Lambda Constructs

CDK constructs for deploying Node.js Lambda functions with opinionated defaults and optional Datadog instrumentation.

---

NodeLambda

A higher-level Node.js Lambda construct that wires up a NodejsFunction, a dedicated CloudWatch log group, and a least-privilege execution role in one step.

Key features:

• Builds the function name as <serviceName>-<functionName>-<environment> by default. Set forceFunctionName: true to use the exact value of functionName.
• Creates a CloudWatch log group at /aws/lambda/<serviceName>-<functionName>-<environment> (or /aws/lambda/<functionName>-logs when forceFunctionName is true).
• Creates a dedicated IAM execution role with AWSLambdaBasicExecutionRole plus built-in read access to the shared Secrets Manager secret and its KMS key. Additional statements can be injected via lambdaExecutionRoleAdditionalPermissions. The role name is generated by CloudFormation unless executionRoleName is set.
• Injects ENVIRONMENT_NAME, ENV, DD_GIT_COMMIT_SHA, and DD_VERSION environment variables automatically.
• Tags all created resources (Name tag).
• Optionally instruments the function with Datadog via datadogEnabled / datadogConfig.

Validation rules:

• functionName: 3–40 characters, letters/numbers/hyphens only.
• serviceName: 3–20 characters, letters/numbers/hyphens only.
• entry: must end in .ts or .js.
• timeout: 1 second – 15 minutes.
• memorySize: 128–10 240 MB.

Props (NodeLambdaProps):

The props are also documented in API docs

Prop	Type	Default	Description
functionName	string	—	Function name component. Used as <serviceName>-<functionName>-<environment> unless forceFunctionName is set.
forceFunctionName	boolean	false	Use the exact value of functionName instead of the composed name.
serviceName	string	—	Service name prefix used in resource naming and as the default Datadog service name.
executionRoleName	string	CloudFormation-generated	Explicit IAM role name for the execution role. Max 64 characters and must be unique within the account.
environment	FinnairEnv	—	Deployment environment/phase injected into naming and environment variables.
entry	string	—	Path to the Lambda entry file (.ts or .js).
handlerName	string	'handler'	Exported handler function name.
runtime	Runtime	Runtime.NODEJS_24_X	Node.js Lambda runtime.
timeout	Duration	Duration.seconds(30)	Function timeout.
architecture	Architecture	Architecture.ARM_64	CPU architecture.
memorySize	number	256	Memory in MB.
environmentVariables	Record<string,string>	—	Additional environment variables merged on top of the built-in defaults.
logGroupClass	LogGroupClass	INFREQUENT_ACCESS	CloudWatch log group class.
logRetention	RetentionDays	RetentionDays.SIX_MONTHS	Log retention period.
logRemovalPolicy	RemovalPolicy	RemovalPolicy.RETAIN	Removal policy for the log group.
disableCloudWatchLogs	boolean	false	Deny the role CloudWatch log writes so logs only go to Datadog. See Sending logs to Datadog.
loggingFormat	LoggingFormat	LoggingFormat.JSON	Lambda log format.
systemLogLevelV2	SystemLogLevel	SystemLogLevel.WARN	System log level.
applicationLogLevelV2	ApplicationLogLevel	ApplicationLogLevel.INFO	Application log level.
lambdaExecutionRoleAdditionalPermissions	PolicyStatement[]	—	Extra IAM statements added to the execution role's inline policy.
managedPolicies	IManagedPolicy[]	—	Managed policies attached to the execution role in addition to AWSLambdaBasicExecutionRole.
bundling	BundlingOptions	{}	esbuild bundling options. See also the bundling presets below.
currentVersionOptions	VersionOptions	—	Options for the auto-created Lambda version.
datadogEnabled	boolean	false	Enable Datadog instrumentation.
datadogConfig	DatadogConfig	—	Datadog configuration. See DatadogConfig below.
description	string	—	Human-readable function description.
ephemeralStorageSize	Size	512 MiB	Size of the /tmp ephemeral storage.
filesystem	FileSystem	—	EFS filesystem configuration.
reservedConcurrentExecutions	number	—	Reserved concurrency limit.
retryAttempts	number	2	Async invocation retry attempts (0–2).
vpc	IVpc	—	VPC to place the function in. Requires vpcSubnets.
vpcSubnets	SubnetSelection	—	Subnet selection when vpc is provided.
securityGroups	ISecurityGroup[]	—	Security groups to associate when vpc is provided.
layers	ILayerVersion[]	—	Lambda layers to attach.
tracing	Tracing	Tracing.DISABLED	AWS X-Ray tracing mode.

Outputs:

Property	Description
lambdaFunction	The underlying NodejsFunction instance.
logGroup	The CloudWatch LogGroup for the function.
lambdaExecutionRole	The IAM role attached to the function.

---

DatadogConfig (type)

Optional Datadog instrumentation settings passed via NodeLambdaProps.datadogConfig. All fields are optional and fall back to sensible defaults.

Field	Type	Default	Description
service	string	serviceName	Service name shown in Datadog. Defaults to the construct's serviceName.
enableDatadogTracing	boolean	true	Enable Datadog APM tracing.
site	string	'datadoghq.eu'	Datadog site to send telemetry to.
addLayers	boolean	true	Automatically attach the Datadog Lambda layers.
nodeLayerVersion	number	see below	Datadog Node.js layer version.
extensionLayerVersion	number	see below	Datadog Extension layer version.
flushMetricsToLogs	boolean	false	Send custom metrics via CloudWatch Logs (Forwarder mode). Disabled by default.
captureLambdaPayload	boolean	false	Capture Lambda request/response payloads in Datadog APM.
sourceCodeIntegration	boolean	false	Link telemetry to Git source via Datadog source code integration.
enableDatadogLogs	boolean	false	Forward Lambda logs to Datadog via the Lambda Extension.

The default layer versions are DATADOG_NODE_LAYER_VERSION and DATADOG_EXTENSION_LAYER_VERSION in config.ts. Renovate keeps them up to date and opens a separate, non-automerged PR when a new layer is released. If you override nodeLayerVersion / extensionLayerVersion, your functions stop getting these managed updates.

Sending logs to Datadog

Two independent flags control where the function's logs go:

• datadogConfig.enableDatadogLogs (needs datadogEnabled: true) forwards logs to Datadog through the Lambda Extension.
• disableCloudWatchLogs stops logs from being written to CloudWatch. It adds an explicit Deny on logs:CreateLogStream and logs:PutLogEvents for the function's log group, following the Datadog guide. The log group is still created but stays empty.

Logs go to	enableDatadogLogs	disableCloudWatchLogs
CloudWatch (default)	false	false
Datadog + CloudWatch	true	false
Datadog only	true	true

new NodeLambda(this, 'MyFunction', {
  // ...
  disableCloudWatchLogs: true,
  datadogEnabled: true,
  datadogConfig: { enableDatadogLogs: true },
})
Copy

Before you set disableCloudWatchLogs:

• Check that the logs show up in Datadog first. Logs the extension can't deliver (e.g. no network route to Datadog from a VPC) are lost.
• It requires datadogEnabled: true and datadogConfig.enableDatadogLogs: true, otherwise synth fails, so logs always go somewhere.
• It can't be combined with flushMetricsToLogs: true, because that mode sends metrics through CloudWatch Logs; synth fails.

---

Bundling presets

Two ready-made BundlingOptions objects are exported for ESM output:

LAMBDA_BUNDLING_OPTS_NODEJS_ESM

Bundles in ESM format and excludes the AWS SDK from the build artifact, relying on the SDK version bundled in the Lambda runtime.

import { LAMBDA_BUNDLING_OPTS_NODEJS_ESM } from '@finnair/cdk-constructs'

new NodeLambda(this, 'MyFunction', {
  // ...
  bundling: LAMBDA_BUNDLING_OPTS_NODEJS_ESM,
})
Copy

LAMBDA_BUNDLING_OPTS_NODEJS_ESM_BUNDLE_SDK

Same as above but includes the AWS SDK in the artifact. Use this when you need a specific SDK version that differs from the one in the runtime.

import { LAMBDA_BUNDLING_OPTS_NODEJS_ESM_BUNDLE_SDK } from '@finnair/cdk-constructs'

new NodeLambda(this, 'MyFunction', {
  // ...
  bundling: LAMBDA_BUNDLING_OPTS_NODEJS_ESM_BUNDLE_SDK,
})
Copy

---

Example

Minimal

new NodeLambda(this, 'MyFunction', {
  functionName: 'my-function',
  serviceName: 'my-service',
  environment: 'prod',
  entry: path.resolve(import.meta.dirname, '../src/handler.ts'),
})
Copy

With Datadog and custom IAM permissions

import { PolicyStatement, Effect } from 'aws-cdk-lib/aws-iam'
import { Duration } from 'aws-cdk-lib'

new NodeLambda(this, 'MyFunction', {
  functionName: 'my-function',
  serviceName: 'my-service',
  environment: 'prod',
  entry: 'src/handlers/my-function.ts',
  timeout: Duration.seconds(60),
  memorySize: 512,
  environmentVariables: {
    TABLE_NAME: myTable.tableName,
  },
  lambdaExecutionRoleAdditionalPermissions: [
    new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ['dynamodb:GetItem', 'dynamodb:PutItem'],
      resources: [myTable.tableArn],
    }),
  ],
  datadogEnabled: true,
})
Copy