AWS Lambda backend logic integration for mobile app

AWS Lambda Backend Logic Integration in Mobile Applications

AWS Lambda is serverless functions executing on request without server management. For mobile app, Lambda covers server logic that can't move to client: payment verification, signing S3 URLs, push notifications, webhook handling from Stripe/Apple IAP, heavy computations.

Architecture: Mobile Client → Lambda

Mobile app calls Lambda via one of paths:

API Gateway + Lambda — most common. REST or HTTP API Gateway accepts request, proxies to Lambda. Lambda responds — Gateway returns to client. Authorization via Cognito Authorizer or JWT Authorizer.

AppSync + Lambda resolver — for GraphQL. Lambda acts as resolver for specific schema fields.

Lambda Function URL — direct HTTPS endpoint for function without API Gateway. Cheaper and simpler, but fewer capabilities (no throttling, no custom domains without CloudFront).

Practical Example: Apple IAP Verification

Can't validate app store purchases on client — receipt easily faked. Lambda:

// handler.mjs (Node.js 20.x)
import { AppleVerifyReceiptResponse } from './types.js';

export const handler = async (event) => {
  const { receiptData, userId } = JSON.parse(event.body);

  const verifyUrl = process.env.APPLE_ENV === 'production'
    ? 'https://buy.itunes.apple.com/verifyReceipt'
    : 'https://sandbox.itunes.apple.com/verifyReceipt';

  const response = await fetch(verifyUrl, {
    method: 'POST',
    body: JSON.stringify({
      'receipt-data': receiptData,
      password: process.env.APPLE_SHARED_SECRET,
      'exclude-old-transactions': true,
    }),
  });

  const data = await response.json();

  if (data.status !== 0) {
    return { statusCode: 400, body: JSON.stringify({ error: 'Invalid receipt' }) };
  }

  // Save purchase in DynamoDB
  await savePurchase(userId, data.latest_receipt_info);

  return { statusCode: 200, body: JSON.stringify({ success: true }) };
};

Secrets (APPLE_SHARED_SECRET) go in AWS Secrets Manager or Parameter Store, not environment variables directly in console (visible in logs if careless).

Cold Start — Main Lambda Problem for Mobile Clients

Cold start on Node.js 20.x with SnapStart — 200–400ms. For Java without SnapStart — 1–3 seconds. Critical for API users expect.

Mitigations:

• Provisioned Concurrency — Lambda always warm, but pay for idle
• AWS Lambda SnapStart (Java) — snapshot of initialized environment
• Minimal dependencies — aws-sdk v3 with modular imports instead of whole SDK
• Node.js / Python for latency-sensitive functions instead of Java/Kotlin

// Bad: import entire SDK
import AWS from 'aws-sdk';

// Good: only needed client
import { DynamoDBClient, PutItemCommand } from '@aws-sdk/client-dynamodb';

Bundle size difference: 30MB vs 150KB. Cold start difference: noticeable.

Authorization via Cognito

// React Native: add token to requests
const session = await fetchAuthSession();
const token = session.tokens?.idToken?.toString();

const response = await fetch('https://api.myapp.com/purchase/verify', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${token}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ receiptData }),
});

API Gateway with Cognito JWT Authorizer automatically verifies token. Lambda gets event.requestContext.authorizer.jwt.claims with userId — no need to validate token in function code.

IaC: Lambda via CDK or Terraform

Button clicks in AWS Console — not for production. Lambda described in code:

// AWS CDK (TypeScript)
const verifyPurchaseFn = new NodejsFunction(this, 'VerifyPurchase', {
  entry: 'src/functions/verify-purchase/handler.ts',
  runtime: Runtime.NODEJS_20_X,
  timeout: Duration.seconds(10),
  memorySize: 256,
  environment: {
    APPLE_ENV: 'production',
  },
  bundling: { minify: true, sourceMap: true },
});

const api = new RestApi(this, 'MobileApi');
api.root.addResource('purchase').addResource('verify')
  .addMethod('POST', new LambdaIntegration(verifyPurchaseFn), {
    authorizer: cognitoAuthorizer,
  });

CDK builds and bundles TypeScript functions via esbuild, deploys via CloudFormation.

What's Included in Integration

Setup Lambda functions for specific server logic. API Gateway or Function URL with authorization. IaC via CDK or Terraform. Environment setup (dev/staging/prod). Monitoring via CloudWatch + X-Ray tracing. Mobile client integration (SDK or fetch).

Timeline

One Lambda function with API Gateway: 1–2 days. Full serverless backend (5–10 functions + DynamoDB + Auth): 1–3 weeks. Cost by volume.