Hack University - Triggers and events

What invokes a function?

A Lambda function never runs on its own. Something triggers it, and each trigger delivers a differently-shaped event to the handler. This wiring is the real payoff of serverless: services glued together with no polling loops and no always-on watcher process to host, patch, and pay for.

trigger	event says	typical job
API Gateway (a managed HTTPS endpoint in front of Lambda)	method, path, body	serve an API endpoint
S3	bucket + key of a new object	make a thumbnail, scan an upload
EventBridge schedule	it is time	nightly cleanup, scheduled reports
SQS queue	a batch of messages	background jobs

The schedule row replaces cron, the classic Unix scheduler that runs commands at fixed times: an EventBridge schedule is cron as a managed service, with no machine left running just to keep time.

The S3 one deserves a pause: storage events as code triggers is a genuinely new pattern. Upload cats/whiskers.jpg to the bucket from lesson 4-1, and S3 itself invokes your thumbnail function with that key in the event. No polling loop, no queue to build, no server watching for files.

An event-driven pipeline: the upload itself triggers the function. The function runs for a few hundred milliseconds, writes the thumbnail, and nothing is billed until the next upload.

Routing an API Gateway event

An API Gateway event carries the method and the path, and a one-function API dispatches on them. In bash that is a case statement.

handle() {
  case "$1" in
    "GET /todos") echo "$1 -> list_todos" ;;
    "POST /todos") echo "$1 -> create_todo" ;;
    *) echo "$1 -> 404 not found" ;;
  esac
}
handle "GET /todos"
handle "POST /todos"
handle "DELETE /nope"

Output

GET /todos -> list_todos
POST /todos -> create_todo
DELETE /nope -> 404 not found

Reading the dispatch

The POST /todos case goes above the * catch-all. Order matters, because case takes the first pattern that matches and * matches everything, so it must stay last.
The 404 branch is the catch-all doing its job. An unrouted path is a normal outcome that needs a real answer, not a crash.
Method and path are matched together as one string. That is why DELETE /nope falls through even though /todos routes exist: the pair is the route, not the path alone.

The trigger for a nightly report

A report that must run every night at 02:00 with no user involved fits an EventBridge schedule.

Schedules are events too. EventBridge fires the equivalent of "it is 02:00", Lambda receives it as an event, and the function runs. Nothing distinguishes it from an upload event or an API request from the handler's point of view.

The contrast with the old approach is stark. Before serverless, this job meant a whole EC2 instance idling 23.9 hours a day just to host one cron entry, with an operating system to patch and a disk to monitor, all so that one command could run once a night.

Which service is the trigger in a thumbnail pipeline

The trigger is S3.

The upload lands in a bucket, S3 emits an object-created event carrying the bucket and the key, and Lambda runs the thumbnail code with that event as input.

The direction is the part worth getting straight: Lambda is the target of the trigger, and S3 is the source. Nothing in your code asks S3 whether new files have appeared.

The giveaway in any event is its contents. An event carrying a bucket name and an object key came from S3, because those are the only identifiers S3 has to offer. Reading the event shape backwards to its source is a fast way to orient yourself in an unfamiliar pipeline.