on first invoke when lambda pulls new image or creates container, if result of first invoke is error (if i intentionally send bad request params) slack transport will send error only when that container is killed (aprox. 5mins after there are no new requests), if i try new requests slack transport will send them to slack

This is probably related to the async error handling of your Slack transport. If the async execution is not handled properly, the lambda will freeze before the error is sent to the webhook. The reason why it's sent later on, it's because of the lifecycle:

1. After an invoke, once the event loop is empty, it's doing a freeze (probably with a SIGSTOP signal)
2. After some time if there is no more activity, it will try to stop by:
   1. Resume first (with SIGCONT, because you can't stop a frozen process) - that would explain the execution you had after 5 minutes
   2. Terminate gracefully (with a SIGTERM)
   3. if SIGTERM is failing, it will force a stop with a SIGKILL signal

winston cloudwatch transport will not log any error to cloudwatch during container lifetime but will send them all after container is killed when lambda decide to do that

The issue seems to be similar to the previous one. In that case the project is using callback based functions, and I guess your code is using promises with async/await. You should be able to make it work correctly by using promisify util like this example:

const winstonCloudWatch = new WinstonCloudWatch({
    name: 'using-kthxbye',
    logGroupName: 'testing',
    logStreamName: 'another',
    awsRegion: 'us-east-1',
    awsAccessKeyId: await getSecretValue('AWS_ACCESS_KEY_ID'),
    awsSecretKey: await getSecretValue('AWS_SECRET_KEY'),
});
kthxbyeAsync = promisify(winstonCloudWatch.kthxbye).bind(winstonCloudWatch);
winston.add(winstonCloudWatch);

winston.add(new winston.transports.Console({
    level: 'info'
}));