Official middlewares

Middy comes with a series of additional (opt-in) plugins that are officially maintained by the core team and kept in sync with every release of the core package.

These middleware focus on common use cases when using Lambda with other AWS services.

Each middleware should do a single task. We try to balance each to be as performant as possible while meeting the majority of developer needs.

Observability

• cloudwatch-metrics: Hydrates lambda's context.metrics property with an instance of AWS MetricLogger
• error-logger: Logs errors
• input-output-logger: Logs request and response

Lifecycle

• do-not-wait-for-empty-event-loop: Sets callbackWaitsForEmptyEventLoop property to false
• warmup: Used to pre-warm a lambda function

Request Transformation

• event-normalizer: Middleware for iterating through an AWS event records, parsing and normalizing nested events.
• http-content-negotiation: Parses Accept-* headers and provides utilities for content negotiation (charset, encoding, language and media type) for HTTP requests
• http-event-normalizer: Normalizes HTTP events by adding an empty object for queryStringParameters, multiValueQueryStringParameters or pathParameters if they are missing.
• http-header-normalizer: Normalizes HTTP header names to their canonical format
• http-json-body-parser: Automatically parses HTTP requests with JSON body and converts the body into an object. Also handles gracefully broken JSON if used in combination of httpErrorHandler.
• http-jwt: Verifies a JWT on incoming HTTP requests using a shared secret or a public key fetched from kms.
• http-multipart-body-parser: Automatically parses HTTP requests with content type multipart/form-data and converts the body into an object.
• http-paseto: Verifies a PASETO v4.public token on incoming HTTP requests using a public key fetched from kms.
• http-urlencode-body-parser: Automatically parses HTTP requests with URL encoded body (typically the result of a form submit).
• http-urlencode-path-parser: Automatically parses HTTP requests with URL encoded path.
• validator: Automatically validates incoming events and outgoing responses against custom schemas.
• ws-json-body-parser: Automatically parses WebSocket requests with JSON message and converts the message into an object.

Response Transformation

• http-content-encoding: Sets HTTP Content-Encoding header on response and compresses response body
• http-cors: Sets HTTP CORS headers on response
• http-error-handler: Creates a proper HTTP response for errors that are created with the http-errors module and represents proper HTTP errors.
• http-security-headers: Applies best practice security headers to responses. It's a simplified port of HelmetJS.
• http-partial-response: Filter response objects attributes based on query string parameters.
• http-response-serializer: HTTP response serializer.
• event-batch-response: Shapes Lambda batch responses per event source (SQS, Kinesis, DynamoDB Streams, Kafka, S3 Batch Operations, Kinesis Firehose).
• sqs-partial-batch-failure: Handles partially failed SQS batches (superseded by event-batch-response).
• ws-response: Forwards response to WebSocket endpoint.

Fetch Data

• appconfig: Fetch JSON configurations from AppConfig.
• dsql-signer: Fetches token for connecting to Aurora DSQL with IAM users.
• dynamodb: Fetch configurations from DynamoDB.
• kms: Fetches asymmetric public keys from AWS KMS for signature verification (e.g. http-jwt, http-paseto).
• rds-signer: Fetches token for connecting to RDS with IAM users.
• s3: Fetch JSON configurations from S3.
• s3-object-response: Gets and write S3 object response.
• secrets-manager: Fetches parameters from AWS Secrets Manager.
• service-discovery: Fetches Service Discovery instances to be used when connecting to other AWS services.
• ssm: Fetches parameters from AWS Systems Manager Parameter Store.
• sts: Fetches credentials to assumes IAM roles for connection to other AWS services.

Lambda Extensions

AWS Lambda Extensions run as sidecar processes inside the Lambda execution environment and expose a local HTTP API. Middleware in this category talk to that local API instead of calling AWS service endpoints directly, trading AWS SDK overhead for a Lambda Layer dependency.

Incompatible with AWS Lambda Code Signing. Extensions are deployed as AWS-published Lambda Layers. If your function restricts layers to your own signing profiles, use the SDK-direct alternatives in the Fetch Data section instead.

• appconfig-extension: Fetch AppConfig feature flags and configuration via the AppConfig Lambda Extension. Alternative to appconfig.
• secrets-manager-extension: Fetch Secrets Manager secrets via the Parameters and Secrets Lambda Extension. Alternative to secrets-manager.
• ssm-extension: Fetch SSM Parameter Store values via the Parameters and Secrets Lambda Extension. Alternative to ssm.

Last updated: 2026-05-22