Skip to content

lambda-microvm-cdk

banner

A reusable AWS CDK v2 construct (pure Python, 3.11+) for provisioning AWS Lambda MicroVMs — Firecracker-based, VM-isolated, snapshot-fast serverless compute for AI sandboxes, interactive dev environments, and multi-tenant CI.

Install

pip install lambda-microvm-cdk

What you get

  • LambdaMicroVM — declarative AWS::Lambda::MicrovmImage: zip your Dockerfile+app, upload to S3, create least-privilege build + VM-execution roles, resolve the base-image version, and build a snapshotted image. Exposes typed properties (image_arn, execution_role, ingress_connector_arn / egress_connector_arn, log_group_name) and grant_run(principal).
  • MicrovmNetworkConnector — opt-in VPC egress: bring your own VPC and it wires up the rest — the AWS::Lambda::NetworkConnector, a security group that is the egress policy (deny-all by default), and a least-privilege ENI operator role. Pass it straight to LambdaMicroVM(egress_connectors=[...]). See MicroVM Image and Network Connector.

Parameter-driven with secure defaults (arm64, no extra OS capabilities, CloudWatch logging), every AWS knob overridable, plus an overrides escape hatch for anything not yet modeled.

See Getting Started, Security, and Pipeline.