> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-delivery/3.0/use-deployments/overview-2/serverless-infrastructure.md).

# Serverless infrastructure

Create Harness environments and Serverless Lambda infrastructure definitions to target your AWS account for deployment.

An infrastructure definition links a Harness environment to the AWS account, region, and deployment stage where your Serverless Lambda functions run. You create both at **Deployments > Environments** and reuse them across pipelines.

***

### What you will learn <a href="#what-you-will-learn" id="what-you-will-learn"></a>

* How to create a Harness environment for Serverless Lambda deployments.
* How to configure an infrastructure definition with an AWS connector, region, and stage.
* The AWS authentication methods supported for Serverless deployments.
* How to configure dynamic provisioning for the infrastructure definition.

***

### Create an environment <a href="#create-an-environment" id="create-an-environment"></a>

To create a new Harness environment:

1. Go to **Deployments**, expand the drop-down, and select **Environments**.
2. Select **+ New Environment**.
3. Enter a name and select an environment type: **Pre-Production** or **Production**. The type affects governance policies and deployment dashboards.
4. Select **Save**.

Harness opens the environment detail page with three tabs: **Configuration**, **Infrastructure Definitions**, and **References**.

***

### Create an infrastructure definition <a href="#create-an-infrastructure-definition" id="create-an-infrastructure-definition"></a>

Infrastructure definitions live inside an environment. Each definition links the environment to a specific AWS region and deployment stage.

1. Open the environment and select the **Infrastructure Definitions** tab.
2. Select **+ Create Infrastructure**.
3. Select **Serverless Lambda** as the infrastructure type.
4. Enter a name. Harness auto-suggests one, and you can change both the name and ID.
5. Under **Storage**, choose **Inline** or a Git repository.
6. Fill in the fields under **Amazon Web Services Details** as described below.
7. Configure **Simultaneous deployments** and **Scope to Specific Services** as needed.
8. Select **Save**.

#### AWS infrastructure details <a href="#aws-details" id="aws-details"></a>

| Field         | Required | Description                                                                                                                                                         |
| ------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connector** | Yes      | The AWS connector that Harness uses to authenticate with AWS. Harness uses these credentials to run `serverless deploy` and interact with CloudFormation.           |
| **Region**    | Yes      | The AWS region to deploy to, for example `US East (N. Virginia)`. This value is passed as `--region` to the Serverless CLI. Supports expressions and runtime input. |
| **Stage**     | Yes      | The deployment stage name, for example `dev` or `prod`. This value is passed as `--stage` to the Serverless CLI. Supports expressions and runtime input.            |

***

### AWS authentication methods <a href="#auth-methods" id="auth-methods"></a>

The AWS connector supports several authentication methods for Serverless deployments.

| Method                                    | Description                                                                                                           |
| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| **Access key and secret**                 | Static credentials stored as Harness secrets.                                                                         |
| **IAM role**                              | The connector assumes an IAM role using `sts:AssumeRole`. Requires the delegate to have base credentials to call STS. |
| **OIDC**                                  | The connector exchanges an OIDC token for temporary AWS credentials. Requires delegate version 857xx or later.        |
| **IAM Roles for Service Accounts (IRSA)** | The connector uses Kubernetes service account annotations to obtain credentials via the EKS Pod Identity Webhook.     |
| **EC2 instance role**                     | The delegate running on an EC2 instance uses the instance's IAM role.                                                 |

Go to **Platform > Connectors** in your Harness account to add or configure an AWS connector with any of these authentication methods.

***

### Dynamic provisioning <a href="#dynamic-provisioning" id="dynamic-provisioning"></a>

Instead of targeting a pre-existing AWS region and stage, you can have a provisioner step create or look up the target infrastructure at runtime and pass its outputs directly into the infrastructure definition.

The following provisioner types are supported for Serverless Lambda deployments:

* Terraform
* Terragrunt
* Terraform Cloud
* CloudFormation
* Shell Script

#### Configure dynamic provisioning <a href="#configure-dynamic-provisioning" id="configure-dynamic-provisioning"></a>

The **Provisioner Configuration** section appears inside **Amazon Web Services Details** when you create or edit an infrastructure definition.

1. Under **Amazon Web Services Details**, expand **Provisioner Configuration**.
2. Set **Map Dynamically Provisioned Infrastructure** to **True**. A **Provisioner** field appears.
3. In the **Provisioner** field, select or enter the provisioner step whose outputs should populate the infrastructure fields. Use `<+input>` to make this a runtime selection.
4. Set the **Connector**, **Region**, and **Stage** fields to expression type and reference the provisioner outputs using `<+provisioner.OUTPUT_NAME>` syntax.

For example, a CloudFormation template that outputs the required values:

```yaml
Outputs:
  region_name:
    Value: !Ref AWS::Region
    Description: AWS region where the Serverless Framework application is deployed

  stage_name:
    Value: !Ref StageName
    Description: The stage name for the Serverless deployment
```

Map the outputs in the infrastructure definition:

* **Region** → `<+provisioner.region_name>`
* **Stage** → `<+provisioner.stage_name>`

***

### Simultaneous deployments <a href="#simultaneous-deployments" id="simultaneous-deployments"></a>

By default, Harness queues deployments to the same infrastructure definition to prevent conflicts; the UI shows **Simultaneous deployments: False**. Set this to **True** to allow concurrent deployments to the same target.

***

### Scope to specific services <a href="#scope-to-specific-services" id="scope-to-specific-services"></a>

By default, an infrastructure definition is available to any service in the environment. Enable **Scope to Specific Services** to limit the infrastructure definition so it only appears when deploying a specific set of services. This prevents teams from accidentally targeting the wrong infrastructure.

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* Go to [Serverless services](/continuous-delivery/3.0/use-deployments/overview-2/serverless-services.md) to configure manifests and artifact sources.
* Go to [Serverless deployment](/continuous-delivery/3.0/use-deployments/overview-2/serverless-deployment.md) to configure execution steps and rollback.

{% @harness-feedback/feedback %}