No. AWS states that any function already referencing a deleted layer version continues to run with that layer content. Deletion only stops new functions from being configured to use it. To remove a vulnerable layer from production, update each function to a patched version.
What the documentation says
The AWS page on deleting layers is direct. When you delete a layer version, you can no longer configure new functions to use it. Functions that already reference it keep running with that content. Lambda never reuses version numbers for a layer name, so you cannot replace version 3 with a fixed version 3.
It also covers storage. If the layer used Lambda managed storage, deleting it removes the code from your account level storage quota, but functions still have access, and the content still counts toward each function's 250 MB deployment size limit. Deleting a layer version never deactivates the functions that reference it.
Why this surprises security teams
A common reaction to a vulnerable layer is to delete it. It feels decisive. In practice it hides the problem: the layer no longer shows up in the console list, yet every function that used it still loads the vulnerable library on every cold start.
Two things make this worse:
- Published function versions keep their layers. AWS says a published version's layers are immutable after publish. An old version with the vulnerable layer remains invocable if an alias or trigger points to it.
- Visibility drops. If the layer is gone, you cannot easily inspect its contents later to confirm what was inside. Save the build artifact and lockfile before deleting.
A safer order of operations
- Publish a patched layer version.
- List all functions and versions that reference the vulnerable layer ARN.
- Attach the patched version to each function and publish new function versions.
- Move aliases and triggers to the new function versions.
- Remove or delete old function versions that still carry the old layer.
- Delete the old layer version last, as housekeeping, once nothing references it.
How to check what still uses a layer
Use the function configuration, which lists layer ARNs, and loop over your functions and published versions. The AWS CLI list-functions command with all versions returns configuration for each version, and your query can filter on layer ARN. Infrastructure code that references layer ARNs by variable makes this easier.
Permissions can also be changed after the fact
AWS says you can change permissions on an existing layer version at any time, but to change its code you must publish a new version. If a vulnerable layer was shared with other accounts, revoking sharing is another step, and it does not fix functions in your own account.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice that a finding stays open until the affected asset changes. Deleting a record is not the same as fixing the asset.
Quick check
Can I replace a layer version in place?
No. Layer versions are immutable. Publish a new version and update functions to reference it.
Do deleted layer versions deactivate functions?
No. AWS states that deleting a layer version never deactivates functions that reference it.
Safeguard's dependency scanning and SBOM generation help you see which of your applications contain a vulnerable library, so the update list is complete. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
