Internals of AWS Lambda 2026 Custom Runtimes – How to Use Rust 1.85 for Serverless

# Install rustup if not already installed
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# Install Rust 1.85
rustup install 1.85.0
rustup default 1.85.0

# Add targets for Lambda
rustup target add x86_64-unknown-linux-musl
rustup target add aarch64-unknown-linux-musl
rustup target add wasm32-wasip1

# Install required tools
cargo install cargo-bloat
sudo apt-get install upx

cargo new lambda-rust-2026 --bin
cd lambda-rust-2026

[package]
name = "lambda-rust-2026"
version = "0.1.0"
edition = "2021"

[dependencies]
anyhow = "1.0"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
aws-config = "1.0"
aws-sdk-dynamodb = "1.0"
chrono = "0.4"
uuid = { version = "1.0", features = ["v4"] }
tokio = { version = "1.0", features = ["full"] }

[target.x86_64-unknown-linux-musl.dependencies]
# No additional dependencies for musl target

[target.wasm32-wasip1.dependencies]
wasm-bindgen = "0.2"

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  RustLambdaFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: rust-lambda-2026
      Runtime: provided.al2023
      Handler: bootstrap
      CodeUri: ./target/x86_64-unknown-linux-musl/release/
      MemorySize: 128
      Timeout: 30
      Environment:
        Variables:
          SESSIONS_TABLE: !Ref SessionsTable
          AWS_LAMBDA_RUNTIME_API: !Sub "runtimes.lambda.${AWS::Region}.amazonaws.com"
      Events:
        ApiGateway:
          Type: Api
          Properties:
            Path: /sessions
            Method: ANY

  SessionsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: sessions
      AttributeDefinitions:
        - AttributeName: session_id
          AttributeType: S
      KeySchema:
        - AttributeName: session_id
          KeyType: HASH
      BillingMode: PAY_PER_REQUEST

# Build the binary for Lambda
cargo build --release --target x86_64-unknown-linux-musl
strip target/x86_64-unknown-linux-musl/release/bootstrap
upx --best target/x86_64-unknown-linux-musl/release/bootstrap

# Deploy with SAM
sam build
sam deploy --guided

// src/main.rs - Lambda Custom Runtime Bootstrap for Rust 1.85
// Implements the 2026 AWS Lambda Custom Runtime API v3 specification
use anyhow::{Context, Result};
use serde::{Deserialize, Serialize};
use serde_json::Value;
use std::env;
use std::io::{BufRead, BufWriter, Write};
use std::net::TcpStream;
use tracing::{info, error, instrument};

// Lambda Runtime API v3 request structure for next invocation
#[derive(Deserialize)]
struct NextInvocationRequest {
    request_id: String,
    expiration: String,
    tracing_context: Option,
}

// Tracing context injected by Lambda runtime for OpenTelemetry compatibility
#[derive(Deserialize)]
struct TracingContext {
    root_trace_id: String,
    parent_span_id: String,
}

// Response structure to return to Lambda runtime
#[derive(Serialize)]
struct InvocationResponse {
    request_id: String,
    status_code: u16,
    body: Value,
}

// Initialize tracing subscriber with OpenTelemetry support
fn init_tracing() -> Result<()> {
    tracing_subscriber::fmt()
        .with_env_filter(env::var("RUST_LOG").unwrap_or_else(|_| "info".to_string()))
        .with_span_events(tracing_subscriber::fmt::format::FmtSpan::CLOSE)
        .try_init()
        .context("Failed to initialize tracing subscriber")?;
    Ok(())
}

// Connect to the Lambda Runtime API endpoint
fn connect_runtime_api() -> Result {
    let runtime_api = env::var("AWS_LAMBDA_RUNTIME_API")
        .context("AWS_LAMBDA_RUNTIME_API environment variable not set")?;
    let stream = TcpStream::connect(runtime_api)
        .context(format!("Failed to connect to runtime API at {}", runtime_api))?;
    stream
        .set_read_timeout(Some(std::time::Duration::from_secs(30)))
        .context("Failed to set read timeout on runtime API stream")?;
    Ok(stream)
}

// Poll for next invocation from the runtime
fn get_next_invocation(stream: &mut BufRead<&TcpStream>) -> Result<(NextInvocationRequest, String)> {
    let mut request_line = String::new();
    stream
        .read_line(&mut request_line)
        .context("Failed to read invocation request line")?;

    // Parse request ID from headers (simplified for example, full implementation parses all headers)
    let request_id = request_line
        .split("request-id:")
        .nth(1)
        .and_then(|s| s.trim().split_whitespace().next())
        .context("Failed to parse request ID from invocation headers")?
        .to_string();

    let mut body = String::new();
    stream
        .read_line(&mut body)
        .context("Failed to read invocation body")?;

    let invocation_req = NextInvocationRequest {
        request_id: request_id.clone(),
        expiration: String::new(),
        tracing_context: None,
    };

    Ok((invocation_req, body))
}

// Send invocation response back to runtime
fn send_response(stream: &mut BufWriter<&TcpStream>, response: InvocationResponse) -> Result<()> {
    let response_json = serde_json::to_string(&response)
        .context("Failed to serialize invocation response")?;
    stream
        .write_all(format!("HTTP/1.1 200 OK\r\nContent-Length: {}\r\n\r\n{}", response_json.len(), response_json).as_bytes())
        .context("Failed to write response to runtime stream")?;
    stream.flush().context("Failed to flush runtime stream")?;
    Ok(())
}

#[instrument(skip(stream))]
fn handle_invocation(stream: &mut BufRead<&TcpStream>, writer: &mut BufWriter<&TcpStream>) -> Result<()> {
    let (invocation, body) = get_next_invocation(stream)?;
    info!(request_id = %invocation.request_id, "Processing new invocation");

    // Parse incoming event body (API Gateway v2 format)
    let event: Value = serde_json::from_str(&body)
        .context("Failed to parse invocation event body")?;

    // Simple handler logic: echo the event back with a timestamp
    let response_body = serde_json::json!({
        "message": "Hello from Rust 1.85 Lambda!",
        "timestamp": chrono::Utc::now().to_rfc3339(),
        "event": event,
    });

    let response = InvocationResponse {
        request_id: invocation.request_id,
        status_code: 200,
        body: response_body,
    };

    send_response(writer, response)?;
    Ok(())
}

fn main() -> Result<()> {
    init_tracing()?;
    info!("Starting Rust 1.85 Lambda Custom Runtime v3");

    let mut stream = connect_runtime_api()?;
    let mut reader = std::io::BufReader::new(&stream);
    let mut writer = std::io::BufWriter::new(&stream);

    loop {
        if let Err(e) = handle_invocation(&mut reader, &mut writer) {
            error!(error = %e, "Invocation handling failed");
            // Send error response to runtime
            let error_response = InvocationResponse {
                request_id: String::new(),
                status_code: 500,
                body: serde_json::json!({"error": e.to_string()}),
            };
            let _ = send_response(&mut writer, error_response);
        }
    }
}

// src/handler.rs - Lambda Function Handler with DynamoDB Integration
// Uses AWS SDK for Rust 1.85, implements API Gateway v2 request/response
use anyhow::{Context, Result};
use aws_sdk_dynamodb::{Client, Error as DynamoError};
use aws_types::region::Region;
use serde::{Deserialize, Serialize};
use serde_json::{Value, json};
use tracing::{info, instrument};

// API Gateway v2 HTTP request structure
#[derive(Deserialize)]
struct ApiGatewayRequest {
    route_key: String,
    raw_path: String,
    raw_query_string: Option,
    headers: Option,
    body: Option,
    request_context: RequestContext,
}

// API Gateway request context with identity info
#[derive(Deserialize)]
struct RequestContext {
    account_id: String,
    api_id: String,
    domain_name: String,
    domain_prefix: String,
    http: HttpInfo,
    request_id: String,
    route_key: String,
    stage: String,
    time: String,
    time_epoch: i64,
}

// HTTP method and path info from request context
#[derive(Deserialize)]
struct HttpInfo {
    method: String,
    path: String,
    protocol: String,
    source_ip: String,
    user_agent: String,
}

// Session data structure to persist to DynamoDB
#[derive(Serialize, Deserialize)]
struct UserSession {
    session_id: String,
    user_id: String,
    created_at: String,
    last_active: String,
    metadata: Value,
}

// Initialize DynamoDB client with Lambda's default credentials chain
async fn init_dynamodb_client() -> Result {
    let region = env::var("AWS_REGION")
        .unwrap_or_else(|_| "us-east-1".to_string());
    let config = aws_config::from_env()
        .region(Region::new(region))
        .load()
        .await;
    Ok(Client::new(&config))
}

// Create a new user session in DynamoDB
#[instrument(skip(client, request))]
async fn create_session(
    client: &Client,
    request: &ApiGatewayRequest,
    session_id: &str,
) -> Result {
    let user_id = request
        .headers
        .as_ref()
        .and_then(|h| h.get("x-user-id"))
        .and_then(|v| v.as_str())
        .context("Missing x-user-id header")?
        .to_string();

    let session = UserSession {
        session_id: session_id.to_string(),
        user_id,
        created_at: chrono::Utc::now().to_rfc3339(),
        last_active: chrono::Utc::now().to_rfc3339(),
        metadata: json!({"source_ip": request.request_context.http.source_ip}),
    };

    client
        .put_item()
        .table_name(env::var("SESSIONS_TABLE").context("SESSIONS_TABLE env var not set")?)
        .item("session_id", aws_sdk_dynamodb::types::AttributeValue::S(session.session_id.clone()))
        .item("user_id", aws_sdk_dynamodb::types::AttributeValue::S(session.user_id.clone()))
        .item("created_at", aws_sdk_dynamodb::types::AttributeValue::S(session.created_at.clone()))
        .item("last_active", aws_sdk_dynamodb::types::AttributeValue::S(session.last_active.clone()))
        .item("metadata", aws_sdk_dynamodb::types::AttributeValue::S(session.metadata.to_string()))
        .send()
        .await
        .context("Failed to put session item to DynamoDB")?;

    info!(session_id = %session_id, "Created new user session");
    Ok(session)
}

// Retrieve session from DynamoDB by session ID
#[instrument(skip(client))]
async fn get_session(client: &Client, session_id: &str) -> Result> {
    let response = client
        .get_item()
        .table_name(env::var("SESSIONS_TABLE").context("SESSIONS_TABLE env var not set")?)
        .key("session_id", aws_sdk_dynamodb::types::AttributeValue::S(session_id.to_string()))
        .send()
        .await
        .context("Failed to get session item from DynamoDB")?;

    if let Some(item) = response.item {
        let session: UserSession = serde_json::from_value(Value::Object(
            item.into_iter()
                .map(|(k, v)| (k, serde_json::Value::String(v.as_s().unwrap_or_default().to_string())))
                .collect(),
        ))
        .context("Failed to deserialize session from DynamoDB item")?;
        Ok(Some(session))
    } else {
        Ok(None)
    }
}

// Main handler logic invoked by the bootstrap runtime
#[instrument(skip(client, event))]
pub async fn handle_event(client: &Client, event: Value) -> Result {
    let request: ApiGatewayRequest = serde_json::from_value(event)
        .context("Failed to parse API Gateway request")?;

    info!(method = %request.request_context.http.method, path = %request.raw_path, "Processing API request");

    match request.request_context.http.method.as_str() {
        "GET" => {
            let session_id = request
                .raw_query_string
                .as_ref()
                .and_then(|q| q.split("session_id=").nth(1))
                .and_then(|s| s.split("&").next())
                .context("Missing session_id query parameter")?;

            let session = get_session(client, session_id).await?;
            match session {
                Some(s) => Ok(json!({"statusCode": 200, "body": serde_json::to_value(s)?})),
                None => Ok(json!({"statusCode": 404, "body": json!({"error": "Session not found"})}),
            }
        }
        "POST" => {
            let session_id = uuid::Uuid::new_v4().to_string();
            let session = create_session(client, &request, &session_id).await?;
            Ok(json!({"statusCode": 201, "body": serde_json::to_value(session)?}))
        }
        _ => Ok(json!({"statusCode": 405, "body": json!({"error": "Method not allowed")})),
    }
}

// src/tests/integration.rs - Integration Tests for Rust Lambda Function
// Mocks the Lambda Runtime API v3 to test handler logic without deploying to AWS
use anyhow::{Context, Result};
use aws_sdk_dynamodb::types::AttributeValue;
use serde_json::{Value, json};
use tokio;
use tracing::{info, instrument};

// Mock structure for Lambda Runtime API next invocation response
struct MockRuntimeResponse {
    request_id: String,
    body: Value,
}

// Mock Lambda Runtime API server for testing
struct MockRuntimeServer {
    responses: Vec,
    port: u16,
}

impl MockRuntimeServer {
    async fn start(&self) -> Result<()> {
        let listener = tokio::net::TcpListener::bind(format!("127.0.0.1:{}", self.port))
            .await
            .context("Failed to bind mock runtime server")?;
        info!(port = %self.port, "Started mock Lambda runtime server");

        let mut response_idx = 0;
        loop {
            let (stream, _) = listener.accept().await?;
            let mut reader = tokio::io::BufReader::new(&stream);
            let mut writer = tokio::io::BufWriter::new(&stream);

            // Read invocation request from Lambda function
            let mut request_line = String::new();
            reader.read_line(&mut request_line).await?;

            if response_idx >= self.responses.len() {
                // Send shutdown signal if no more responses
                break;
            }

            let response = &self.responses[response_idx];
            let response_json = serde_json::to_string(&response.body)?;
            writer
                .write_all(
                    format!(
                        "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nX-Request-Id: {}\r\n\r\n{}",
                        response_json.len(),
                        response.request_id,
                        response_json
                    )
                    .as_bytes(),
                )
                .await?;
            writer.flush().await?;

            response_idx += 1;
        }

        Ok(())
    }
}

// Test case: Successful POST request to create session
#[tokio::test]
#[instrument]
async fn test_create_session_success() -> Result<()> {
    // Initialize test tracing
    tracing_subscriber::fmt()
        .with_env_filter("debug")
        .try_init()
        .ok();

    // Set up mock DynamoDB client (uses DynamoDB Local for testing)
    env::set_var("AWS_REGION", "us-east-1");
    env::set_var("AWS_ACCESS_KEY_ID", "test");
    env::set_var("AWS_SECRET_ACCESS_KEY", "test");
    env::set_var("SESSIONS_TABLE", "test-sessions");

    let dynamodb_client = lambda_rust_2026_demo::handler::init_dynamodb_client().await?;

    // Create test table in DynamoDB Local (simplified, assumes DynamoDB Local is running)
    dynamodb_client
        .create_table()
        .table_name("test-sessions")
        .key_schema(
            aws_sdk_dynamodb::types::KeySchemaElement::builder()
                .attribute_name("session_id")
                .key_type(aws_sdk_dynamodb::types::KeyType::Hash)
                .build()?,
        )
        .attribute_definitions(
            aws_sdk_dynamodb::types::AttributeDefinition::builder()
                .attribute_name("session_id")
                .attribute_type(aws_sdk_dynamodb::types::ScalarAttributeType::S)
                .build()?,
        )
        .provisioned_throughput(
            aws_sdk_dynamodb::types::ProvisionedThroughput::builder()
                .read_capacity_units(5)
                .write_capacity_units(5)
                .build()?,
        )
        .send()
        .await
        .context("Failed to create test DynamoDB table")?;

    // Mock API Gateway request
    let test_event = json!({
        "route_key": "POST /sessions",
        "raw_path": "/sessions",
        "request_context": {
            "http": {
                "method": "POST",
                "path": "/sessions",
                "source_ip": "127.0.0.1",
            },
            "request_id": "test-request-123",
        },
        "headers": {
            "x-user-id": "test-user-456",
        },
    });

    // Call handler
    let response = lambda_rust_2026_demo::handler::handle_event(&dynamodb_client, test_event).await?;

    // Assert response
    assert_eq!(response["statusCode"].as_i64().unwrap(), 201);
    let session: Value = serde_json::from_value(response["body"].clone())?;
    assert_eq!(session["user_id"].as_str().unwrap(), "test-user-456");
    info!(session_id = %session["session_id"], "Test create session passed");

    Ok(())
}

// Test case: GET request for non-existent session returns 404
#[tokio::test]
async fn test_get_nonexistent_session() -> Result<()> {
    let dynamodb_client = lambda_rust_2026_demo::handler::init_dynamodb_client().await?;

    let test_event = json!({
        "route_key": "GET /sessions",
        "raw_path": "/sessions",
        "raw_query_string": "session_id=nonexistent-session",
        "request_context": {
            "http": {
                "method": "GET",
                "path": "/sessions",
            },
            "request_id": "test-request-456",
        },
    });

    let response = lambda_rust_2026_demo::handler::handle_event(&dynamodb_client, test_event).await?;
    assert_eq!(response["statusCode"].as_i64().unwrap(), 404);
    Ok(())
}

cargo build --release --target x86_64-unknown-linux-musl
strip target/x86_64-unknown-linux-musl/release/bootstrap
upx --best target/x86_64-unknown-linux-musl/release/bootstrap

rustup target add wasm32-wasip1
cargo build --target wasm32-wasip1 --release

tracing_subscriber::fmt()
    .with_env_filter("info")
    .with_span_events(tracing_subscriber::fmt::format::FmtSpan::CLOSE)
    .init();

lambda-rust-2026-demo/
├── Cargo.toml                # Rust project dependencies
├── src/
│   ├── main.rs               # Custom runtime bootstrap (code example 1)
│   ├── handler.rs            # Lambda function handler (code example 2)
│   └── tests/
│       └── integration.rs    # Integration tests (code example 3)
├── .github/
│   └── workflows/
│       └── deploy.yml        # GitHub Actions CI/CD pipeline
├── template.yaml             # AWS SAM deployment template
└── README.md                 # Setup and deployment instructions