AWS Launches Lambda MicroVMs for Isolated, Stateful Execution of Untrusted Code

AWS has introduced a new serverless primitive designed specifically for applications that need to run code they don't control—such as AI-generated instructions or user-supplied scripts—in isolation from one another. Dubbed Lambda MicroVMs, the service packages each session or agent inside its own Firecracker virtual machine, combining the strong isolation of VMs with the rapid startup and operational simplicity serverless platforms are known for.

The Problem It Solves#

Until now, teams building multi-tenant platforms faced an impossible choice. Traditional VMs provided true isolation but required minutes to start. Containers launched quickly but shared a kernel, making them insufficient for untrusted workloads without extensive hardening. AWS Lambda Functions excelled at event-driven patterns but weren't designed for long-running, stateful sessions that preserve application state between requests.

Lambda MicroVMs eliminate that tradeoff by delivering all three properties: isolated execution at the hardware level, near-instantaneous launch, and the ability to maintain application state for up to eight hours.

How It Works#

The workflow differs meaningfully from Lambda Functions. Developers upload a Dockerfile and code artifacts to S3, and AWS builds a snapshot of the initialized application state—memory and disk—using Firecracker. When a session starts, the MicroVM resumes from this pre-baked state rather than booting cold, avoiding startup overhead.

Each running session gets its own dedicated HTTPS endpoint. No load balancers or infrastructure provisioning required. The service handles the underlying networking and authentication via JWE tokens.

The most novel aspect is the suspend/resume cycle. When idle, a MicroVM freezes its memory and disk state, then resumes when traffic returns with everything intact—installed packages, loaded models, open file handles. Third-party testing confirmed this preservation is transparent to clients.

Isolation and Scale#

Firecracker, the same hypervisor powering over 15 trillion monthly Lambda invocations, provides the isolation boundary. Each MicroVM runs in a dedicated VM with no shared kernel or shared resources between sessions. A container escape in one environment cannot reach another session or the host—a meaningfully stronger guarantee than container-level isolation.

For teams deploying AI-generated code at scale, where millions of daily executions come from unauditable models, this is a material security upgrade over traditional container sandboxing.