iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To keep S3-triggered Lambda work recoverable, treat S3 notification delivery and Lambda’s asynchronous invocation as separate failure points. Lambda’s retry settings apply after Lambda accepts an event; they do not define S3’s delivery retry schedule. Build for duplicate and out-of-order notifications, configure Lambda’s retry and event-age limits deliberately, and retain failed invocations in a destination or dead-letter queue (DLQ) that you can inspect and replay.
Why an S3 trigger may not invoke Lambda
Start with the bucket’s notification configuration, not the function’s retry settings. Amazon S3 notifications are designed for at-least-once delivery, so duplicates are possible, and notifications are not guaranteed to arrive in event order. A function should therefore be idempotent—processing the same event twice should not repeat harmful side effects—and should not rely on event arrival order.
Check the trigger’s configuration and authorization:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Confirm the notification is on the intended bucket and includes the event types you expect, such as object creation.
- Check the destination ARN and any prefix or suffix filters. A filter that does not match the object key prevents that notification from matching.
- Verify that the bucket and Lambda function are in the same AWS Region.
- Confirm the function’s resource-based policy permits Amazon S3 to invoke it. See AWS’s S3-to-Lambda permission guidance.
- When saving a notification in the S3 console, account for its test message. Review the S3 console notification setup.
If creating a trigger returns Unable to validate the following destination configurations, inspect every destination already configured on that bucket. A stale destination or one missing required permissions can block validation of a new notification. AWS describes this case in its S3-trigger tutorial.
#1 Best Overall
- OTP Token in card format that provides secure remote access with strong authentication
- Easy to use and easy to carry, same size as a credit card
- Zero footprint; No software on end-user PCs
- Compliant to OATH open standard (time based - 6 digits)
- Expected battery life is 3 years or approximately 15,000 clicks
Separate S3 delivery failures from Lambda handler failures
There are two different handoffs. First, S3 delivers a notification to Lambda. After Lambda accepts an asynchronous invocation, Lambda queues the event and runs the function. If the function or runtime fails, Lambda’s asynchronous retry behavior applies. A Lambda retry configuration does not control S3’s notification delivery policy.
AWS’s documentation does not establish an exact retry schedule for S3’s direct delivery attempts to Lambda. Do not assume Lambda’s one-minute and two-minute function-error retry delays describe that S3-side handoff. Use Lambda’s invocation metrics and logs to diagnose accepted invocations, and check the bucket notification and permissions when the function has no corresponding invocation.
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Set Lambda retries and event age to fit the work
For asynchronous function errors, Lambda makes two additional attempts by default: the first after one minute and the second after two minutes. For throttling and system errors, Lambda returns events to its queue and retries with backoff for up to six hours by default. These are AWS-documented service behaviors, not guarantees that every event will ultimately run.
Lambda’s asynchronous configuration includes MaximumRetryAttempts and MaximumEventAgeInSeconds. AWS documents a range of zero to two retries for function errors and a maximum event age of six hours. Choose values according to how long the work remains useful and how much retry load the system can tolerate. See Lambda asynchronous invocation configuration.
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
- More retries can help recover from transient failures, but can extend processing and repeat side effects. Make writes and downstream actions safe to repeat, using an idempotency key or durable deduplication where appropriate.
- A shorter maximum event age can prevent stale work from running, but it also means an event may be discarded sooner.
- Retries are not a retention policy. Lambda may discard an event after it expires or exhausts retries; AWS also warns that under load events can be deleted from Lambda’s queue without being sent to the function.
Retain failures so you can diagnose and replay them
Configure an on-failure destination or a DLQ if failed asynchronous events must be recoverable. They preserve different information, so choose based on what operators need and how they will handle recovery.
| Recovery option | What it retains | Supported target and recovery use |
|---|---|---|
| On-failure destination | Invocation record details, including information useful for inspecting the failed invocation | Supported asynchronous targets include standard SQS, standard SNS, S3 for on-failure use, Lambda, and EventBridge. An operator or consumer can inspect the record and route recovery work. |
| Dead-letter queue (DLQ) | Discarded event content in a queue or topic | Standard SQS or SNS. Retrieve or consume messages for later reprocessing; SNS can fan out to subscribers. |
A destination is useful when investigation needs invocation metadata; a DLQ is a straightforward way to preserve discarded event content for later retrieval. AWS explains their behavior and setup in capturing asynchronous invocation records.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Grant the Lambda execution role the permissions needed to write to the selected destination, and verify that the destination type and record size are supported. Monitor Lambda’s DestinationDeliveryFailures metric: a configured destination is not protective if delivery to it fails.
- Alert on function errors, throttles, and destination delivery failures.
- Inspect the retained message or invocation record and identify whether the cause is code, permissions, capacity, or a downstream dependency.
- Fix the cause before replaying the event.
- Replay through a controlled consumer or reprocessor that is idempotent. AWS documents retrieving or consuming DLQ events for reprocessing in its asynchronous event retention guidance.
Check concurrency and prevent recursive notifications
Insufficient concurrency can throttle invocations and leave events queued. If the queue remains backed up, events can age out. Check reserved and account concurrency alongside downstream service capacity, and alert on Lambda errors and throttles. A retry policy cannot compensate for a sustained capacity shortage.
Best Value
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
Also check whether the function writes objects to the same bucket and key space that triggers it. If those writes match the notification rules, they can invoke the function repeatedly. Use separate input and output buckets, or constrain the notification to an input prefix that excludes output objects. For supported destination types and notification constraints, consult S3 event notification destinations and S3 notification filtering.
S3 direct event notifications do not support SQS FIFO as a destination. If FIFO routing is required, AWS documents using EventBridge to route S3 events to FIFO queues; see S3 EventBridge integration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
