put external work inside durable operations, make side effects idempotent, and pin production executions to numbered function versions. A callback pauses the workflow; it does not freeze the handler’s code path. When the workflow resumes, the handler starts at the beginning and must follow the same operation history represented by its checkpoints.
What replay means in a Lambda durable execution
The handler starts over, but completed operations use checkpoints
A durable execution can span multiple Lambda invocations. When the function reaches a durable wait or callback, the SDK checkpoints the operation and suspends the execution. Once it can continue, Lambda invokes the handler again and the SDK reads the saved execution state. The handler runs from its beginning; as it reaches previously completed durable operations, their stored results are returned instead of rerunning their completed operation bodies. Ordinary code outside durable operations runs again on each replay. AWS describes the invocation lifecycle, and its replay guidance explains the determinism requirement.
As an Amazon Associate I earn from qualifying purchases.
“Replay bug” is a failure pattern, not a named AWS error
The phrase describes a mismatch: the handler’s current control flow or operation inputs no longer line up with the execution’s checkpoint history. If replay takes a different branch or reaches operations in a different sequence, the SDK can encounter non-determinism errors or, in some cases, silent failures. AWS’s practical rule is: “Any code that is not inside a durable operation must be a pure function of the handler inputs and the results of completed operations.” AWS’s determinism best practices explain this rule.
Where the human approval boundary belongs
Use a callback for an external decision-maker
A callback is the durable handoff when a person or external system must make a decision. The function creates a callback and receives a unique callback ID; it sends that ID to the approval application, then suspends. The invocation ends while approval is pending, rather than continuously consuming Lambda execution time. After the external system calls SendDurableExecutionCallbackSuccess or SendDurableExecutionCallbackFailure, Lambda starts another invocation and replay continues with the callback result. The SDK also offers waitForCallback for callback submission-and-wait patterns. See the AWS callback operation reference.
#1 Best Overall
Make the approval request itself retry-safe
The callback records the wait; it does not make every surrounding external effect exactly once. Put the request send inside a durable step, or otherwise ensure it is safe to retry. An interruption before a step completes can cause its body to run more than once, so an approval notification, agent decision write, payment, or downstream update should use an idempotency key or equivalent deduplication where duplicates matter. Completed steps are skipped on replay, but durable steps use at-least-once execution semantics by default. AWS’s idempotency guidance covers this distinction.
Why a resumed agent can diverge from its saved history
Nondeterministic decisions outside durable operations
A replay can take a different route if ordinary handler code uses a changing value to choose which durable operation comes next. Examples to review include the current time, random values, mutable global state, or a fresh external lookup performed outside a durable operation. If that value affects a branch or operation input, the resumed handler may no longer match the checkpoint sequence. Put externally variable work inside durable operations and use their checkpointed results to drive subsequent deterministic orchestration. AWS’s testing guidance specifically flags nondeterministic replay, shared global state, and conditional-logic errors.
Rank #2
Deploying new code while an execution is paused
An execution started with $LATEST is not pinned to immutable code. If the function is updated before the execution resumes, it can continue on the changed code, which may interpret saved state differently. AWS warns that this can lead to “non-determinism errors or silent failures.” It also cautions against renaming steps or changing their behavior while executions are in progress. Start production executions using a numbered Lambda version or an alias that resolves to a numbered version. An alias can be moved to route new starts; existing executions remain associated with the version on which they started. See invocation behavior and durable-function best practices.
Free tools Windows power users keep installed
One-click scans. No signup required.
Confusing replay safety with exactly-once effects
Checkpointing prevents a completed step body from being run again just because the handler replays. It does not guarantee exactly-once execution for a step interrupted before completion. Execution names can help prevent duplicate execution starts, but they do not replace idempotency inside a step. For a write, charge, or message that must not take effect twice, design the destination operation to recognize and safely handle retries. AWS explains execution names and step idempotency.
How to test and diagnose a replay divergence
- Reproduce the pause and resume. Use the durable test environment or a suitable cloud test, including the callback or wait boundary. Exercise the branch conditions that may change between invocations.
- Find the first history mismatch. Inspect execution status, operation ordering, operation count, and per-operation results. Compare the first point where the resumed path differs from the recorded history; AWS documents testing approaches in its durable-function testing guide.
- Check the code version used at start and resume. Compare the execution’s version with deployment and alias changes made while it was suspended. Pay particular attention to executions started from
$LATEST. - Audit side effects and retries. Confirm that external effects are inside durable operations or independently retry-safe, and that operations with duplicate-impact risk have idempotency handling.
- Trace across services. For cloud runs, inspect execution history in CloudWatch Logs and use tracing to follow the request across services.
Design retries and terminal-failure handling separately
Set retry behavior for transient failures
Choose explicit retry strategies appropriate to each operation, including attempt limits, conditional retries, and exponential backoff where appropriate. Distinguish retries of an individual durable step from backend retries; they address different failure stages. AWS recommends configuring and monitoring retries rather than relying on an undifferentiated default. See retry guidance for Lambda durable functions.
Route and alert on executions that cannot recover
Retries do not handle every terminal failure. AWS recommends a dead-letter queue (DLQ) and EventBridge notifications for FAILED, STOPPED, and TIMED_OUT transitions, along with monitoring DLQ depth. These mechanisms help surface work requiring investigation or recovery. See AWS’s operational best practices.
Choose the right wait, version, and invocation model
| Decision | Use it when | Important constraint |
|---|---|---|
| Callback versus condition wait | Use a callback when an external actor can submit a result; use a condition wait when the workflow needs to check a predicate. | A durable wait suspends the invocation rather than holding it open. The current SDK wait reference documents a minimum duration of one second and a maximum of the maximum execution duration of one year; it also says a started wait cannot be canceled. Verify the current service documentation before relying on these limits. |
Numbered version versus $LATEST |
Use a numbered version for stable code during an in-progress production execution; use an alias as a movable reference for routing new starts. | An execution started with $LATEST can resume on updated code, so changed operation behavior or names can break replay. |
| Direct invocation versus event source mapping | Choose based on the event source and the workflow’s expected duration. | Event source mappings have their own total execution duration limits. AWS describes a 15-minute default and up to 90 minutes on Lambda Managed Instances, with service-specific exceptions. Check the exact source and capacity mode; an intermediary function pattern may be needed for longer workflows. See event source mapping constraints. |
A Lambda durable function is not AWS Step Functions: both coordinate workflows, but the replay behavior discussed here is specific to the Lambda durable execution SDK and its in-handler checkpoint history. The SDK documentation describes its operations and capabilities.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
