Repository navigation
Consider documenting AWS_LC_SYS_NO_JITTER_ENTROPY #1101
Description
Context: aws/aws-lc-rs#899
Docs: https://aws.github.io/aws-lc-rs/resources.html#entropy-configuration
Recent versions of AWS_LC enable a new entropy source, CPU jitter, which is somewhat expensive to initialize. It adds ~50ms of latency to startup in their testing, though I've seen signs of a decent amount higher on small instance sizes. CPU jitter is enabled by default, but can be opted out of.
Since lambdas are frequently cold-start latency sensitive, this might be relevant to our userbase. For context, java lambdas using snapstart, have it disabled by default, based on a built in AWS LC check.
We don't directly use AWS_LC, but it is widely used by lambda applications as aws-sdks default to using it as the TLS backend (along with reqwest and much of the rest of the async ecosystem). So, we can expect most lambdas to be impacted by this behavior.
The workaround is to inject an environment variable via eg your .cargo/config.toml:
[env]
AWS_LC_SYS_NO_JITTER_ENTROPY=1
The implication of disabling this is, you would only have 1-2 other entropy sources (OS source + CPU source). CPU source availability varies based on environment. You generally want >= 2 entropy sources, hence the new default.
However, on casual examination, I think pretty much any hardware that aws lambda runs on, should anyway have cpu source? (I have not looked deeply though, some might not, this needs more research).
It seems like this is something our users would appreciate knowing about. Not sure exactly where though. Perhaps it belongs in the aws-side lambda docs instead?
Activity
PeterUlb commentedon Feb 19, 2026
Just to get some numbers with limited vCPU:
I did a micro-benchmark for cold starts of a Lambda calling DDB (any AWS SDK call uses AWS_LC), averaging multiple iterations (20+) to reduce network latency / DDB warmup impact.
AWS_LC_SYS_NO_JITTER_ENTROPY=1This is particularly unfortunate as it makes Rust appear significantly slower than other runtimes for Lambda, when the real culprit is a single build flag.
jlizen commentedon Feb 19, 2026
The rust AWS sdk just posted an announcement on this specifically focused on Lambda: smithy-lang/smithy-rs#4541
Might be a good sign that we should announce as well.
danielgaskins commentedon Sep 20, 2026
I’ll put together a short README section for this. The build instructions look like the least surprising home for it. I’ll explain where the startup cost comes from, show the
.cargo/config.tomlsetting, and make the entropy tradeoff hard to miss. I’ll link the AWS-LC guidance and the SDK announcement rather than sending readers on a cryptography side quest.github-actions commentedon Sep 20, 2026
This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.