# Lambda MicroVMs > A Firecracker VM per session for code nobody reviewed, inside your AWS account, in Sydney, with VPC access. It suspends with its memory intact and resumes on the next request. - Verdict: Watching - Vendor: AWS - Layer: [AI](https://cloudlesslabs.com/stack/layers/ai/index.md). Job: Untrusted code, in Australia or next to private data - Last reviewed: 30 October 2026, by Nicolas Dao (Cloudless Labs, Sydney) - Web page: https://cloudlesslabs.com/stack/aws-lambda-microvms/. The whole stack in one file: https://cloudlesslabs.com/stack/brief.md Launched in June 2026 and in Sydney since August: a new Lambda primitive, separate from functions, that runs a Linux environment built from a Dockerfile in its own Firecracker VM. It's what you reach for when your product runs code nobody reviewed (an agent's code, a customer's script) and that code must stay in Australia or reach private data in a VPC. I'm watching it rather than using it: I haven't run it in production, and for short bursts of code in a product on Workers, [Cloudflare Sandbox](https://cloudlesslabs.com/stack/cloudflare-sandbox/index.md) is cheaper and ships a ready-made toolkit. MicroVMs win as soon as residency, the VPC, bigger machines or long sessions that keep their running processes matter. Both, priced on two real cases, are in [Cloudflare Sandbox or Lambda MicroVMs?](https://cloudlesslabs.com/stack/guides/sandbox-or-microvms/index.md). The part I like most is suspend and resume: a session idle for a while is snapshotted, memory included, and picks up exactly where it was on the next request, for up to 8 hours. The part I like least is that you build the server inside it yourself. ## Use it when - The code must run in Australia: Sydney since 19 August 2026. - The code must reach private data in a VPC, such as the client's Postgres, through a network connector. - Long, stateful sessions: a coding agent's dev server, node_modules and memory survive the user leaving, and come back on the next request. - More than 4 vCPU or 12 GiB: up to 16 vCPU, 32 GB of memory and 32 GB of disk per MicroVM. - Running untrusted files or binaries with a full VM's isolation, inside the AWS account and its security tooling. ## Don't use it when - Short bursts of code in a product on Workers: Cloudflare Sandbox bills active CPU only and costs about a quarter as much for that pattern. - The code is yours and reviewed: a Lambda or a Fargate task is simpler. - Sessions longer than 8 hours in total. ## Pricing Baseline compute billed per second while the MicroVM runs, from 1 vCPU and 2 GB (about $0.126 an hour at US East Arm rates: $0.0000276944 per vCPU-second and $0.0000036667 per GB-second). Resources above the baseline, up to 4×, billed only while used. Suspended: no compute, only snapshots ($0.0038 per GB written, $0.00155 per GB read, $0.08 per GB-month stored). Sydney rates not checked. ## Gotchas, with fixes - **Gotcha:** There's no exec or code-interpreter SDK: Lambda returns an HTTPS endpoint to your own app inside the VM. **Fix:** Bake a small server into the image (run a command, read and write files) and drive it over HTTPS with the short-lived token Lambda issues in the X-aws-proxy-auth header. - **Gotcha:** The baseline is billed every second the MicroVM runs, busy or idle. **Fix:** Set an idle policy so it suspends quickly, and stop it when the session ends. For sessions of a few minutes, don't suspend at all: one suspend and resume of a 3 GB snapshot costs more than the session's compute. - **Gotcha:** Every MicroVM starts from the same snapshot, so anything generated at initialisation (random IDs, open connections, temporary credentials) is cloned into every copy. **Fix:** Generate unique values and open connections after resume, using the hooks the service provides. - **Gotcha:** Arm64 only. **Fix:** Build the image for arm64, and check that every native dependency has an arm64 build. ## Provisioning Official Pulumi package · Official Terraform provider In @pulumi/aws (lambdamicrovms.Image and lambdamicrovms.Microvm, with egressNetworkConnectors for the VPC) and aws-native (lambda.MicrovmImage). The image is infrastructure; the MicroVMs themselves are usually started by the app at runtime (run-microvm), one per session. ## Instead, consider - [Cloudflare Sandbox](https://cloudlesslabs.com/stack/cloudflare-sandbox/index.md): Short bursts of code, a product on Workers, no Australian residency or VPC needed. - [Fargate scheduled tasks](https://cloudlesslabs.com/stack/aws-fargate-scheduled-tasks/index.md): Long jobs on code you control. ## Decision guides - [Cloudflare Sandbox or Lambda MicroVMs?](https://cloudlesslabs.com/stack/guides/sandbox-or-microvms/index.md): My product runs code nobody reviewed, written by an LLM or a customer. Where does it run safely, and which fits which business? ## The concept behind it - [Where may the data go?](https://cloudlesslabs.com/concepts/data-residency/index.md): Must the data, the prompts and the logs stay in Australia, and what does each service do with them by default? - [Where should code nobody reviewed run?](https://cloudlesslabs.com/concepts/sandboxing/index.md): Where does code written by a model or a customer run, so it can't reach your credentials, your network or the next user's files? ## Where it fits - [AI that runs the code it writes](https://cloudlesslabs.com/stack/use-cases/ai-code/index.md): pick 2. When the code must run in Australia, reach a private VPC, use more than 4 vCPU, or keep its processes through long sessions. ## Sources - [AWS introduces Lambda MicroVMs](https://aws.amazon.com/about-aws/whats-new/2026/06/aws-lambda-microvms) - [Lambda MicroVMs in five more regions, Sydney included](https://aws.amazon.com/about-aws/whats-new/2026/08/lambda-microvms-5-additional-regions) - [Lambda pricing (MicroVMs)](https://aws.amazon.com/lambda/pricing/) - [InfoQ: AWS Lambda MicroVMs](https://infoq.com/news/2026/06/aws-lambda-microvms) ## Related - [AI](https://cloudlesslabs.com/stack/layers/ai/index.md): every tool in this layer, with its verdict - [The whole stack in one file](https://cloudlesslabs.com/stack/brief.md): every use case and tool, for questions that span many - [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)