Amazon Web Services (AWS) has launched a feature for its serverless compute service that lets users run code in isolated environments.

Unveiled for its serverless Function as a Service platform, Lambda, AWS’ MicroVMs provide a lightweight virtualization capability. Each instance gives a single end user or session its own isolated environment, where memory and disk state are retained solely depending on the length of the session.

MicroVMs are powered by Firecracker, the same virtualization technology underpinning functions on AWS Lambda, while eliminating the need for infrastructure management or virtualization engineering nous.

The ever-creeping specter of data sovereignty, mixed with security relating to company data used in conjunction with AI workloads, has seen developers scramble for secure solutions that provide control over environment lifecycles and state.

AWS wants to fill that demand while ensuring users won’t have to manage complex infrastructures. Its MicroVM offering – available in U.S. East (N. Virginia, Ohio), U.S. West (Oregon), Europe (Ireland), and Asia Pacific (Tokyo) regions – provides up to 16 vCPUs, 32 GB of memory, and 32 GB of disk per machine. Any idle MicroVMs can also be suspended via an API call or automatically through a lifecycle policy to help reduce running costs, while preserving memory and disk state.

In total, MicroVMs support up to eight hours of total runtime and can be suspended automatically after a configurable idle window. Any installed packages, loaded models, or working file sets are available whenever a user resumes their session.

“Lambda MicroVMs is a new resource within AWS Lambda, with a distinct API surface. Lambda Functions remain the right choice for event-driven, request-response workloads, and Lambda MicroVMs is purpose-built for multi-tenant applications that need to hand each end user or session their own isolated environment to execute user- or AI-generated code,” Micah Walter, a senior solutions architect at AWS, wrote in a blog post.

“The two complement each other. An application using Lambda Functions for its event-driven backbone can call into Lambda MicroVMs for the steps that need to run untrusted code in isolation. You bring the application, and the service delivers the execution environment.”