# AWS Lambda — Self-hosted Temporal Service Self-hosted Serverless Workers require Temporal Service v1.31.0 or later. Complete this server enablement before following `setup.md`. For the Lambda invocation role Temporal assumes (the CloudFormation stack and trust policy), see `iam.md`. ## Network reachability The Temporal Service frontend must be reachable from the Lambda execution environment. If the Temporal Service runs on a private network, you may need VPC access for Lambda, VPC peering, or a similar mechanism. ## Enable the Worker Controller Instance (WCI) WCI is disabled by default and must be enabled through dynamic configuration. Add the following keys to your dynamic config file: ```yaml workercontroller.enabled: - value: true workercontroller.compute_providers.enabled: - value: - aws-lambda workercontroller.scaling_algorithms.enabled: - value: - no-sync ``` To enable WCI for specific Namespaces instead of globally, add a `constraints` section with the Namespace name under `workercontroller.enabled`: ```yaml workercontroller.enabled: - value: true constraints: namespace: 'your-namespace' ``` The Temporal Service watches the dynamic config file for changes and applies updates without a restart. ## Configure AWS credentials The Temporal Service needs AWS credentials to assume an IAM role that invokes Lambda functions. **On AWS infrastructure (EC2, ECS, EKS):** The server uses the attached instance role, task role, or pod role automatically. No additional credential configuration is needed. The attached role must have `sts:AssumeRole` permission for the Lambda invocation role. **Outside AWS:** Use IAM Roles Anywhere, or configure static AWS credentials in the server's environment (not recommended). These credentials must belong to an IAM user or role that has `sts:AssumeRole` permission for the Lambda invocation role. ``` AWS_ACCESS_KEY_ID= AWS_SECRET_ACCESS_KEY= AWS_REGION= ```