Publish a new layer version with the patched libraries, then update every function to reference that exact version ARN. Functions do not pick up new layer versions on their own, because each layer version is an immutable snapshot. Verify every function afterwards, since old versions keep working.
Why layers need a deliberate rollout
AWS defines a layer version as an immutable snapshot, identified by a unique ARN with a version number. When you add a layer to a function you specify the exact version. That is good for repeatability and awkward for security fixes: a patched layer helps nobody until functions point at it.
AWS also says each function can use up to five layers, and the unzipped size of the function plus all layers must stay within 250 MB.
Steps
- Fix the source. Update the dependency version in the layer's manifest and lockfile, then rebuild the layer package. Build for the target architecture and runtime.
- Publish a new version. Each run of publish-layer-version creates a new layer version:
aws lambda publish-layer-version --layer-name my-layer --zip-file fileb://layer.zip --compatible-runtimes python3.14
- List the functions that use the layer. Check the function configuration for layer ARNs, across regions and accounts. Keep a record so none is missed.
- Test on a copy. Point a test alias at the new layer version and run your tests.
- Update each function. Attach the new version ARN, publish a function version, and move the production alias.
- Confirm. Read each function configuration back and check the layer ARN ends with the new version number.
- Retire the old version. Deleting a layer version stops new functions from using it, but see the next section before relying on that.
Deleting the old version does not fix functions
AWS states that when you delete a layer version, any function that already references it continues to run with that layer content. So deleting is housekeeping, not remediation. The vulnerable code stays live in every function you forgot to update.
Published function versions are also immutable, including their layers, so an old published version keeps the old layer until you delete that function version.
Make the rollout repeatable
| Practice | Why it helps |
|---|---|
| Track layer ARNs in infrastructure code | One change updates every function that references it |
| Keep a layer to function map | Tells you who is exposed when a layer has a vulnerability |
| Version layer builds with the lockfile hash | You can tell which dependency set a version contains |
| Add a CI check for outdated layer ARNs | Catches drift before production |
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a fixed version is surfaced next to the finding. Your layer rollout starts at the same point: knowing a fix exists.
Quick check
Do functions auto update to the newest layer version?
No. You specify an exact layer version ARN for each function, and a new version needs to be attached by you.
Is a Lambda layer cheaper to patch than a bundle?
It can be, because one rebuild serves many functions. You still have to update each function to point at the new version.
Safeguard can scan the dependencies in your repositories and SBOMs, and its autonomous remediation can open fix PRs (off by default, with every category on Manual). Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
