Lambda Ephemeral Storage: Safe /tmp Strategies for Large Artifacts

need ≈ download + uncompressed + output + 20% margin

// cdk
const fn = new lambda.Function(this, "ArtifactWorker", {
  runtime: lambda.Runtime.NODEJS_20_X,
  memorySize: 2048,
  ephemeralStorageSize: Size.mebibytes(4096), // ✅ not default 512 for large zips
  timeout: Duration.minutes(5),
});

// tmpWorkspace.ts
import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import { randomUUID } from "node:crypto";

export async function withTmpWorkspace<T>(fn: (dir: string) => Promise<T>): Promise<T> {
  const dir = path.join(os.tmpdir(), "inv", process.env.AWS_REQUEST_ID ?? randomUUID());
  await fs.mkdir(dir, { recursive: true });
  try {
    return await fn(dir);
  } finally {
    // ✅ Always scrub — warm containers reuse /tmp
    await fs.rm(dir, { recursive: true, force: true });
  }
}

export async function assertFreshTmp() {
  // Optional hygiene: remove orphaned inv/* older than N minutes
  const root = path.join(os.tmpdir(), "inv");
  try {
    for (const name of await fs.readdir(root)) {
      const p = path.join(root, name);
      const st = await fs.stat(p);
      if (Date.now() - st.mtimeMs > 15 * 60_000) {
        await fs.rm(p, { recursive: true, force: true });
      }
    }
  } catch {
    /* ignore */
  }
}

// ❌ Wrong: fixed path shared across warm invokes
const ZIP = "/tmp/input.zip";
await downloadTo(ZIP);
await unzip(ZIP, "/tmp/out"); // leaks + races under concurrency concurrency=1 still races across invokes

import { execFile } from "node:child_process";
import { promisify } from "node:util";
const execFileAsync = promisify(execFile);

export async function safeUnzip(zipPath: string, dest: string) {
  // ✅ Example: unzip with -j avoided; use a library that blocks path traversal
  await execFileAsync("unzip", ["-qq", "-o", zipPath, "-d", dest], { timeout: 120_000 });
  // Post-pass: reject any extracted path that escapes dest via ..
}