# AWS Lambda

> Invoke an AWS Lambda function with your Ours Privacy event data in real time for serverless transformation, enrichment, and custom processing.

Source: https://docs.oursprivacy.com/docs/aws-lambda

Use this page to connect Ours Privacy to **AWS Lambda**. Each event invokes your function, so you can transform, enrich, or validate events, or route them into other AWS services.

***

## Before you start

* A deployed Lambda function and its ARN.
* Permission to create an IAM role in the AWS account that owns the function.

Ours Privacy invokes your function through an IAM role in your AWS account.

## Setup

1. Open the [Destinations](https://app.oursprivacy.com/destinations) page and add an **AWS Lambda** destination.

2. Enter the following, then save:
   * **Lambda Function ARN**: the function to invoke. The ARN includes the region, so there's no separate region setting.
   * **Role ARN**: the role you'll create in the next step, for example `arn:aws:iam::123456789012:role/ours-privacy-lambda-invoke`.

3. Copy the **External ID** from the **Destination Info** panel on the destination's settings page.

4. In the AWS account that owns the function, create the role named in step 2. Email [support@oursprivacy.com](mailto:support@oursprivacy.com) with the External ID for the trust policy to attach.

5. Attach a permissions policy that lets the role invoke the function. Use the same ARN you entered in step 2:

   ```json
   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "lambda:InvokeFunction",
         "Resource": "<LAMBDA_FUNCTION_ARN>"
       }
     ]
   }
   ```

6. Publish a new version to start sending events.

Ours Privacy invokes the function asynchronously and doesn't wait for its response. If the role or function isn't set up correctly, the destination's **Activity** tab shows the error.

## Event format

Each invocation's payload is one event with its visitor and user records:

```json
{
  "event": {
    "event": "Order Completed",
    "distinct_id": "evt_789",
    "time": "2026-01-15T18:04:12.000Z",
    "event_properties": {
      "order_id": "12345",
      "total": 99.99
    }
  },
  "visitor": {
    "visitor_id": "visitor_123",
    "first_seen_at": "2026-01-01T00:00:00Z",
    "email": "example@example.com"
  },
  "user": {
    "external_id": "user_456",
    "email": "example@example.com"
  }
}
```

* `event` is the event as Ours Privacy received it, with its name, properties, and `distinct_id`.
* `visitor` is the profile of the visitor who triggered the event.
* `user` combines every visitor profile that shares the visitor's external ID.

The records arrive whole, contact details included, so field mappings and hashing don't apply to this destination. To keep an event from reaching it, [stop dispatch](https://docs.oursprivacy.com/docs/understanding-the-event-flow#step-3-optional-custom-mapper) with a custom mapping or a [Global Data Governance](https://docs.oursprivacy.com/docs/global-data-governance) rule.

## Delivery guarantees

Events are delivered at least once, so a retry can deliver the same event more than once. Deduplicate on `event.distinct_id`, which stays the same on every delivery of an event. Every event from a visitor shares `visitor.visitor_id`, so it can't tell two events apart.

***

## Next steps

* [Destination overview](https://docs.oursprivacy.com/docs/destination-overview): how destinations fit into the event pipeline.
* [AWS Kinesis](https://docs.oursprivacy.com/docs/aws-kinesis), [AWS SNS](https://docs.oursprivacy.com/docs/aws-sns), and [Google Pub/Sub](https://docs.oursprivacy.com/docs/google-pubsub): stream the same payload to a data stream or message topic.

## Need help?

Reach out to [support@oursprivacy.com](mailto:support@oursprivacy.com).