Increasing Lambda Timeout: Where to Change It and What the Maximum Limit Is

Increasing Lambda timeout is a common fix when your function stops mid-execution — understanding where to configure it and the hard ceiling prevents silent failures in production.

TL;DR: Lambda Timeout Configuration at a Glance

The default Lambda timeout is 3 seconds. You can increase it up to a maximum of 900 seconds (15 minutes) per invocation. Change the setting in the function's configuration via the AWS Console, AWS CLI, or infrastructure-as-code. If your task exceeds 15 minutes, Lambda is not the right compute primitive — use AWS Fargate, AWS Batch, or EC2 instead.

PropertyValue
Default timeout3 seconds
Maximum timeout900 seconds (15 minutes)
Minimum timeout1 second
Granularity1-second increments
ScopePer function version / alias
Applies toEach individual invocation

Why Lambda Timeout Exists and How It Terminates Execution

Lambda enforces a hard wall-clock timeout per invocation. When the configured duration elapses, the runtime sends a SIGKILL to the execution environment — your code does not receive a graceful shutdown signal, no finally block runs, and no partial result is returned to the caller. The invocation is marked as a timeout error.

This is not a soft limit you can catch inside your function. The process is terminated externally by the Lambda service.

sequenceDiagram participant Caller as Caller participant LambdaSvc as Lambda Service participant Env as Execution Environment participant CW as CloudWatch Logs Caller->>LambdaSvc: Invoke function LambdaSvc->>Env: Start execution + start timeout clock Env->>Env: Handler running... alt Completes before timeout Env->>LambdaSvc: Return result LambdaSvc->>Caller: 200 OK + result Env->>CW: REPORT log (normal duration) else Timeout threshold reached LambdaSvc->>Env: SIGKILL (hard termination) LambdaSvc->>Caller: Error: Task timed out Env->>CW: "Task timed out after X.XX seconds" end
  1. Invocation received — Lambda allocates an execution environment and starts the timeout clock.
  2. Handler running — Your code executes normally within the configured window.
  3. Timeout threshold reached — If the handler has not returned by the deadline, Lambda forcibly terminates the process.
  4. Error propagated — Synchronous callers (API Gateway, SDK) receive a Task timed out error. Asynchronous invocations retry according to the function's retry configuration.
  5. CloudWatch log entry — A Task timed out after X.XX seconds message is written to the function's log stream.
Think of Lambda timeout like a parking meter. The meter starts the moment your car (invocation) arrives. When time expires, the car is towed regardless of whether you finished your errand — no warning, no grace period.

How to Increase Lambda Timeout — Three Approaches

Choose the method that matches your deployment workflow. All three modify the same underlying function configuration property: Timeout.

flowchart TD Start(["Need to increase Lambda timeout"]) --> Q1{"Deployment method?"} Q1 -->|"Manual / one-off"| CLI["AWS CLI
update-function-configuration"] Q1 -->|"Console access"| Console["Lambda Console
Configuration tab"] Q1 -->|"Infrastructure as code"| IaC["CloudFormation / SAM
Timeout property"] CLI --> Verify["Verify with
get-function-configuration"] Console --> Verify IaC --> Deploy["Deploy stack / changeset"] Deploy --> Verify Verify --> Check{"Task duration
> 900 seconds?"} Check -->|"No"| Done(["Done — timeout updated"]) Check -->|"Yes"| Alt["Use Step Functions,
Fargate, or Batch"]

Approach A (Recommended): AWS CLI

Use update-function-configuration to set the timeout on an existing function. The --timeout value is in seconds.

aws lambda update-function-configuration \
  --function-name my-function \
  --timeout 30 \
  --region us-east-1

Verify the change took effect:

aws lambda get-function-configuration \
  --function-name my-function \
  --region us-east-1 \
  --query 'Timeout'

Approach B: AWS Management Console

  1. Open the Lambda console and select your function.
  2. Choose the Configuration tab, then General configuration.
  3. Click Edit.
  4. Set the Timeout field to your desired value (minutes and seconds).
  5. Click Save.

Approach C: AWS CloudFormation / SAM

For infrastructure-as-code deployments, set the Timeout property directly on the AWS::Lambda::Function resource.

🔽 Click to expand — CloudFormation resource snippet 
MyLambdaFunction:
  Type: AWS::Lambda::Function
  Properties:
    FunctionName: my-function
    Runtime: python3.12
    Handler: index.handler
    Role: arn:aws:iam::123456789012:role/MyLambdaExecutionRole
    Timeout: 30
    Code:
      S3Bucket: my-deployment-bucket
      S3Key: my-function.zip

For AWS SAM, the equivalent property is also Timeout under AWS::Serverless::Function.

IAM Permissions Required to Change Lambda Timeout

Updating function configuration requires the lambda:UpdateFunctionConfiguration IAM action. The policy below follows least privilege — it scopes the permission to a specific function ARN.

🔽 Click to expand — IAM policy for updating Lambda configuration 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "lambda:UpdateFunctionConfiguration",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function"
    },
    {
      "Effect": "Allow",
      "Action": "lambda:GetFunctionConfiguration",
      "Resource": "arn:aws:lambda:us-east-1:123456789012:function:my-function"
    }
  ]
}

Diagnosing a Lambda Timeout in CloudWatch Logs

A timeout does not always surface as an obvious application error. Teams frequently misdiagnose it as a downstream service hanging, when the actual cause is that the Lambda execution environment was terminated before the downstream call returned.

The definitive signal is in CloudWatch Logs. Every timeout produces a log line in this exact format:

Task timed out after 3.00 seconds

Use the following CLI command to search for timeout events in a function's log group — because scrolling the console misses intermittent timeouts under load.

aws logs filter-log-events \
  --log-group-name /aws/lambda/my-function \
  --filter-pattern "Task timed out" \
  --region us-east-1

If you see this message, the fix is to increase the timeout. If you do not see this message but the function is still failing, the root cause is elsewhere — check for unhandled exceptions or downstream errors instead.

flowchart TD Symptom(["Function invocation fails"]) --> CWCheck["Search CloudWatch Logs
for 'Task timed out'"] CWCheck --> Found{"Message found?"} Found -->|"Yes"| Report["Check REPORT line:
Billed Duration = Timeout value"] Report --> Increase["Increase timeout above
p99 execution duration"] Increase --> Instrument["Add per-step timestamps
to identify slow operations"] Instrument --> Retest(["Re-test and monitor"]) Found -->|"No"| OtherCause["Timeout is NOT the cause
Check for unhandled exceptions
or downstream errors"]
  1. Check CloudWatch Logs for "Task timed out" — confirms the execution environment was killed, not that your code threw an exception.
  2. Check the REPORT log line duration — the Billed Duration in the REPORT line equals the configured timeout when a timeout occurs, confirming the wall-clock limit was hit.
  3. Increase timeout and re-test — set the timeout above your measured p99 execution duration, not just above the average.
  4. Add structured logging with timestamps — instrument your handler to log entry/exit of each major operation so you can identify which step consumes the most time.

In practice, teams often set the timeout to exactly their average execution time. Under load, p99 latency spikes past that threshold and intermittent timeouts appear — set the timeout with headroom above your worst-case observed duration.

When 15 Minutes Is Not Enough: Alternatives to Increasing Lambda Timeout

If your workload genuinely requires more than 900 seconds, Lambda is architecturally the wrong tool. The table below maps task duration to the appropriate AWS compute service.

Task DurationRecommended ServiceNotes
Up to 15 minutesAWS LambdaIncrease timeout up to 900 s
Minutes to hoursAWS Fargate (ECS)Container-based, no timeout limit
Minutes to hours (batch)AWS BatchManaged job queues, retry support
Long-running workflowsAWS Step FunctionsOrchestrate multiple Lambda steps; each step has its own timeout
Arbitrary durationAmazon EC2Full control, self-managed

AWS Step Functions (a serverless workflow orchestration service) is worth highlighting specifically: if your 10-second task is one step in a larger pipeline, decomposing the pipeline into discrete Lambda functions — each well within the timeout — is often cleaner than pushing a single function toward the 15-minute ceiling.

Pricing and Billing Interaction with Timeout

Lambda billing is based on the number of requests and the duration of execution, measured in 1-millisecond increments. A function that times out is billed for the full configured timeout duration, not just the work completed before termination. Setting an unnecessarily high timeout on a function that consistently completes in 2 seconds does not increase cost — but a function that consistently times out at 900 seconds will be billed for 900 seconds per invocation.

Pricing and limits vary — always check the official AWS Lambda pricing page for current rates.

Increasing Lambda Timeout: Wrap-Up and Next Steps

Set your Lambda timeout above your measured worst-case execution duration using update-function-configuration, the console, or your IaC template. The hard maximum is 900 seconds. If your task exceeds that, decompose it with Step Functions or move it to Fargate.

For related configuration topics, review how Lambda memory allocation affects CPU and execution speed — increasing memory can reduce duration enough that a timeout increase becomes unnecessary.

Glossary

TermDefinition
Lambda TimeoutThe maximum wall-clock duration a single Lambda invocation is allowed to run before the execution environment is forcibly terminated.
Execution EnvironmentThe isolated runtime sandbox Lambda provisions to run your function code, including the runtime, dependencies, and temporary storage.
REPORT log lineA structured log entry Lambda writes at the end of every invocation containing duration, billed duration, memory used, and init duration.
Step FunctionsAn AWS serverless orchestration service that coordinates multiple Lambda functions (or other AWS services) into stateful workflows with per-step timeouts.
update-function-configurationThe AWS CLI and API operation used to modify Lambda function settings including timeout, memory, environment variables, and handler.

Related Posts

Comments

Post a Comment

Popular posts from this blog

EC2 No Internet Access in Custom VPC: Fix Internet Gateway and Route Table

EC2 no internet access in a custom VPC is one of the most common launch-day failures — the instance is running, but outbound connectivity is completely silent. TL;DR: EC2 No Internet Access — Fix Checklist Step What to Do Why It Matters Complexity 1 Create and attach an Internet Gateway to the VPC Without an IGW, the VPC has no path to the public internet Low 2 Add a default route (0.0.0.0/0) pointing to the IGW in the subnet's route table The IGW exists but traffic has no route to reach it Low 3 Assign a public IP or Elastic IP to the instance Private IPs are not routable on the public internet Low 4 Verify Security Group allows outbound traffic A restrictive outbound rule silently drops all egress Low 5 Verify Network ...
Read more

EC2 SSH Connection Timeout: Which Security Group Rules to Check

An EC2 SSH connection timeout is one of the most common blockers when launching a new instance — the fix is almost always a missing or misconfigured inbound rule in your Security Group. TL;DR — Diagnostic Steps at a Glance Step What to Check Common Fix 1 Security Group inbound rules Add SSH (TCP 22) from your IP 2 Subnet route table Ensure 0.0.0.0/0 routes to an Internet Gateway 3 Network ACL rules Allow inbound TCP 22 and ephemeral return ports 4 Instance public IP / Elastic IP Confirm a public IP is assigned 5 Key pair and SSH username Use correct private key and AMI-specific username Why SSH Times Out Instead of Refusing A connection refused error means the TCP handshake reached the host but nothing is listening. A connection timed out error means packets never arrived — or replies never returned. On EC2, that silence is almost always a network-layer block, not an OS-level problem. The Se...
Read more

Difference Between IAM User and IAM Role: Which One Should Your EC2 Use?

Understanding the difference between IAM User and IAM Role is critical — choosing wrong means either hardcoded credentials in your app or a silent security exposure you won't catch until an audit. TL;DR: IAM User vs IAM Role at a Glance Dimension IAM User IAM Role Identity type Permanent, named human or service identity Assumable identity with temporary credentials Credential type Long-lived access keys or password Short-lived STS tokens (auto-rotated) Attached to EC2? No native attachment — keys must be embedded Yes — via Instance Profile, injected automatically Rotation required? Manual — your responsibility Automatic — AWS STS handles it Recommended for EC2 → S3? No Yes — always Cross-account access Requires separate user per account Native — assume role across accounts Audit trail Tied to user identity Tied to role + session name in CloudTrail What IAM User and IAM Role Actual...
Read more