Find Lambda Functions With Too Much Memory

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListFunctionsAndLogGroups",
      "Effect": "Allow",
      "Action": ["lambda:ListFunctions", "logs:DescribeLogGroups", "logs:GetQueryResults"],
      "Resource": "*"
    },
    {
      "Sid": "QueryLambdaLogGroups",
      "Effect": "Allow",
      "Action": "logs:StartQuery",
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:*"
    }
  ]
}

// find-lambda-functions-too-much-memory.ts
// Compares each Lambda function's configured memory with the peak memory its invocations used,
// from the REPORT records in CloudWatch Logs (Logs Insights), and estimates the GB-seconds you'd save.
// Report only: it never changes a function.
// Usage: npx tsx find-lambda-functions-too-much-memory.ts [--days 14] [--ratio 0.5] [--headroom 0.3]
import { LambdaClient, paginateListFunctions } from "@aws-sdk/client-lambda";
import {
  CloudWatchLogsClient,
  GetQueryResultsCommand,
  StartQueryCommand,
  paginateDescribeLogGroups,
  type ResultField,
} from "@aws-sdk/client-cloudwatch-logs";

const args = process.argv.slice(2);
const num = (name: string, fallback: number): number => {
  const i = args.indexOf(name);
  const v = i >= 0 ? Number(args[i + 1]) : NaN;
  return Number.isFinite(v) ? v : fallback;
};
const days = num("--days", 14);
const ratio = num("--ratio", 0.5); // flag functions whose peak is below this share of configured memory
const headroom = num("--headroom", 0.3); // suggested size = peak + 30%, rounded up to 64 MB

// us-east-1 duration prices, first tier, from the AWS Price List (checked September 2026).
const PRICE_PER_GB_SECOND: Record<string, number> = { x86_64: 0.0000166667, arm64: 0.0000133334 };

const lambda = new LambdaClient({});
const logs = new CloudWatchLogsClient({});

interface Fn { name: string; memoryMB: number; arch: string; logGroup: string; format: string }
interface Usage { invocations: number; peakMB: number; p99MB: number; billedMs: number }

// Plain-text logs: REPORT lines with @memorySize and @maxMemoryUsed (bytes).
const TEXT_QUERY = `filter @type = "REPORT"
| stats count(*) as invocations, max(@maxMemoryUsed / 1000 / 1000) as peakMB,
  pct(@maxMemoryUsed / 1000 / 1000, 99) as p99MB, sum(@billedDuration) as billedMs by @log`;
// JSON logs: platform.report events with record.metrics in MB and ms.
const JSON_QUERY = `filter type = "platform.report"
| stats count(*) as invocations, max(record.metrics.maxMemoryUsedMB) as peakMB,
  pct(record.metrics.maxMemoryUsedMB, 99) as p99MB, sum(record.metrics.billedDurationMs) as billedMs by @log`;

async function listFunctions(): Promise<Fn[]> {
  const fns: Fn[] = [];
  for await (const page of paginateListFunctions({ client: lambda }, {})) {
    for (const f of page.Functions ?? []) {
      if (!f.FunctionName) continue;
      fns.push({
        name: f.FunctionName,
        memoryMB: f.MemorySize ?? 128,
        arch: f.Architectures?.[0] ?? "x86_64",
        logGroup: f.LoggingConfig?.LogGroup ?? `/aws/lambda/${f.FunctionName}`,
        format: f.LoggingConfig?.LogFormat ?? "Text",
      });
    }
  }
  return fns;
}

// StartQuery fails if any named log group doesn't exist, so keep only the ones that do.
async function existingLogGroups(names: string[]): Promise<Set<string>> {
  const found = new Set<string>();
  const prefixes = new Set(names.map((n) => (n.startsWith("/aws/lambda/") ? "/aws/lambda/" : n)));
  for (const prefix of prefixes) {
    for await (const page of paginateDescribeLogGroups({ client: logs }, { logGroupNamePrefix: prefix })) {
      for (const g of page.logGroups ?? []) if (g.logGroupName) found.add(g.logGroupName);
    }
  }
  return found;
}

async function runQuery(queryString: string, groups: string[]): Promise<Map<string, Usage>> {
  const out = new Map<string, Usage>();
  const end = Math.floor(Date.now() / 1000);
  const start = end - days * 86_400;
  for (let i = 0; i < groups.length; i += 50) { // up to 50 log groups per query
    const { queryId } = await logs.send(new StartQueryCommand({ logGroupNames: groups.slice(i, i + 50), startTime: start, endTime: end, queryString }));
    let status = "Running";
    let results: ResultField[][] = [];
    let scanned = 0;
    while (status === "Running" || status === "Scheduled") {
      await new Promise((r) => setTimeout(r, 2000));
      const res = await logs.send(new GetQueryResultsCommand({ queryId }));
      status = res.status ?? "Unknown";
      results = res.results ?? [];
      scanned = res.statistics?.bytesScanned ?? 0;
    }
    if (status !== "Complete") throw new Error(`Logs Insights query ended with status ${status}`);
    console.error(`query scanned ${(scanned / 1e9).toFixed(2)} GB`);
    for (const row of results) {
      const f = Object.fromEntries(row.map((c) => [c.field ?? "", c.value ?? ""]));
      const group = (f["@log"] ?? "").replace(/^\d+:/, ""); // "123456789012:/aws/lambda/name"
      out.set(group, { invocations: Number(f.invocations), peakMB: Number(f.peakMB), p99MB: Number(f.p99MB), billedMs: Number(f.billedMs) });
    }
  }
  return out;
}

async function main(): Promise<void> {
  const fns = await listFunctions();
  const existing = await existingLogGroups([...new Set(fns.map((f) => f.logGroup))]);
  const textGroups = [...new Set(fns.filter((f) => f.format !== "JSON" && existing.has(f.logGroup)).map((f) => f.logGroup))];
  const jsonGroups = [...new Set(fns.filter((f) => f.format === "JSON" && existing.has(f.logGroup)).map((f) => f.logGroup))];
  const usage = new Map([...(await runQuery(TEXT_QUERY, textGroups)), ...(await runQuery(JSON_QUERY, jsonGroups))]);
  const sharedGroups = new Set(fns.map((f) => f.logGroup).filter((g, i, all) => all.indexOf(g) !== i));

  const rows: { row: Record<string, string | number>; saving: number }[] = [];
  let totalSaving = 0;
  for (const f of fns) {
    const u = usage.get(f.logGroup);
    if (!u || !u.invocations) {
      rows.push({ saving: -1, row: { Function: f.name, MemoryMB: f.memoryMB, PeakMB: "-", UsedPct: "-", SuggestMB: "-", "Est$/30d": "-", Verdict: "no invocations in window" } });
      continue;
    }
    const used = u.peakMB / f.memoryMB;
    const suggest = Math.max(128, Math.ceil((u.peakMB * (1 + headroom)) / 64) * 64);
    // Upper bound: assumes duration stays the same at the lower setting, which CPU-bound code won't.
    const savedGbSeconds = (u.billedMs / 1000) * (Math.max(0, f.memoryMB - suggest) / 1024);
    const saving = savedGbSeconds * (PRICE_PER_GB_SECOND[f.arch] ?? PRICE_PER_GB_SECOND.x86_64) * (30 / days);
    let verdict = "ok";
    if (sharedGroups.has(f.logGroup)) verdict = "shared log group: check manually";
    else if (used >= 0.9) verdict = "near the limit: consider more memory";
    else if (used < ratio && suggest < f.memoryMB) {
      verdict = "OVERSIZED: test the lower setting";
      totalSaving += saving;
    }
    rows.push({ saving, row: { Function: f.name, MemoryMB: f.memoryMB, PeakMB: Math.round(u.peakMB), UsedPct: Math.round(used * 100), SuggestMB: suggest, "Est$/30d": saving.toFixed(2), Verdict: verdict } });
  }

  rows.sort((a, b) => b.saving - a.saving);
  console.table(rows.map((r) => r.row));
  console.log(`${fns.length} functions, last ${days} days. Oversized functions could save up to about $${totalSaving.toFixed(2)} per 30 days in duration charges (upper bound).`);
  console.log("Report only: no function configuration was changed.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-lambda @aws-sdk/client-cloudwatch-logs
npm install --save-dev tsx typescript

# Last 14 days, flag functions whose peak is under 50% of configured memory
AWS_PROFILE=readonly AWS_REGION=us-east-1 npx tsx find-lambda-functions-too-much-memory.ts

# A longer window and a more cautious suggestion (peak + 50%)
AWS_PROFILE=readonly AWS_REGION=us-east-1 npx tsx find-lambda-functions-too-much-memory.ts --days 30 --headroom 0.5

query scanned 3.84 GB
┌─────────┬──────────────────┬──────────┬────────┬─────────┬───────────┬──────────┬────────────────────────────────────────┐
│ (index) │ Function         │ MemoryMB │ PeakMB │ UsedPct │ SuggestMB │ Est$/30d │ Verdict                                │
├─────────┼──────────────────┼──────────┼────────┼─────────┼───────────┼──────────┼────────────────────────────────────────┤
│ 0       │ 'image-resizer'  │ 3008     │ 412    │ 14      │ 576       │ '41.87'  │ 'OVERSIZED: test the lower setting'    │
│ 1       │ 'orders-api'     │ 1024     │ 180    │ 18      │ 256       │ '4.50'   │ 'OVERSIZED: test the lower setting'    │
│ 2       │ 'report-builder' │ 2048     │ 1890   │ 92      │ 2496      │ '0.00'   │ 'near the limit: consider more memory' │
│ 3       │ 'webhook-relay'  │ 256      │ 88     │ 34      │ 128       │ '0.21'   │ 'OVERSIZED: test the lower setting'    │
│ 4       │ 'audit-writer'   │ 512      │ 301    │ 59      │ 448       │ '0.09'   │ 'ok'                                   │
│ 5       │ 'legacy-cron'    │ 1536     │ '-'    │ '-'     │ '-'       │ '-'      │ 'no invocations in window'             │
└─────────┴──────────────────┴──────────┴────────┴─────────┴───────────┴──────────┴────────────────────────────────────────┘
6 functions, last 14 days. Oversized functions could save up to about $46.58 per 30 days in duration charges (upper bound).
Report only: no function configuration was changed.