AWS Lambda

Use this page to connect Ours Privacy to AWS Lambda. Each event invokes your function, so you can transform, enrich, or validate events, or route them into other AWS services.

Before you start

• A deployed Lambda function and its ARN.
• Permission to create an IAM role in the AWS account that owns the function.

Ours Privacy invokes your function through an IAM role in your AWS account.

Setup

1. Open the Destinations page and add an AWS Lambda destination.

2. Enter the following, then save:

   • Lambda Function ARN: the function to invoke. The ARN includes the region, so there's no separate region setting.
   • Role ARN: the role you'll create in the next step, for example arn:aws:iam::123456789012:role/ours-privacy-lambda-invoke.

3. Copy the External ID from the Destination Info panel on the destination's settings page.

4. In the AWS account that owns the function, create the role named in step 2. Email support@oursprivacy.com with the External ID for the trust policy to attach.

5. Attach a permissions policy that lets the role invoke the function. Use the same ARN you entered in step 2:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "lambda:InvokeFunction",
         "Resource": "<LAMBDA_FUNCTION_ARN>"
       }
     ]
   }

6. Publish a new version to start sending events.

Ours Privacy invokes the function asynchronously and doesn't wait for its response. If the role or function isn't set up correctly, the destination's Activity tab shows the error.

Event format

Each invocation's payload is one event with its visitor and user records:

{
  "event": {
    "event": "Order Completed",
    "distinct_id": "evt_789",
    "time": "2026-01-15T18:04:12.000Z",
    "event_properties": {
      "order_id": "12345",
      "total": 99.99
    }
  },
  "visitor": {
    "visitor_id": "visitor_123",
    "first_seen_at": "2026-01-01T00:00:00Z",
    "email": "example@example.com"
  },
  "user": {
    "external_id": "user_456",
    "email": "example@example.com"
  }
}

• event is the event as Ours Privacy received it, with its name, properties, and distinct_id.
• visitor is the profile of the visitor who triggered the event.
• user combines every visitor profile that shares the visitor's external ID.

The records arrive whole, contact details included, so field mappings and hashing don't apply to this destination. To keep an event from reaching it, stop dispatch with a custom mapping or a Global Data Governance rule.

Delivery guarantees

Events are delivered at least once, so a retry can deliver the same event more than once. Deduplicate on event.distinct_id, which stays the same on every delivery of an event. Every event from a visitor shares visitor.visitor_id, so it can't tell two events apart.

Next steps

• Destination overview: how destinations fit into the event pipeline.
• AWS Kinesis, AWS SNS, and Google Pub/Sub: stream the same payload to a data stream or message topic.

Need help?

Reach out to support@oursprivacy.com.