Bring Your Own Cloud on AWS is now generally available
By Steven Van ·
Vercel's Enterprise plan can now run Node.js and Python functions as Lambda in the customer's own AWS account, with Vercel still serving the CDN.
Enterprise teams can now run Vercel Functions as AWS Lambda functions in their own AWS account. Vercel has made Bring Your Own Cloud (BYOC) generally available, so function code and execution stay inside the customer's security and compliance boundary.
Vercel continues to handle deployments, environments, routing and static assets. Customers control function execution through their own IAM permissions, network access and resource lifecycle policies. BYOC supports Node.js and Python functions, private connections to backends and services in a VPC, and use of existing AWS commitments.
How a deployment works
Builds run on the customer's own machines or CI. A BYOC deployment moves through five stages:
- Initialize: vercel deploy init creates a deployment on Vercel that waits for its functions to be provisioned.
- Build: vercel build --id builds the application with that deployment's environment variables.
- Describe: vercel deploy describe packages each function as a ZIP file and writes a descriptor.json listing the Lambda functions and layers to create. It creates no AWS resources.
- Provision: the team's own provisioning tool creates the Lambda functions and layers in its AWS account.
- Continue: vercel deploy continue uploads static assets and deployment metadata, without function code, and Vercel completes the deployment.
There are 15 minutes between vercel deploy init and vercel deploy continue. After that the deployment fails with "Provisioning exceeded the maximum allowed time."
Requests and IAM roles
The Vercel CDN terminates TLS and serves static assets and cached responses without contacting the AWS account. For a dynamic route, Vercel assumes an invocation role in the customer's account and invokes the matching Lambda function. The response returns through Vercel to the client.
BYOC uses two IAM roles. The invocation role is assumed by Vercel and allows lambda:InvokeFunction on the BYOC functions. It is registered once per team under Settings, Networking, and every BYOC project on the team can reuse it. The Lambda execution role is assumed by AWS Lambda and provides logging access and any other permissions the application needs.
What Vercel receives
Function code and runtime layers stay on the build machine and in AWS. Vercel receives static assets, routing and function configuration metadata, the function-to-Lambda mappings, the application's package.json files, and request and response data, which pass through the CDN.
What the team takes on
The customer's team owns the AWS side: function code and runtime, both IAM roles, outbound internet access and VPC attachment, AWS quotas and concurrency limits, function logs in Amazon CloudWatch, and deleting resources for deployments it no longer needs (Vercel sends a deployment.cleanup webhook). Vercel can't raise AWS quotas, recreate deleted functions, or fix IAM or network changes made in the account.
Limits
BYOC does not fit cases where all traffic must stay in the customer's account, since TLS terminates at the Vercel CDN. It does not currently satisfy FedRAMP or other government certification requirements, and it does not support the Edge runtime, the container runtime, or Services.
Availability
BYOC is available on Enterprise plans. Teams can contact sales or their account team to get started.