Critical-path Lambdas that throttle other workloads, not the customer.

The post-incident analysis was straightforward. A misbehaving batch job had spawned 800 concurrent Lambda invocations, hitting the account concurrency limit. The checkout-flow Lambda — which was small and well-behaved — got throttled because there was no concurrency reserved for it.

Reserved concurrency on the 12 critical-path functions guaranteed them a floor; provisioned concurrency on the latency-sensitive front-door function eliminated cold-start hits during traffic spikes. The batch jobs got a reserved concurrency cap to keep them well-behaved.

Checkout throttle events dropped to zero in the 90 days post-fix. Cold-start p99 on the customer-facing function is under 50ms. The batch jobs run slower at peak, which the team accepted as a deliberate trade-off — batch is async, customer-facing isn’t.