Lambda allows up to five layers per function, and the layers count toward the 250 MB unzipped package limit. When you hit that, you can merge layers, bundle dependencies into the function package, or switch to a container image. Each choice changes how you patch, so pick on patching, not convenience.
What the limits are
AWS documents that you can include up to five layers per function, that layers work only with functions deployed as .zip archives, and that a layer's contents are extracted to /opt. The unzipped deployment size limit of 250 MB includes layers.
Option 1: merge layers
Combine two or three layers into one. This frees slots and keeps the shared patching model.
- Good when the merged layers change together.
- Risky when they have different owners, because one team now blocks another.
- Keep a manifest of the layer's contents so the merge does not hide what is inside.
Option 2: bundle into the package
Put dependencies in the function zip.
- Good when only one or two functions use a library.
- Patching is per function, so a shared vulnerability means rebuilding each one.
- Scanning is simpler, since the artifact is self-contained.
Option 3: move to a container image
AWS says container image functions package their own runtime and dependencies, and layers are not used there. The code package limit is 10 GB uncompressed.
- Good for large or native dependencies.
- You own more of the stack, including base image refreshes. See rebuilding after a base image update.
- AWS notes you cannot change the package type of an existing function, so this means creating a new function. See converting a zip function.
A decision table
| Situation | Leaning |
|---|---|
| Shared libraries, one owner, change together | Merge layers |
| Library used by one or two functions | Bundle into the package |
| Large or native dependencies, over 250 MB | Container image |
| Go or Rust function | Compile into the binary, see AWS guidance on layers for Go and Rust |
Whatever you choose, keep an inventory
A layer is easy to forget because the function code never shows it. List each function with its layer ARNs and versions. AWS's list-functions output includes each function's layers and runtime, which makes a script straightforward, as covered in inventorying every Lambda function and layer.
Try it yourself
Open the demo and trace one package to every place it is used. That cross-reference is what you need before you merge or split layers.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard's SBOM and dependency scanning can cover the build of a layer as well as of a function, so merged or split layers still have an inventory. Free scan: gold.safeguard.sh/scan.
Quick check
Do layers count toward the package size limit?
Yes. AWS says the 250 MB unzipped limit includes layers and custom runtimes.
Can container image functions use layers?
No. AWS says layers apply only to .zip functions, and container images package their own dependencies.
Sources
- Managing Lambda dependencies with layers, AWS documentation
- Lambda quotas, AWS documentation
- Create a Lambda function using a container image, AWS documentation
Last reviewed: 19 October 2026.
