Overview
LambdaLink lets you keep game logic that must not run on the client — score validation, rewards, purchases, matchmaking rules, AI calls — in AWS Lambda and call it from Unreal Engine 4.27 and 5.8. Requests run on background worker threads with automatic retries; every result arrives back on the game thread.
- Invoke Lambda: Request / Response, Event (fire and forget) and Dry Run, with optional log tail.
- Invoke Lambda Stream: response-streaming functions delivered piece by piece.
- Invoke Lambda Batch: one function, many payloads, in parallel.
- Send Signed Request: AWS Signature V4 for API Gateway (IAM auth), Lambda function URLs and other AWS endpoints.
- Amazon Cognito identity pools for guests and signed-in players; static keys and the default AWS chain for development and servers.
- JSON helpers to convert payloads to and from Blueprint structs.
Requirements
| Requirement | Details |
|---|---|
| Unreal Engine | 4.27 and 5.8 (verified warning-free on both) |
| Platforms | Win64, Linux and Android |
| Modules | LambdaLink (Runtime), LambdaLinkSdk (prebuilt AWS SDK for C++ 1.11.916 in Source/ThirdParty) |
| Dependencies | No other plugins. On Linux and Android the SDK uses the engine's libcurl, OpenSSL and certificate store. |
| AWS | An AWS account. Lambda, Cognito and API Gateway usage is billed by AWS. |
Installation
- Install LambdaLink from Fab into your engine, or copy the
LambdaLinkfolder into your project'sPluginsfolder. - Enable LambdaLink in Edit > Plugins and restart the editor.
- Open Project Settings > Plugins > LambdaLink and set Region and Identity Pool Id.
- C++ only: add
PublicDependencyModuleNames.Add("LambdaLink");to yourBuild.cs.
Setting up AWS
- Create your function in the Lambda console (any runtime). Note its name and region.
- In Amazon Cognito create an identity pool. Enable guest access if players may call functions before signing in, and add your identity providers (for example a Cognito user pool).
- Edit the IAM role the pool gives to players (authenticated and/or guest) so it may invoke only your game's functions:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["lambda:InvokeFunction", "lambda:InvokeWithResponseStream"],
"Resource": "arn:aws:lambda:us-east-1:123456789012:function:mygame-prod-*"
}]
}
For API Gateway routes with IAM authorization add execute-api:Invoke on the route ARNs.
DefaultGame.ini and in packaged games. Use them only for development and dedicated servers; players should always use the identity pool. Shipping builds refuse settings keys unless Allow Static Keys In Shipping is enabled.Quick start
Blueprint
- Add Invoke Lambda to an Event Graph. Function Name
SubmitScore, Payload{"score": 1200}. - From On Success, read Result > Payload or call Get JSON Field with Path
rank. - From On Failure, print Error > Message; Error > Code says why.
- To send a struct, convert it with Struct To JSON; read replies into a struct with JSON To Struct.
Streaming
Configure the function for response streaming (Node.js awslambda.streamifyResponse) and call Invoke Lambda Stream. Append each On Chunk text to a widget; On Completed carries the whole payload.
Latent nodes
All latent nodes run in the background, can be stopped with Cancel on their return value and fire exactly one final pin on the game thread.
| Node | Inputs | Outputs | Description |
|---|---|---|---|
| Invoke Lambda | Function Name, Payload, Qualifier, Invocation Type, Include Log Tail | On Success / On Failure (Result, Error) | Calls a function. Plain names get the Function Name Prefix from the settings; ARNs are used unchanged. A function that throws arrives on On Failure with Error.Code = the function error and Result.Payload = its error object. |
| Invoke Lambda Stream | Function Name, Payload, Qualifier | On Chunk (Text), On Completed / On Failure | Calls a response-streaming function and fires On Chunk for every piece as it arrives. Multi-byte UTF-8 characters split across pieces are joined correctly. |
| Invoke Lambda Batch | Function Name, Payloads, Qualifier, Max Concurrency | On Completed (Results, Failed Count) | Invokes once per payload, up to Max Concurrency (default 4) at a time. Results are in the order of Payloads; failed entries carry the error code in Function Error. |
| Send Signed Request | Url, Verb, Body, Headers, Service, Region | On Success / On Failure (Response, Error) | HTTPS request signed with AWS Signature Version 4. Service is the signing name: execute-api for API Gateway, lambda for function URLs. Status codes of 400 and above go to On Failure. |
| Resolve Identity | Force Refresh | On Success / On Failure (Identity Id, Error) | Fetches the Cognito identity and temporary credentials now, for example right after login, so the first real request is fast and errors show up early. |
Functions
| Node | Description |
|---|---|
| Set Region | Switches the AWS region for every following request. |
| Set Credential Mode | Overrides the credential mode from the settings at runtime. |
| Set Login Token | Signs the player in to the identity pool with a provider token (Cognito user pool, Google, Apple, Facebook, OpenID). |
| Clear Login Tokens | Forgets all login tokens and the cached identity; the player becomes a guest. |
| Set Static Credentials | Uses the given keys from now on (Static Keys mode), for example temporary keys handed out by your backend. |
| Get Identity Id | The player's Cognito identity id; empty until credentials were resolved once. |
| Make User Pool Provider Name | Builds the login key of a Cognito user pool: cognito-idp.<region>.amazonaws.com/<pool id>. |
| Is Configured | Returns false and a reason when the settings are incomplete. |
| Struct To JSON | Converts any struct to a JSON object string. |
| JSON To Struct | Fills a struct from a JSON object string; missing fields keep their defaults. |
| Get JSON Field | Reads one value with a path such as player.stats[2].score. |
| Cancel | On a latent node's return value: none of its pins fire any more. |
| Is Finished | On a latent node's return value: true after it finished or was cancelled. |
Credentials
| Mode | Use for | How |
|---|---|---|
| Cognito Identity Pool | Game clients | Guests get unauthenticated credentials; after Set Login Token the player gets the authenticated role. Credentials refresh automatically before they expire. |
| Static Keys | Development, dedicated servers, keys from your backend | Settings keys or Set Static Credentials (with an optional session token). |
| Default Credential Chain | Servers and tools | Environment variables, the ~/.aws profile, ECS and EC2 instance roles. |
Signed-in players: for a Cognito user pool call Set Login Token with Provider = Make User Pool Provider Name and Token = the ID token. Other providers use their pool login keys (accounts.google.com, appleid.apple.com, graph.facebook.com).
C++ API
// Build.cs: PublicDependencyModuleNames.Add("LambdaLink");
#include "LambdaLinkLibrary.h"
ULambdaLinkLibrary::InvokeNative(TEXT("SubmitScore"), TEXT("{\"score\":1200}"),
ELambdaLinkInvocationType::RequestResponse, FString(), false,
FLambdaLinkNativeDelegate::CreateLambda([](const FLambdaLinkResult& Result, const FLambdaLinkError& Error)
{
// runs on the game thread
}));
The latent node classes (ULambdaLinkInvokeAction and the others) can also be created from C++ through their static factory functions; bind the delegates, then call Activate().
Types
| Type | Kind | Members |
|---|---|---|
| FLambdaLinkResult | Struct | Status Code, Payload, Function Error, Log Tail, Executed Version, Duration (seconds) |
| FLambdaLinkError | Struct | Code, Message, Http Status, Retryable |
| FLambdaLinkHttpResponse | Struct | Status Code, Body, Headers |
| ELambdaLinkInvocationType | Enum | Request / Response, Event, Dry Run |
| ELambdaLinkCredentialMode | Enum | Cognito Identity Pool, Static Keys, Default Credential Chain |
Settings
Project Settings > Plugins > LambdaLink (saved to DefaultGame.ini). Changes apply to the next request.
| Setting | Default | Description |
|---|---|---|
| Region | us-east-1 | Region of your functions and identity pool. |
| Credential Mode | Cognito Identity Pool | Cognito Identity Pool, Static Keys or Default Credential Chain. |
| Identity Pool Id | (empty) | For example us-east-1:01234567-89ab-cdef-0123-456789abcdef. |
| Allow Guest Access | On | Unauthenticated identities before Set Login Token. The pool must allow guest access too. |
| Access Key Id / Secret Access Key | (empty) | Static Keys mode. Saved in DefaultGame.ini - development and servers only. |
| Allow Static Keys In Shipping | Off | Static keys from the settings are refused in Shipping builds unless enabled (dedicated servers). |
| Endpoint Override | (empty) | Custom endpoint such as a local emulator (http://localhost:4566). |
| Request Timeout Ms / Connect Timeout Ms | 30000 / 5000 | Time limits per request. |
| Max Retries | 3 | Automatic retries with exponential back-off for throttling and transient errors. |
| Worker Threads | 4 | Background threads that run requests. |
| Verify SSL | On | Only disable for a local emulator. |
| Log Sdk Warnings | On | Forwards SDK warnings and errors to LogLambdaLink. |
| Function Name Prefix | (empty) | Prepended to plain function names, for example mygame-prod-. |
| Default Qualifier | (empty) | Version or alias used when a node leaves Qualifier empty, for example live. |
Troubleshooting
| Error code | Cause and fix |
|---|---|
NotConfigured | Set the Identity Pool Id in Project Settings > Plugins > LambdaLink, or switch the credential mode. |
NotAuthorizedException | Guest access is off on the identity pool, or a login token expired. Enable guest access or call Set Login Token with a fresh token. |
AccessDeniedException | The identity pool role does not allow lambda:InvokeFunction on that function. Update the role policy (see Setting up AWS). |
ResourceNotFoundException | Wrong function name, region or qualifier. Check Function Name Prefix and Default Qualifier. |
Unhandled | The function itself threw an exception. Result.Payload holds errorMessage / errorType; enable Include Log Tail to see the log. |
Unavailable | The SDK library could not be loaded or the engine is shutting down. Check the Output Log for LogLambdaLink errors. |
HTTP403 (Send Signed Request) | The route uses IAM authorization but the role lacks execute-api:Invoke, or Service / Region do not match the endpoint. |
Credits
© 2026 Alpha XP — alphaxp.net · Support: support@alphaxp.net. Includes the AWS SDK for C++ and the AWS Common Runtime (Apache License 2.0). Built and verified for Unreal Engine 4.27 and 5.8.