cloudwithshad
Week 2 Β· Lab 4 Β· Serverless Image Resizer
BUILD-ON-YOUR-OWN Β· ~75 MINUTES

Build a serverless image resizer

Drop any image into an S3 bucket and watch it auto-resize into a thumbnail β€” no servers, no Nginx, no SSH. This is what serverless really feels like.

5
PHASES
75 min
DURATION
FREE
TIER OK
S3 + Lambda
SERVICES
πŸ› οΈ

This one's on you

Lab 4 is a build-on-your-own challenge. We give you the goal, the architecture, the IAM permissions, and the starter code β€” you wire it together. Stuck? Expand the hints (πŸ’‘) for guidance. Beat the lab? Post your test images in the cohort group.

1
The goal

By the end of this lab, you'll have a fully serverless system where:

You upload S3 bucket /uploads/photo.jpg triggers Lambda Ξ» resize-image Python Β· Pillow writes S3 bucket /thumbs/photo.jpg
Upload β†’ Lambda fires automatically β†’ resized version appears.

Requirements:

  • One S3 bucket with a uploads/ prefix and a thumbs/ prefix
  • A Lambda function that runs whenever a new image lands in uploads/
  • The function resizes the image to 200px wide (keep aspect ratio) and writes it to thumbs/
  • The whole thing must work end-to-end with zero EC2, zero servers, zero SSH
2
Phase 1 β€” Create the S3 bucket

Create a brand new S3 bucket. Suggested name: cloudwithshad-resizer-<your-initials>-<random-number> (bucket names must be globally unique).

1
Bucket name: globally unique. Use lowercase only.
2
Region: same as your other resources (consistency).
3
Block all public access: keep this ON. The Lambda will access it, not the public.
4
Versioning: off (for this lab).
5
After creation, open the bucket and create two "folders": uploads/ and thumbs/
Hint: how to create a "folder" in S3

S3 doesn't really have folders β€” it has object key prefixes. But the console lets you click "Create folder" and it adds a zero-byte object ending in /. That's enough to act like a folder for our trigger.

3
Phase 2 β€” Create an IAM role for Lambda

Your Lambda function needs permission to do three things: read from S3, write to S3, write logs to CloudWatch.

  1. Go to IAM β†’ Roles β†’ Create role
  2. Trusted entity type: AWS service
  3. Use case: Lambda
  4. Attach these managed policies:
    • AWSLambdaBasicExecutionRole β€” for CloudWatch logs
    • AmazonS3FullAccess β€” for read/write to S3 (we'll tighten this later)
  5. Role name: cloudwithshad-resizer-role
Exam tip

In production, you'd never use S3FullAccess β€” you'd write a custom policy granting access only to that ONE bucket. This is the principle of least privilege. For learning, broad permissions are fine.

4
Phase 3 β€” Create the Lambda function
  1. Go to Lambda β†’ Create function
  2. Author from scratch
  3. Function name: resize-image
  4. Runtime: Python 3.12
  5. Architecture: x86_64
  6. Execution role: Use existing β†’ cloudwithshad-resizer-role
  7. Click Create function

Once created, scroll to the Code tab. Paste this code:

# Lambda handler β€” resizes ANY image dropped into uploads/ # Handles JPEG, PNG (with transparency), WebP, GIF, BMP, TIFF, CMYK, palette images, rotated phone photos. import io import os import logging from urllib.parse import unquote_plus import boto3 from PIL import Image, ImageOps, UnidentifiedImageError # Raise Pillow's decompression-bomb safety limit (default ~89M pixels) so big legit images work. Image.MAX_IMAGE_PIXELS = 200_000_000 logger = logging.getLogger() logger.setLevel(logging.INFO) s3 = boto3.client('s3') # What we'll write for each input format. Unknown formats fall back to JPEG. FORMAT_MAP = { 'JPEG': ('JPEG', 'image/jpeg', '.jpg'), 'PNG': ('PNG', 'image/png', '.png'), # keeps transparency 'WEBP': ('WEBP', 'image/webp', '.webp'), 'GIF': ('JPEG', 'image/jpeg', '.jpg'), # first frame only 'BMP': ('JPEG', 'image/jpeg', '.jpg'), 'TIFF': ('JPEG', 'image/jpeg', '.jpg'), } THUMB_MAX = (300, 300) # max width/height β€” aspect ratio preserved JPEG_QUALITY = 85 def lambda_handler(event, context): for record in event['Records']: bucket = record['s3']['bucket']['name'] key = unquote_plus(record['s3']['object']['key']) # Defence in depth β€” never resize our own output if key.startswith('thumbs/'): logger.info(f"Skipping {key} (already a thumbnail)") continue try: process_image(bucket, key) except UnidentifiedImageError: # Common cause: HEIC (iPhone), corrupted file, or it isn't actually an image. # Return success so S3 doesn't retry 3 times on something that will never work. logger.warning(f"Skipping {key}: not a recognised image (HEIC, corrupt, or not an image)") continue except Exception as e: logger.exception(f"Failed on {key}: {e}") raise # let S3 retry transient issues return {'statusCode': 200, 'body': 'done'} def process_image(bucket, key): logger.info(f"Reading s3://{bucket}/{key}") response = s3.get_object(Bucket=bucket, Key=key) img = Image.open(io.BytesIO(response['Body'].read())) # Capture the format BEFORE exif_transpose β€” it returns a new image without .format set input_format = img.format logger.info(f"Input: format={input_format}, mode={img.mode}, size={img.size}") # Apply EXIF orientation so phone photos aren't sideways img = ImageOps.exif_transpose(img) # Choose output format from input (anything weird β†’ JPEG) out_format, out_content_type, out_ext = FORMAT_MAP.get( input_format, ('JPEG', 'image/jpeg', '.jpg') ) # Make sure the image mode is compatible with the chosen output format img = convert_mode(img, out_format) # Resize β€” thumbnail() preserves aspect ratio in-place img.thumbnail(THUMB_MAX, Image.Resampling.LANCZOS) # Encode to memory buf = io.BytesIO() save_kwargs = {'format': out_format, 'optimize': True} if out_format == 'JPEG': save_kwargs['quality'] = JPEG_QUALITY img.save(buf, **save_kwargs) buf.seek(0) # Write to thumbs/ with the correct extension and content type base = os.path.splitext(os.path.basename(key))[0] out_key = f"thumbs/{base}{out_ext}" s3.put_object( Bucket=bucket, Key=out_key, Body=buf, ContentType=out_content_type, ) logger.info(f"Wrote s3://{bucket}/{out_key} ({out_content_type})") def convert_mode(img, out_format): """Convert image mode so it can be safely saved in the chosen output format. JPEG can't do transparency β€” we flatten on white. PNG/WebP keep more modes natively.""" if out_format == 'JPEG': # Transparent? Flatten onto white background if img.mode in ('RGBA', 'LA'): bg = Image.new('RGB', img.size, (255, 255, 255)) bg.paste(img, mask=img.split()[-1]) return bg if img.mode == 'P': # palette (often GIF / PNG-8) may carry transparency img = img.convert('RGBA') bg = Image.new('RGB', img.size, (255, 255, 255)) bg.paste(img, mask=img.split()[-1]) return bg if img.mode != 'RGB': # CMYK, grayscale, 1-bit, etc return img.convert('RGB') return img if out_format == 'PNG': if img.mode == 'CMYK': return img.convert('RGB') return img if out_format == 'WEBP': if img.mode == 'P': return img.convert('RGBA') if img.mode == 'CMYK': return img.convert('RGB') return img return img

Click Deploy.

πŸ“– Why is this code longer than a basic resizer?

Real-world image processing is messy. A naΓ―ve 25-line resizer works for "normal" JPEGs but breaks on roughly half the images people actually upload. Here's what each defensive block fixes:

  • ImageOps.exif_transpose β€” phone photos store rotation as EXIF metadata, not pixel data. Without this, portrait shots come out sideways.
  • convert_mode() for RGBA / LA / P β€” PNG-with-transparency, palette GIFs, and screenshots have an alpha channel. JPEG can't store alpha β€” saving raises OSError: cannot write mode RGBA as JPEG. We flatten transparency onto white.
  • FORMAT_MAP β€” PNG in β†’ PNG out (preserves transparency for logos/screenshots). JPEG in β†’ JPEG out. Weird stuff (BMP/TIFF/CMYK) β†’ JPEG. The output extension and S3 ContentType match the actual format so browsers display it correctly inline.
  • UnidentifiedImageError catch β€” iPhone HEIC photos and corrupted files crash Pillow. We log and skip cleanly so S3 doesn't retry the same broken file 3 times.
  • MAX_IMAGE_PIXELS β€” Pillow refuses images bigger than ~89 megapixels by default (anti-bomb security). Modern phone cameras push 50MP, drone shots push 100MP+. We raise the limit to 200M.
  • unquote_plus(key) β€” S3 event keys are URL-encoded. A filename with a space arrives as my+photo.jpg; without decoding, get_object fails with "key not found."
  • thumbs/ early return + the trigger prefix β€” defence in depth against the infinite-loop trap.

You'll see this pattern in every production Lambda you write: the happy path is short, the defensive code around it is what keeps it alive at 3 AM.

⚠️ One unsupported format: HEIC (iPhone .heic photos)

The code logs and skips HEIC files cleanly β€” it won't crash, but it won't resize them either. If you want HEIC support, you need an extra Lambda Layer (pillow-heif). For this lab we keep it simple: tell users to upload JPEG/PNG/WebP/GIF/BMP/TIFF. iPhone users can change their camera setting to "Most Compatible" instead of "High Efficiency" to save as JPEG by default.

⚠️ Pillow isn't in Lambda by default

The code uses the Pillow library, but Lambda's Python runtime doesn't include it. You'll get No module named 'PIL' the first time you test. The fix: attach a Lambda Layer that provides Pillow. AWS doesn't publish one, but the community-maintained Klayers project does β€” and it's free.

Add the Pillow layer β€” exact steps:

  1. Scroll down on the function page β†’ find the Layers section β†’ click "Add a layer"
  2. Three radio options appear: AWS layers, Custom layers, Specify an ARN β†’ pick Specify an ARN
  3. Paste this ARN (for us-east-1, Python 3.12):
    arn:aws:lambda:us-east-1:770693421928:layer:Klayers-p312-Pillow:11

    β“΅ Verified working as of June 2026 (Pillow 12.2.0). If you get a "version not found" error, the version at the end (:11) has bumped β€” see the callout below to look up the current one.

  4. Click Verify β€” the box on the right should say "Compatible runtimes: python3.12" βœ“
  5. Click Add
πŸ’‘ Different region or Python version?

The ARN above is specific to us-east-1 and Python 3.12. If your function is in another region or runtime, check the canonical list β€” Klayers publishes the current ARN per region/runtime here:

https://api.klayers.cloud/api/v2/p3.12/layers/latest/us-east-1/Pillow

Replace us-east-1 with your region, or p3.12 with p3.11 / p3.10 as needed. If you get a "version not found" error, the version number at the end of the ARN (:11) has bumped β€” check the URL above for the latest and update accordingly.

Optional: build your own Pillow layer instead

Klayers is the easy path. If you want the harder, more educational route: download Pillow on a Linux machine, zip it into a python/ folder, upload as your own layer. AWS docs walk through this at docs.aws.amazon.com/lambda/latest/dg/python-layers.html. More work, more learning β€” totally optional for this lab.

Now configure timeout and memory (don't skip this)

Image resizing takes a few seconds and Lambda's defaults are too tight. You'll see Task timed out after 3.00 seconds in CloudWatch logs if you skip this.

  1. Still on the function page β†’ Configuration tab β†’ General configuration β†’ Edit
  2. Memory: set to 512 MB (Pillow needs the headroom)
  3. Timeout: set to 30 seconds (gives image processing breathing room)
  4. Save
5
Phase 4 β€” Wire up the S3 trigger

Now we connect S3 to Lambda. In the Lambda function page:

  1. Click "+ Add trigger" (in the function overview diagram at the top)
  2. Select S3 from the dropdown
  3. Bucket: your resizer bucket
  4. Event types: All object create events
  5. Prefix: uploads/ ← critical β€” limits the trigger to the uploads folder only
  6. Suffix: leave empty
  7. Tick "I acknowledge that using the same S3 bucket for both input and output is not recommended..." (we handle this in code with the prefix check, so it's safe)
  8. Click Add
⚠️ Don't click "Add destination" β€” different feature!

You may see an "Add destination" button somewhere on the function page (or after a trigger fails). Ignore it for this lab. "Destinations" are for sending the Lambda's invocation result (success or failure) to another service like SQS, SNS, or EventBridge. It is NOT the same as "configure where the output image goes" β€” that's already handled by our code writing to the thumbs/ prefix.

If AI tools have told you to create a second S3 bucket as a destination, that's a different (also valid) architecture pattern β€” but it's not what this lab uses. One bucket with two prefixes works just fine.

Why the prefix matters

Without the uploads/ prefix, the trigger would fire when Lambda writes the thumb back into S3 β€” which would trigger another resize β€” infinite loop. The prefix + the early-return check in our code (if key.startswith('thumbs/')) both prevent this. Defence in depth.

6
Phase 5 β€” Test it!

The moment of truth.

  1. Open your S3 bucket in the console
  2. Navigate into uploads/
  3. Click Upload and drop in any JPG or PNG (a selfie, a screenshot, anything under 5 MB)
  4. Wait ~5 seconds
  5. Go to the thumbs/ folder and refresh
  6. You should see your image β€” resized to 200px wide πŸŽ‰

If you check the Lambda function's Monitor tab, you'll see:

  • Invocation count: 1
  • Average duration: 1-3 seconds
  • Errors: 0 (hopefully)
Submission

Take a screenshot showing both the original (in uploads/) and the resized version (in thumbs/) side by side. Post it in the cohort WhatsApp group with the caption "Lab 4 done".

Hint: what to do when it doesn't work

Go to CloudWatch β†’ Log groups β†’ /aws/lambda/resize-image. Open the most recent log stream. The error will be in plain English. Most common issues:

  • No module named 'PIL' β†’ Pillow layer not attached
  • Task timed out β†’ bump timeout from 3s to 30s
  • AccessDenied β†’ IAM role missing S3 permissions
  • Nothing in logs at all β†’ trigger isn't firing. Check prefix & bucket name.

πŸš€ Bonus challenges (for the keen)

Already done with the main lab? Try one of these β€” each one teaches a new pattern:

  • Multiple sizes: Also create thumbs-small/ (100px) and thumbs-large/ (500px) versions in one Lambda run.
  • Format conversion: Convert any input to WebP for better compression β€” and append .webp to the key.
  • Watermark: Use Pillow's ImageDraw to stamp "cloudwithshad" in the bottom-right corner of every thumb.
  • Notification: Add SNS β€” send yourself an email every time a new thumb is created.
7
Clean up

Lambda + S3 won't break the bank, but tidy habits matter. After your screenshot:

  1. Empty the S3 bucket first (Bucket β†’ Empty), then Delete the bucket
  2. Delete the Lambda function (Lambda β†’ resize-image β†’ Delete)
  3. Delete the IAM role (IAM β†’ Roles β†’ cloudwithshad-resizer-role β†’ Delete)
  4. Optional: delete the CloudWatch log group (/aws/lambda/resize-image) β€” logs are charged after 5 GB
The honest truth

Serverless changes how you think. With EC2 you ask "what server do I need?" With Lambda you ask "what should trigger when?" Both have their place β€” but the future is event-driven. You just built one. Welcome to serverless.

⚑

Lab 4 complete!

You just built a real-world serverless workflow. The same pattern powers Instagram thumbnails, e-commerce product galleries, and document scanners.

Next week: Auto-scaling, load balancing, and CI/CD pipelines