anchor.diff:  If you are building native images, and want to use https://aws.amazon.com/xray[AWS X-Ray Tracing] with your lambda
   you will need to include `quarkus-amazon-lambda-xray` as a dependency in your pom.  The AWS X-Ray
   library is not fully compatible with GraalVM so we had to do some integration work to make this work.
  +
  +In addition, remember to enable the AWS X-Ray tracing parameter in `manage.sh`, in the `cmd_create()` function.  This can also be set in the AWS Management Console.
  +[source]
  +----
  +    --tracing-config Mode=Active
  +----
  +
  +For the sam template files, add the following to the YAML function Properties.
  +[source]
  +----
  +    Tracing: Active
  +----
  +
  +AWS X-Ray does add many classes to your distribution, do ensure you are using at least the 256MB AWS Lambda memory size.
  +This is explicitly set in `manage.sh` `cmd_create()`. Whilst the native image potentially can always use a lower memory setting, it would be recommended to keep the setting the same, especially to help compare performance.
  +
  +[[https]]
  +== Using HTTPS or SSL/TLS
  +
  +If your code makes HTTPS calls, such as to a micro-service (or AWS service), you will need to add configuration to the native image,
  +as GraalVM will only include the dependencies when explictly declared.  Quarkus, by default enables this functionality on extensions that implicitly require it.
  +For further information, please consult the link:native-and-ssl[Quarkus SSL guide]
  +
  +Open src/main/resources/application.properties and add the following line to enable SSL in your native image.
  +
  +[source]
  +----
  +quarkus.ssl.native=true
  +----
  +
  +[[aws-sdk-v2]]
  +== Using the AWS Java SDK v2
  +
  +With minimal integration, it is possible to leverage the AWS Java SDK v2,
  +which can be used to invoke services such as SQS, SNS, S3 and DynamoDB.
  +
  +For native image, however the URL Connection client must be preferred over the Apache HTTP Client
  +when using synchronous mode, due to issues in the GraalVM compilation (at present).
  +
  +Add `quarkus-jaxb` as a dependency in your Maven `pom.xml`, or Gradle `build.gradle` file.
  +
  +You must also force your AWS service client for SQS, SNS, S3 et al, to use the URL Connection client,
  +which connects to AWS services over HTTPS, hence the inclusion of the SSL enabled property, as described in the <<Using HTTPS>> section above.
  +
  +[source,java]
  +----
  +// select the appropriate client, in this case SQS, and
  +// insert your region, instead of XXXX, which also improves startup time over the default client
  +  client = SqsClient.builder().region(Region.XXXX).httpClient(software.amazon.awssdk.http.urlconnection.UrlConnectionHttpClient.builder().build()).build();
  +----
  +
  +For Maven, add the following to your `pom.xml`.
  +
  +[source,xml]
  +----
  +
  +    <properties>
  +        <aws.sdk2.version>2.10.69</aws.sdk2.version>
  +    </properties>
  +
  +    <dependencyManagement>
  +        <dependencies>
  +
  +            <dependency>
  +                <groupId>software.amazon.awssdk</groupId>
  +                <artifactId>bom</artifactId>
  +                <version>${aws.sdk2.version}</version>
  +                <type>pom</type>
  +                <scope>import</scope>
  +            </dependency>
  +
  +        </dependencies>
  +    </dependencyManagement>
  +    <dependencies>
  +
  +        <dependency>
  +            <groupId>software.amazon.awssdk</groupId>
  +            <artifactId>url-connection-client</artifactId>
  +        </dependency>
  +
  +        <dependency>
  +            <groupId>software.amazon.awssdk</groupId>
  +            <artifactId>apache-client</artifactId>
  +            <exclusions>
  +                <exclusion>
  +                    <groupId>commons-logging</groupId>
  +                    <artifactId>commons-logging</artifactId>
  +                </exclusion>
  +            </exclusions>
  +        </dependency>
  +
  +        <dependency>
  +            <groupId>software.amazon.awssdk</groupId>
  +            <!-- sqs/sns/s3 etc -->
  +            <artifactId>sqs</artifactId>
  +            <exclusions>
  +                <!-- exclude the apache-client and netty client -->
  +                <exclusion>
  +                    <groupId>software.amazon.awssdk</groupId>
  +                    <artifactId>apache-client</artifactId>
  +                </exclusion>
  +                <exclusion>
  +                    <groupId>software.amazon.awssdk</groupId>
  +                    <artifactId>netty-nio-client</artifactId>
  +                </exclusion>
  +                <exclusion>
  +                    <groupId>commons-logging</groupId>
  +                    <artifactId>commons-logging</artifactId>
  +                </exclusion>
  +            </exclusions>
  +        </dependency>
  +
  +        <dependency>
  +            <groupId>org.jboss.logging</groupId>
  +            <artifactId>commons-logging-jboss-logging</artifactId>
  +            <version>1.0.0.Final</version>
  +        </dependency>
  +    </dependencies>
  +----
  +
  +NOTE: if you are using GraalVM earlier than 19.3, or see `java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty` or similar SSL error, due to the current status of GraalVM,
  +there is some additional work to bundle the function.zip, as below.  For more information, please see the link:native-and-ssl[Quarkus Native SSL Guide].
  +
  +NOTE: If you have a Linux installation of GraalVM, you can reference the artifacts directly; if not, you will need to use Docker.
  +
  +To bundle the missing artifacts, we need to first extract them from the Docker image used to build the native image.
  +
  +We do this by starting up a Docker container, in the background, and attaching to that container to copy the artifacts.
  +
  +First, let's start the GraalVM container, noting the container id output.
  +[source, shell]
  +----
  +docker run -it -d --entrypoint bash quay.io/quarkus/ubi-quarkus-native-image:19.3.1-java8
  +
  +# This will output a container id, like 6304eea6179522aff69acb38eca90bedfd4b970a5475aa37ccda3585bc2abdde
  +# Note this value as we will need it for the commands below
  +----
  +
  +First, libsunec.so, the C library used for the SSL implementation:
  +
  +[source]
  +----
  +docker cp {container-id-from-above}:/opt/graalvm/jre/lib/amd64/libsunec.so src/main/resources/
  +----
  +
  +Second, cacerts, the certificate store.  You may need to periodically obtain an updated copy, also.
  +[source]
  +----
  +docker cp {container-id-from-above}:/opt/graalvm/jre/lib/security/cacerts src/main/resources/
  +----
  +
  +We then create a new function.zip that adds these artifacts.  As we now need to execute a bootstrap script,
  +we have to rename the Quarkus image to a new name, here `boostrap.bin`, and use the below script as `bootstrap`.
  +
  +[source, shell]
  +----
  +./bootstrap.bin \
  +    -Djava.library.path=${LAMBDA_TASK_ROOT}/ssl \
  +    -Djavax.net.ssl.trustStore=${LAMBDA_TASK_ROOT}/ssl/cacerts \
  +    -Djavax.net.ssl.trustAnchors=${LAMBDA_TASK_ROOT}/ssl/cacerts \
  +    -Djavax.net.ssl.trustStorePassword=changeit
  +----
  +
  +Your final archive will look like this:
  +[source, shell]
  +----
  +jar tvf target/function.zip
  +
  +    bootstrap
  +    bootstrap.bin
  +    ssl/
  +    ssl/cacerts
  +    ssl/libsunec.so
  +----
  +
  +This can be automated with a new Maven assembly zip.xml, for a new profile, such as the `function-zip.xml` below:
  +
  +[source, xml]
  +----
  +<assembly xmlns="http://maven.apache.org/ASSEMBLY/2.0.0"
  +          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  +          xsi:schemaLocation="http://maven.apache.org/ASSEMBLY/2.0.0 http://maven.apache.org/xsd/assembly-2.0.0.xsd">
  +    <id>function-package</id>
  +    <formats>
  +        <format>zip</format>
  +    </formats>
  +    <includeBaseDirectory>false</includeBaseDirectory>
  +    <files>
  +        <file>
  +            <source>${project.build.directory}${file.separator}${artifactId}-${version}-runner</source>
  +            <outputDirectory>${file.separator}</outputDirectory>
  +            <destName>bootstrap.bin</destName>
  +            <fileMode>755</fileMode>
  +        </file>
  +        <file>
  +            <source>${project.basedir}${file.separator}src${file.separator}main${file.separator}resources${file.separator}cacerts</source>
  +            <outputDirectory>${file.separator}ssl</outputDirectory>
  +            <destName>cacerts</destName>
  +            <fileMode>644</fileMode>
  +        </file>
  +        <file>
  +            <source>${project.basedir}${file.separator}src${file.separator}main${file.separator}resources${file.separator}bootstrap</source>
  +            <outputDirectory>${file.separator}</outputDirectory>
  +            <destName>bootstrap</destName>
  +            <fileMode>755</fileMode>
  +        </file>
  +        <file>
  +            <source>${project.basedir}${file.separator}src${file.separator}main${file.separator}resources${file.separator}libsunec.so</source>
  +            <outputDirectory>${file.separator}ssl</outputDirectory>
  +            <destName>libsunec.so</destName>
  +            <fileMode>755</fileMode>
  +        </file>
  +    </files>
  +</assembly>
  +----
  +
  +Maven profile to execute the new function.zip:
  +
  +[source, xml]
  +----
  +        <profile>
  +            <id>zip</id>
  +            <activation>
  +                <property>
  +                    <name>zip</name>
  +                </property>
  +            </activation>
  +            <build>
  +                <plugins>
  +                    <plugin>
  +                        <groupId>org.apache.maven.plugins</groupId>
  +                        <artifactId>maven-assembly-plugin</artifactId>
  +                        <version>3.1.0</version>
  +                        <executions>
  +                            <execution>
  +                                <id>zip-assembly</id>
  +                                <phase>package</phase>
  +                                <goals>
  +                                    <goal>single</goal>
  +                                </goals>
  +                                <configuration>
  +                                    <finalName>function</finalName>
  +                                    <descriptors>
  +                                        <descriptor>src/assembly/function-zip.xml</descriptor>
  +                                    </descriptors>
  +                                    <attach>false</attach>
  +                                    <appendAssemblyId>false</appendAssemblyId>
  +                                </configuration>
  +                            </execution>
  +                        </executions>
  +                    </plugin>
  +                </plugins>
  +            </build>
  +        </profile>
  +----
  
positive.code: 
  [source, subs=attributes+]
  ----
  ./mvnw clean install
  ----
  
  This will compile and package your code.
  
negative.code: your convenience. Examine the output of the `manage.sh` script if you want to learn what aws commands are executed
  to create, delete, and update your lambdas.
  
  `manage.sh` supports four operation:  `create`, `delete`, `update`, and `invoke`.
  
  NOTE: To verify your setup, that you have the AWS CLI installed, executed aws configure for the AWS access keys,
  and setup the `LAMBDA_ROLE_ARN` environment variable (as described above), please execute `manage.sh` without any parameters.
  A usage statement will be printed to guide you accordingly.
  
  NOTE: If using Gradle, the path to the binaries in the `manage.sh` must be changed from `target` to `build`
  
  To see the `usage` statement, and validate AWS configuration:
  [source, subs=attributes+]
  ----
  sh manage.sh
  ----
  
  You can `create` your function using the following command:
  
  [source, subs=attributes+]
  ----
  