Plugin Documentation

LambdaLink
AWS Lambda for Blueprints and C++

Call Lambda functions and IAM-protected HTTPS APIs straight from your game: request/response, streaming and batch invocations with Amazon Cognito credentials, built on the official AWS SDK for C++.

v1.0
UE 4.27 & 5.8
Win64, Linux & Android
Category Networking
Alpha XP

Overview

LambdaLink lets you keep game logic that must not run on the client — score validation, rewards, purchases, matchmaking rules, AI calls — in AWS Lambda and call it from Unreal Engine 4.27 and 5.8. Requests run on background worker threads with automatic retries; every result arrives back on the game thread.

  • Invoke Lambda: Request / Response, Event (fire and forget) and Dry Run, with optional log tail.
  • Invoke Lambda Stream: response-streaming functions delivered piece by piece.
  • Invoke Lambda Batch: one function, many payloads, in parallel.
  • Send Signed Request: AWS Signature V4 for API Gateway (IAM auth), Lambda function URLs and other AWS endpoints.
  • Amazon Cognito identity pools for guests and signed-in players; static keys and the default AWS chain for development and servers.
  • JSON helpers to convert payloads to and from Blueprint structs.

Requirements

RequirementDetails
Unreal Engine4.27 and 5.8 (verified warning-free on both)
PlatformsWin64, Linux and Android
ModulesLambdaLink (Runtime), LambdaLinkSdk (prebuilt AWS SDK for C++ 1.11.916 in Source/ThirdParty)
DependenciesNo other plugins. On Linux and Android the SDK uses the engine's libcurl, OpenSSL and certificate store.
AWSAn AWS account. Lambda, Cognito and API Gateway usage is billed by AWS.

Installation

  1. Install LambdaLink from Fab into your engine, or copy the LambdaLink folder into your project's Plugins folder.
  2. Enable LambdaLink in Edit > Plugins and restart the editor.
  3. Open Project Settings > Plugins > LambdaLink and set Region and Identity Pool Id.
  4. C++ only: add PublicDependencyModuleNames.Add("LambdaLink"); to your Build.cs.
Several AWS plugins in one projectEach Alpha XP cloud plugin carries its own copy of the SDK under a plugin-specific name, so they install side by side without conflicts.

Setting up AWS

  1. Create your function in the Lambda console (any runtime). Note its name and region.
  2. In Amazon Cognito create an identity pool. Enable guest access if players may call functions before signing in, and add your identity providers (for example a Cognito user pool).
  3. Edit the IAM role the pool gives to players (authenticated and/or guest) so it may invoke only your game's functions:
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["lambda:InvokeFunction", "lambda:InvokeWithResponseStream"],
    "Resource": "arn:aws:lambda:us-east-1:123456789012:function:mygame-prod-*"
  }]
}

For API Gateway routes with IAM authorization add execute-api:Invoke on the route ARNs.

Never ship access keysStatic keys in the settings end up in DefaultGame.ini and in packaged games. Use them only for development and dedicated servers; players should always use the identity pool. Shipping builds refuse settings keys unless Allow Static Keys In Shipping is enabled.

Quick start

Blueprint

  1. Add Invoke Lambda to an Event Graph. Function Name SubmitScore, Payload {"score": 1200}.
  2. From On Success, read Result > Payload or call Get JSON Field with Path rank.
  3. From On Failure, print Error > Message; Error > Code says why.
  4. To send a struct, convert it with Struct To JSON; read replies into a struct with JSON To Struct.

Streaming

Configure the function for response streaming (Node.js awslambda.streamifyResponse) and call Invoke Lambda Stream. Append each On Chunk text to a widget; On Completed carries the whole payload.

Latent nodes

All latent nodes run in the background, can be stopped with Cancel on their return value and fire exactly one final pin on the game thread.

NodeInputsOutputsDescription
Invoke LambdaFunction Name, Payload, Qualifier, Invocation Type, Include Log TailOn Success / On Failure (Result, Error)Calls a function. Plain names get the Function Name Prefix from the settings; ARNs are used unchanged. A function that throws arrives on On Failure with Error.Code = the function error and Result.Payload = its error object.
Invoke Lambda StreamFunction Name, Payload, QualifierOn Chunk (Text), On Completed / On FailureCalls a response-streaming function and fires On Chunk for every piece as it arrives. Multi-byte UTF-8 characters split across pieces are joined correctly.
Invoke Lambda BatchFunction Name, Payloads, Qualifier, Max ConcurrencyOn Completed (Results, Failed Count)Invokes once per payload, up to Max Concurrency (default 4) at a time. Results are in the order of Payloads; failed entries carry the error code in Function Error.
Send Signed RequestUrl, Verb, Body, Headers, Service, RegionOn Success / On Failure (Response, Error)HTTPS request signed with AWS Signature Version 4. Service is the signing name: execute-api for API Gateway, lambda for function URLs. Status codes of 400 and above go to On Failure.
Resolve IdentityForce RefreshOn Success / On Failure (Identity Id, Error)Fetches the Cognito identity and temporary credentials now, for example right after login, so the first real request is fast and errors show up early.

Functions

NodeDescription
Set RegionSwitches the AWS region for every following request.
Set Credential ModeOverrides the credential mode from the settings at runtime.
Set Login TokenSigns the player in to the identity pool with a provider token (Cognito user pool, Google, Apple, Facebook, OpenID).
Clear Login TokensForgets all login tokens and the cached identity; the player becomes a guest.
Set Static CredentialsUses the given keys from now on (Static Keys mode), for example temporary keys handed out by your backend.
Get Identity IdThe player's Cognito identity id; empty until credentials were resolved once.
Make User Pool Provider NameBuilds the login key of a Cognito user pool: cognito-idp.<region>.amazonaws.com/<pool id>.
Is ConfiguredReturns false and a reason when the settings are incomplete.
Struct To JSONConverts any struct to a JSON object string.
JSON To StructFills a struct from a JSON object string; missing fields keep their defaults.
Get JSON FieldReads one value with a path such as player.stats[2].score.
CancelOn a latent node's return value: none of its pins fire any more.
Is FinishedOn a latent node's return value: true after it finished or was cancelled.

Credentials

ModeUse forHow
Cognito Identity PoolGame clientsGuests get unauthenticated credentials; after Set Login Token the player gets the authenticated role. Credentials refresh automatically before they expire.
Static KeysDevelopment, dedicated servers, keys from your backendSettings keys or Set Static Credentials (with an optional session token).
Default Credential ChainServers and toolsEnvironment variables, the ~/.aws profile, ECS and EC2 instance roles.

Signed-in players: for a Cognito user pool call Set Login Token with Provider = Make User Pool Provider Name and Token = the ID token. Other providers use their pool login keys (accounts.google.com, appleid.apple.com, graph.facebook.com).

C++ API

// Build.cs: PublicDependencyModuleNames.Add("LambdaLink");
#include "LambdaLinkLibrary.h"

ULambdaLinkLibrary::InvokeNative(TEXT("SubmitScore"), TEXT("{\"score\":1200}"),
    ELambdaLinkInvocationType::RequestResponse, FString(), false,
    FLambdaLinkNativeDelegate::CreateLambda([](const FLambdaLinkResult& Result, const FLambdaLinkError& Error)
    {
        // runs on the game thread
    }));

The latent node classes (ULambdaLinkInvokeAction and the others) can also be created from C++ through their static factory functions; bind the delegates, then call Activate().

Types

TypeKindMembers
FLambdaLinkResultStructStatus Code, Payload, Function Error, Log Tail, Executed Version, Duration (seconds)
FLambdaLinkErrorStructCode, Message, Http Status, Retryable
FLambdaLinkHttpResponseStructStatus Code, Body, Headers
ELambdaLinkInvocationTypeEnumRequest / Response, Event, Dry Run
ELambdaLinkCredentialModeEnumCognito Identity Pool, Static Keys, Default Credential Chain

Settings

Project Settings > Plugins > LambdaLink (saved to DefaultGame.ini). Changes apply to the next request.

SettingDefaultDescription
Regionus-east-1Region of your functions and identity pool.
Credential ModeCognito Identity PoolCognito Identity Pool, Static Keys or Default Credential Chain.
Identity Pool Id(empty)For example us-east-1:01234567-89ab-cdef-0123-456789abcdef.
Allow Guest AccessOnUnauthenticated identities before Set Login Token. The pool must allow guest access too.
Access Key Id / Secret Access Key(empty)Static Keys mode. Saved in DefaultGame.ini - development and servers only.
Allow Static Keys In ShippingOffStatic keys from the settings are refused in Shipping builds unless enabled (dedicated servers).
Endpoint Override(empty)Custom endpoint such as a local emulator (http://localhost:4566).
Request Timeout Ms / Connect Timeout Ms30000 / 5000Time limits per request.
Max Retries3Automatic retries with exponential back-off for throttling and transient errors.
Worker Threads4Background threads that run requests.
Verify SSLOnOnly disable for a local emulator.
Log Sdk WarningsOnForwards SDK warnings and errors to LogLambdaLink.
Function Name Prefix(empty)Prepended to plain function names, for example mygame-prod-.
Default Qualifier(empty)Version or alias used when a node leaves Qualifier empty, for example live.

Troubleshooting

Error codeCause and fix
NotConfiguredSet the Identity Pool Id in Project Settings > Plugins > LambdaLink, or switch the credential mode.
NotAuthorizedExceptionGuest access is off on the identity pool, or a login token expired. Enable guest access or call Set Login Token with a fresh token.
AccessDeniedExceptionThe identity pool role does not allow lambda:InvokeFunction on that function. Update the role policy (see Setting up AWS).
ResourceNotFoundExceptionWrong function name, region or qualifier. Check Function Name Prefix and Default Qualifier.
UnhandledThe function itself threw an exception. Result.Payload holds errorMessage / errorType; enable Include Log Tail to see the log.
UnavailableThe SDK library could not be loaded or the engine is shutting down. Check the Output Log for LogLambdaLink errors.
HTTP403 (Send Signed Request)The route uses IAM authorization but the role lacks execute-api:Invoke, or Service / Region do not match the endpoint.

Credits

© 2026 Alpha XP — alphaxp.net · Support: support@alphaxp.net. Includes the AWS SDK for C++ and the AWS Common Runtime (Apache License 2.0). Built and verified for Unreal Engine 4.27 and 5.8.