🔐 New: A CISO’s benchmark for authorization maturity ➔ [Download the ebook](https://solutions.cerbos.dev/authorization-maturity-model-a-cisos-benchmark)

# Run Cerbos natively inside AWS Lambda

Embed the Cerbos PDP directly inside your Lambda function for serverless authorization with no external network calls.

[Lambda deployment guide](https://github.com/cerbos/cerbos-aws-lambda) [Deploying Cerbos PDP on AWS Lambda](/content/blog/deploy-cerbos-pdp-aws-lambda/index.html) [Run Cerbos natively inside AWS Lambda](/content/blog/run-cerbos-natively-inside-aws-lambda/index.html)

### Embedded PDP

Cerbos runs in-process inside your Lambda function with no sidecar or external service required

### No network hop

Authorization checks happen in-process, eliminating network latency entirely

### Cerbos Hub bundles

Load pre-compiled policy bundles from Cerbos Hub for fast cold starts and centralized policy management

## What is Cerbos?

Cerbos is an open-source authorization layer that decouples access control from your application code. It runs as a stateless Policy Decision Point (PDP) that evaluates fine-grained policies at request time.

Authorization policies are written in human-readable YAML supporting [RBAC](/content/features-benefits-and-use-cases/rbac/index.html), [ABAC](/content/features-benefits-and-use-cases/abac/index.html), and [conditional rules](/content/features-benefits-and-use-cases/pbac/index.html). They can be updated, tested, and deployed independently of your application.

Deploying Cerbos via AWS Lambda gives you a production-ready authorization service that scales horizontally and fits naturally into your existing infrastructure and observability stack.

[Policy-as-code Human-readable YAML policies managed like source code](/content/features-benefits-and-use-cases/human-readable-authorization/index.html) [Scalable PDP Stateless policy decision point with sub-millisecond latency](/content/features-benefits-and-use-cases/scalability/index.html) [Centralized management Manage, test, and deploy policies from a single control plane](/content/features-benefits-and-use-cases/centralized-management/index.html)

### How to run Cerbos in AWS Lambda

1. **Add the Cerbos binary to your deployment package**, Include the Cerbos binary or use the Lambda layer provided in the cerbos-aws-lambda repository.
2. **Bundle or configure policies**, Include policies in the deployment package or configure Cerbos to load from Cerbos Hub at startup.
3. **Initialize the PDP in your handler**, Start the embedded Cerbos PDP during function initialization so it persists across warm invocations.
4. **Check authorization in-process**, Call the local Cerbos PDP from your handler code to evaluate authorization without any network calls.

## FAQ

### How does Cerbos run inside Lambda?

Cerbos runs as an embedded binary within your Lambda function. The PDP starts during cold start and evaluates policies in-process, eliminating external network calls for authorization checks.

### Does Cerbos add latency to Lambda cold starts?

Cerbos adds a small amount of cold start time to initialize the PDP. Once warm, policy evaluations are sub-millisecond since they happen in-process with no network overhead.

### How do I load policies in Lambda?

Bundle policies with your Lambda deployment package, or configure Cerbos to load policies from Cerbos Hub at startup. Cerbos Hub provides pre-compiled policy bundles optimized for fast loading.

## Cerbos + AWS Lambda

- Cerbos runs alongside your workloads in AWS Lambda
- No external databases or message queues required
- Built-in metrics, distributed tracing, and structured logging
- Stateless PDP instances scale horizontally

[Book a free policy workshop](/content/workshop/index.html) [Try the Playground](/content/features-benefits-and-use-cases/cerbos-playground/index.html)