# AWS Lambda Microvms

Build, run, debug, and operate applications on AWS Lambda MicroVMs, ...

- Repository: https://github.com/awslabs/agent-plugins (933 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-15
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add awslabs/agent-plugins --skill aws-lambda-microvms -g -a claude-code -y`
Codex: `npx skills add awslabs/agent-plugins --skill aws-lambda-microvms -g -a codex -y`
Cursor: `npx skills add awslabs/agent-plugins --skill aws-lambda-microvms -g -a cursor -y`
Gemini CLI: `npx skills add awslabs/agent-plugins --skill aws-lambda-microvms -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add awslabs/agent-plugins`

## Description

Build, run, debug, and operate applications on AWS Lambda MicroVMs, Firecracker-isolated, snapshot-resumable serverless compute environments that run inside a container with up to 8-hour lifetimes. Triggers on: Lambda MicroVMs, Firecracker isolation, snapshot-resumable compute, suspend/resume, sandboxed or untrusted code execution, AI/agent code-execution sandboxes, interactive code playgrounds and notebooks (Jupyter, REPLs), reinforcement-learning environments, multi-tenant CI executors and build runners, sessionful game or simulation servers, isolated security scanners, long-lived sessions, or port-listening servers (gRPC, WebSocket, custom TCP). For standard event-driven Lambda functions, use the aws-lambda skill instead.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Lambda MicroVMs

> The AWS MCP server is recommended for sandboxed execution and audit logging.

AWS Lambda MicroVMs are serverless compute environments that combine Firecracker VM isolation with container-like efficiency. Each MicroVM:

- Runs your application as a **container inside a Firecracker microVM**, you can reproduce the environment locally.
- Runs Amazon Linux 2023 as the base OS inside the MicroVM.
- Boots from a **memory + disk snapshot** captured at image build time, so application init is skipped on run.
- Has a dedicated, TLS-terminated HTTPS endpoint reachable with an auth token.
- Can be **suspended and resumed** with state preserved; lives up to 8 hours.

**Two-resource model:**

- `MicrovmImage`, a versioned artifact built from `{S3 zip with Dockerfile} + baseImageArn`. Each version has per-architecture/chipset `Build`s.
- `Microvm`, a running instance created (`RunMicrovm`) from an image version.

**Two roles:**

- `buildRoleArn`, used during image build (S3 read, CloudWatch logs, optional ECR).
- `executionRoleArn`, assumed at runtime by the running MicroVM.

## When to use

### Choose Lambda MicroVMs when

- **Analytics workloads**, isolated compute for data processing, ETL jobs, or query execution with strong tenant separation.
- **AI / agent code execution sandboxes**, fresh, isolated environment per session, fast resume between turns.
- **Interactive code playgrounds & notebooks**, Jupyter, REPLs, dev environments executing user code.
- **Reinforcement-learning environments**, clean per-episode envs with tool access.
- **Multi-tenant CI executors / build runners**, strong tenant isolation.
- **Game / simulation servers**, sessionful, long-lived (up to 8 hr) workloads.
- **Security scanning**, running untrusted analyzers in isolation.

The rest: https://github.com/awslabs/agent-plugins/blob/HEAD/plugins/aws-serverless/skills/aws-lambda-microvms/SKILL.md