Build Lambda layer version configurations with compatible runtimes, architectures, and cross-account policies.
Build Lambda layer version configurations with compatible runtimes, architectures, and cross-account policies.
Required Fields
LayerNameCompatibleRuntimesContent.S3BucketContent.S3KeyOutput will appear here...The builder validates that LayerName, CompatibleRuntimes, Content.S3Bucket, and Content.S3Key all resolve before accepting the JSON as a valid PublishLayerVersion request, the fields Lambda needs to know the layer's name, which runtimes claim compatibility, and where the actual zip content lives in S3; it can't verify the S3 object actually exists or that its contents genuinely match the declared CompatibleArchitectures.
Build a Lambda layer version definition, packaged code/dependencies deployed independently from function code, referenced by CompatibleRuntimes and CompatibleArchitectures which gate which functions can actually attach it. A function attempting to attach a layer built for arm64 while itself configured for x86_64 (or vice versa) fails at deployment with an architecture mismatch, a real, easy-to-hit gotcha since Lambda functions and layers each declare architecture independently, and a layer published only for one architecture silently can't be used by a function on the other, even if the runtime version matches perfectly.
Listing both x86_64 and arm64 in CompatibleArchitectures is a claim, not a guarantee, verify the actual layer zip contents include correctly-built binaries for both architectures before publishing, a layer with only x86_64 binaries but both architectures listed will fail at runtime for arm64 functions, not at layer-publish time.
Total unzipped size across a function's code plus all attached layers is capped (250MB), a layer that's individually small can still push a function over the combined limit when several layers stack up, check the combined total, not just each layer's individual size.
RetainOldVersions doesn't automatically re-point functions using an about-to-be-pruned old version, if a function's IaC or deployment pipeline hardcodes an old layer version ARN, pruning that version out from under it (whether via retention policy or manual deletion) breaks that function's next cold start.
The function deployment or update fails outright with an architecture mismatch error, Lambda doesn't attempt any kind of automatic translation or fallback. If you need a layer usable by functions on both architectures, you need to build genuinely multi-architecture content and list both architectures in CompatibleArchitectures, listing both without the actual binary content supporting both just means the mismatch surfaces at runtime for whichever architecture wasn't really supported.
No, functions reference a specific layer version number (like shared-utils-layer:5), not a floating 'latest' pointer, so publishing a new version has zero effect on functions still pinned to an older version ARN until someone explicitly updates the function's configuration to reference the new version.
Yes, via LayerVersionPolicy with a Principal scoped to a specific account's root ARN (as the example does with two specific account root ARNs), rather than a wildcard Principal, which would make the layer version usable by any AWS account. Scoping the principal explicitly is the standard pattern for controlled cross-account layer sharing.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.