LayerVersionPermission class
Manages an AWS Lambda Layer Version Permission. Use this resource to share Lambda Layers with other AWS accounts, organizations, or make them publicly accessible.
For information about Lambda Layer Permissions and how to use them, see Using Resource-based Policies for AWS Lambda.
> Note: Setting skipDestroy to true means that the AWS Provider will not destroy any layer version permission, even when running pulumi destroy. Layer version permissions are thus intentional dangling resources that are not managed by Pulumi and may incur extra expense in your AWS account.
Example Usage
Share Layer with Specific Account
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
// Lambda layer to share
const example = new aws.lambda.LayerVersion("example", {
code: new pulumi.asset.FileArchive("layer.zip"),
layerName: "shared_utilities",
description: "Common utilities for Lambda functions",
compatibleRuntimes: [
"nodejs24.x",
"python3.12",
],
});
// Grant permission to specific AWS account
const exampleLayerVersionPermission = new aws.lambda.LayerVersionPermission("example", {
layerName: example.layerName,
versionNumber: example.version.apply(x =>Number(x)),
principal: "123456789012",
action: "lambda:GetLayerVersion",
statementId: "dev-account-access",
});
import pulumi
import pulumi_aws as aws
# Lambda layer to share
example = aws.lambda_.LayerVersion("example",
code=pulumi.FileArchive("layer.zip"),
layer_name="shared_utilities",
description="Common utilities for Lambda functions",
compatible_runtimes=[
"nodejs24.x",
"python3.12",
])
# Grant permission to specific AWS account
example_layer_version_permission = aws.lambda_.LayerVersionPermission("example",
layer_name=example.layer_name,
version_number=example.version.apply(lambda x: int(x)),
principal="123456789012",
action="lambda:GetLayerVersion",
statement_id="dev-account-access")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
// Lambda layer to share
var example = new Aws.Lambda.LayerVersion("example", new()
{
Code = new FileArchive("layer.zip"),
LayerName = "shared_utilities",
Description = "Common utilities for Lambda functions",
CompatibleRuntimes = new[]
{
"nodejs24.x",
"python3.12",
},
});
// Grant permission to specific AWS account
var exampleLayerVersionPermission = new Aws.Lambda.LayerVersionPermission("example", new()
{
LayerName = example.LayerName,
VersionNumber = example.Version,
Principal = "123456789012",
Action = "lambda:GetLayerVersion",
StatementId = "dev-account-access",
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/lambda"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Lambda layer to share
example, err := lambda.NewLayerVersion(ctx, "example", &lambda.LayerVersionArgs{
Code: pulumi.NewFileArchive("layer.zip"),
LayerName: pulumi.String("shared_utilities"),
Description: pulumi.String("Common utilities for Lambda functions"),
CompatibleRuntimes: pulumi.StringArray{
pulumi.String("nodejs24.x"),
pulumi.String("python3.12"),
},
})
if err != nil {
return err
}
// Grant permission to specific AWS account
_, err = lambda.NewLayerVersionPermission(ctx, "example", &lambda.LayerVersionPermissionArgs{
LayerName: example.LayerName,
VersionNumber: example.Version,
Principal: pulumi.String("123456789012"),
Action: pulumi.String("lambda:GetLayerVersion"),
StatementId: pulumi.String("dev-account-access"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
aws = {
source = "pulumi/aws"
}
}
}
# Lambda layer to share
resource "aws_lambda_layerversion" "example" {
code = fileArchive("layer.zip")
layer_name = "shared_utilities"
description = "Common utilities for Lambda functions"
compatible_runtimes = ["nodejs24.x", "python3.12"]
}
# Grant permission to specific AWS account
resource "aws_lambda_layerversionpermission" "example" {
layer_name = aws_lambda_layerversion.example.layer_name
version_number = aws_lambda_layerversion.example.version
principal = "123456789012"
action = "lambda:GetLayerVersion"
statement_id = "dev-account-access"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.lambda.LayerVersion;
import com.pulumi.aws.lambda.LayerVersionArgs;
import com.pulumi.aws.lambda.LayerVersionPermission;
import com.pulumi.aws.lambda.LayerVersionPermissionArgs;
import com.pulumi.asset.FileArchive;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Lambda layer to share
var example = new LayerVersion("example", LayerVersionArgs.builder()
.code(new FileArchive("layer.zip"))
.layerName("shared_utilities")
.description("Common utilities for Lambda functions")
.compatibleRuntimes(
"nodejs24.x",
"python3.12")
.build());
// Grant permission to specific AWS account
var exampleLayerVersionPermission = new LayerVersionPermission("exampleLayerVersionPermission", LayerVersionPermissionArgs.builder()
.layerName(example.layerName())
.versionNumber(example.version())
.principal("123456789012")
.action("lambda:GetLayerVersion")
.statementId("dev-account-access")
.build());
}
}
resources:
# Lambda layer to share
example:
type: aws:lambda:LayerVersion
properties:
code:
fn::fileArchive: layer.zip
layerName: shared_utilities
description: Common utilities for Lambda functions
compatibleRuntimes:
- nodejs24.x
- python3.12
# Grant permission to specific AWS account
exampleLayerVersionPermission:
type: aws:lambda:LayerVersionPermission
name: example
properties:
layerName: ${example.layerName}
versionNumber: ${example.version}
principal: '123456789012'
action: lambda:GetLayerVersion
statementId: dev-account-access
Share Layer with Organization
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.lambda.LayerVersionPermission("example", {
layerName: exampleAwsLambdaLayerVersion.layerName,
versionNumber: Number(exampleAwsLambdaLayerVersion.version),
principal: "*",
organizationId: "o-1234567890",
action: "lambda:GetLayerVersion",
statementId: "org-wide-access",
});
import pulumi
import pulumi_aws as aws
example = aws.lambda_.LayerVersionPermission("example",
layer_name=example_aws_lambda_layer_version["layerName"],
version_number=int(example_aws_lambda_layer_version["version"]),
principal="*",
organization_id="o-1234567890",
action="lambda:GetLayerVersion",
statement_id="org-wide-access")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.Lambda.LayerVersionPermission("example", new()
{
LayerName = exampleAwsLambdaLayerVersion.LayerName,
VersionNumber = exampleAwsLambdaLayerVersion.Version,
Principal = "*",
OrganizationId = "o-1234567890",
Action = "lambda:GetLayerVersion",
StatementId = "org-wide-access",
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/lambda"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := lambda.NewLayerVersionPermission(ctx, "example", &lambda.LayerVersionPermissionArgs{
LayerName: pulumi.Any(exampleAwsLambdaLayerVersion.LayerName),
VersionNumber: pulumi.Any(exampleAwsLambdaLayerVersion.Version),
Principal: pulumi.String("*"),
OrganizationId: pulumi.String("o-1234567890"),
Action: pulumi.String("lambda:GetLayerVersion"),
StatementId: pulumi.String("org-wide-access"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
aws = {
source = "pulumi/aws"
}
}
}
resource "aws_lambda_layerversionpermission" "example" {
layer_name = exampleAwsLambdaLayerVersion.layerName
version_number = exampleAwsLambdaLayerVersion.version
principal = "*"
organization_id = "o-1234567890"
action = "lambda:GetLayerVersion"
statement_id = "org-wide-access"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.lambda.LayerVersionPermission;
import com.pulumi.aws.lambda.LayerVersionPermissionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new LayerVersionPermission("example", LayerVersionPermissionArgs.builder()
.layerName(exampleAwsLambdaLayerVersion.layerName())
.versionNumber(exampleAwsLambdaLayerVersion.version())
.principal("*")
.organizationId("o-1234567890")
.action("lambda:GetLayerVersion")
.statementId("org-wide-access")
.build());
}
}
resources:
example:
type: aws:lambda:LayerVersionPermission
properties:
layerName: ${exampleAwsLambdaLayerVersion.layerName}
versionNumber: ${exampleAwsLambdaLayerVersion.version}
principal: '*'
organizationId: o-1234567890
action: lambda:GetLayerVersion
statementId: org-wide-access
Share Layer Publicly
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.lambda.LayerVersionPermission("example", {
layerName: exampleAwsLambdaLayerVersion.layerName,
versionNumber: Number(exampleAwsLambdaLayerVersion.version),
principal: "*",
action: "lambda:GetLayerVersion",
statementId: "public-access",
});
import pulumi
import pulumi_aws as aws
example = aws.lambda_.LayerVersionPermission("example",
layer_name=example_aws_lambda_layer_version["layerName"],
version_number=int(example_aws_lambda_layer_version["version"]),
principal="*",
action="lambda:GetLayerVersion",
statement_id="public-access")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.Lambda.LayerVersionPermission("example", new()
{
LayerName = exampleAwsLambdaLayerVersion.LayerName,
VersionNumber = exampleAwsLambdaLayerVersion.Version,
Principal = "*",
Action = "lambda:GetLayerVersion",
StatementId = "public-access",
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/lambda"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := lambda.NewLayerVersionPermission(ctx, "example", &lambda.LayerVersionPermissionArgs{
LayerName: pulumi.Any(exampleAwsLambdaLayerVersion.LayerName),
VersionNumber: pulumi.Any(exampleAwsLambdaLayerVersion.Version),
Principal: pulumi.String("*"),
Action: pulumi.String("lambda:GetLayerVersion"),
StatementId: pulumi.String("public-access"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
aws = {
source = "pulumi/aws"
}
}
}
resource "aws_lambda_layerversionpermission" "example" {
layer_name = exampleAwsLambdaLayerVersion.layerName
version_number = exampleAwsLambdaLayerVersion.version
principal = "*"
action = "lambda:GetLayerVersion"
statement_id = "public-access"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.lambda.LayerVersionPermission;
import com.pulumi.aws.lambda.LayerVersionPermissionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new LayerVersionPermission("example", LayerVersionPermissionArgs.builder()
.layerName(exampleAwsLambdaLayerVersion.layerName())
.versionNumber(exampleAwsLambdaLayerVersion.version())
.principal("*")
.action("lambda:GetLayerVersion")
.statementId("public-access")
.build());
}
}
resources:
example:
type: aws:lambda:LayerVersionPermission
properties:
layerName: ${exampleAwsLambdaLayerVersion.layerName}
versionNumber: ${exampleAwsLambdaLayerVersion.version}
principal: '*'
action: lambda:GetLayerVersion
statementId: public-access
Multiple Account Access
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
// Share with multiple specific accounts
const devAccount = new aws.lambda.LayerVersionPermission("dev_account", {
layerName: example.layerName,
versionNumber: Number(example.version),
principal: "111111111111",
action: "lambda:GetLayerVersion",
statementId: "dev-account",
});
const stagingAccount = new aws.lambda.LayerVersionPermission("staging_account", {
layerName: example.layerName,
versionNumber: Number(example.version),
principal: "222222222222",
action: "lambda:GetLayerVersion",
statementId: "staging-account",
});
const prodAccount = new aws.lambda.LayerVersionPermission("prod_account", {
layerName: example.layerName,
versionNumber: Number(example.version),
principal: "333333333333",
action: "lambda:GetLayerVersion",
statementId: "prod-account",
});
import pulumi
import pulumi_aws as aws
# Share with multiple specific accounts
dev_account = aws.lambda_.LayerVersionPermission("dev_account",
layer_name=example["layerName"],
version_number=int(example["version"]),
principal="111111111111",
action="lambda:GetLayerVersion",
statement_id="dev-account")
staging_account = aws.lambda_.LayerVersionPermission("staging_account",
layer_name=example["layerName"],
version_number=int(example["version"]),
principal="222222222222",
action="lambda:GetLayerVersion",
statement_id="staging-account")
prod_account = aws.lambda_.LayerVersionPermission("prod_account",
layer_name=example["layerName"],
version_number=int(example["version"]),
principal="333333333333",
action="lambda:GetLayerVersion",
statement_id="prod-account")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
// Share with multiple specific accounts
var devAccount = new Aws.Lambda.LayerVersionPermission("dev_account", new()
{
LayerName = example.LayerName,
VersionNumber = example.Version,
Principal = "111111111111",
Action = "lambda:GetLayerVersion",
StatementId = "dev-account",
});
var stagingAccount = new Aws.Lambda.LayerVersionPermission("staging_account", new()
{
LayerName = example.LayerName,
VersionNumber = example.Version,
Principal = "222222222222",
Action = "lambda:GetLayerVersion",
StatementId = "staging-account",
});
var prodAccount = new Aws.Lambda.LayerVersionPermission("prod_account", new()
{
LayerName = example.LayerName,
VersionNumber = example.Version,
Principal = "333333333333",
Action = "lambda:GetLayerVersion",
StatementId = "prod-account",
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/lambda"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
// Share with multiple specific accounts
_, err := lambda.NewLayerVersionPermission(ctx, "dev_account", &lambda.LayerVersionPermissionArgs{
LayerName: pulumi.Any(example.LayerName),
VersionNumber: pulumi.Any(example.Version),
Principal: pulumi.String("111111111111"),
Action: pulumi.String("lambda:GetLayerVersion"),
StatementId: pulumi.String("dev-account"),
})
if err != nil {
return err
}
_, err = lambda.NewLayerVersionPermission(ctx, "staging_account", &lambda.LayerVersionPermissionArgs{
LayerName: pulumi.Any(example.LayerName),
VersionNumber: pulumi.Any(example.Version),
Principal: pulumi.String("222222222222"),
Action: pulumi.String("lambda:GetLayerVersion"),
StatementId: pulumi.String("staging-account"),
})
if err != nil {
return err
}
_, err = lambda.NewLayerVersionPermission(ctx, "prod_account", &lambda.LayerVersionPermissionArgs{
LayerName: pulumi.Any(example.LayerName),
VersionNumber: pulumi.Any(example.Version),
Principal: pulumi.String("333333333333"),
Action: pulumi.String("lambda:GetLayerVersion"),
StatementId: pulumi.String("prod-account"),
})
if err != nil {
return err
}
return nil
})
}
pulumi {
required_providers {
aws = {
source = "pulumi/aws"
}
}
}
# Share with multiple specific accounts
resource "aws_lambda_layerversionpermission" "dev_account" {
layer_name = example.layerName
version_number = example.version
principal = "111111111111"
action = "lambda:GetLayerVersion"
statement_id = "dev-account"
}
resource "aws_lambda_layerversionpermission" "staging_account" {
layer_name = example.layerName
version_number = example.version
principal = "222222222222"
action = "lambda:GetLayerVersion"
statement_id = "staging-account"
}
resource "aws_lambda_layerversionpermission" "prod_account" {
layer_name = example.layerName
version_number = example.version
principal = "333333333333"
action = "lambda:GetLayerVersion"
statement_id = "prod-account"
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.lambda.LayerVersionPermission;
import com.pulumi.aws.lambda.LayerVersionPermissionArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
// Share with multiple specific accounts
var devAccount = new LayerVersionPermission("devAccount", LayerVersionPermissionArgs.builder()
.layerName(example.layerName())
.versionNumber(example.version())
.principal("111111111111")
.action("lambda:GetLayerVersion")
.statementId("dev-account")
.build());
var stagingAccount = new LayerVersionPermission("stagingAccount", LayerVersionPermissionArgs.builder()
.layerName(example.layerName())
.versionNumber(example.version())
.principal("222222222222")
.action("lambda:GetLayerVersion")
.statementId("staging-account")
.build());
var prodAccount = new LayerVersionPermission("prodAccount", LayerVersionPermissionArgs.builder()
.layerName(example.layerName())
.versionNumber(example.version())
.principal("333333333333")
.action("lambda:GetLayerVersion")
.statementId("prod-account")
.build());
}
}
resources:
# Share with multiple specific accounts
devAccount:
type: aws:lambda:LayerVersionPermission
name: dev_account
properties:
layerName: ${example.layerName}
versionNumber: ${example.version}
principal: '111111111111'
action: lambda:GetLayerVersion
statementId: dev-account
stagingAccount:
type: aws:lambda:LayerVersionPermission
name: staging_account
properties:
layerName: ${example.layerName}
versionNumber: ${example.version}
principal: '222222222222'
action: lambda:GetLayerVersion
statementId: staging-account
prodAccount:
type: aws:lambda:LayerVersionPermission
name: prod_account
properties:
layerName: ${example.layerName}
versionNumber: ${example.version}
principal: '333333333333'
action: lambda:GetLayerVersion
statementId: prod-account
Import
For backwards compatibility, the following legacy pulumi import command is also supported:
$ pulumi import aws:lambda/layerVersionPermission:LayerVersionPermission example arn:aws:lambda:us-west-2:123456789012:layer:shared_utilities,1
Constructors
- LayerVersionPermission(String name, {LayerVersionPermissionArgs? args, CustomResourceOptions? options})
-
Creates a new LayerVersionPermission.
nameThe Pulumi resource name.argsArguments used to configure this LayerVersionPermission. The set of arguments for LayerVersionPermission.optionsResource options controlling this resource's behavior. - LayerVersionPermission.reference(String urn)
- Creates a typed reference to an existing LayerVersionPermission resource.
Properties
-
action
↔ Output<
String> -
Action that will be allowed.
lambda:GetLayerVersionis the standard value for layer access.latefinal -
childResources
→ Set<
Resource> -
finalinherited
-
completionSources
↔ Map<
String, IOutputCompletionSource> -
latefinalinherited
- hashCode → int
-
The hash code for this object.
no setterinherited
-
id
↔ Output<
String> -
getter/setter pairinherited
- isCustom → bool
-
Returns whether this resource is provider-managed.
no setterinherited
- isProtected → bool
-
Returns whether this resource is protected from deletion.
no setterinherited
- isRemote → bool
-
Whether this resource is registered as remote.
no setterinherited
- isResourceReference → bool
-
Whether this instance represents a resource value returned over RPC.
finalinherited
-
layerName
↔ Output<
String> -
Name or ARN of the Lambda Layer.
latefinal
-
organizationId
↔ Output<
String?> -
AWS Organization ID that should be able to use your Lambda Layer.
principalshould be set to*whenorganizationIdis provided.latefinal -
policy
↔ Output<
String> -
Full Lambda Layer Permission policy.
latefinal
-
principal
↔ Output<
String> -
AWS account ID that should be able to use your Lambda Layer. Use
*to share with all AWS accounts.latefinal -
region
↔ Output<
String> -
Region where this resource will be managed. Defaults to the Region set in the provider configuration.
latefinal
-
resourceTransforms
→ List<
ResourceTransform> -
Inherited/explicit async transforms.
no setterinherited
-
revisionId
↔ Output<
String> -
Unique identifier for the current revision of the policy.
latefinal
- runtimeType → Type
-
A representation of the runtime type of the object.
no setterinherited
-
skipDestroy
↔ Output<
bool?> -
Whether to retain the permission when the resource is destroyed. Default is
false.latefinal -
statementId
↔ Output<
String> -
Unique identifier for the permission statement.
latefinal
-
transformations
→ List<
ResourceTransformation> -
Inherited/explicit legacy transformations.
no setterinherited
-
urn
↔ Output<
String> -
latefinalinherited
-
versionNumber
↔ Output<
int> -
Version of Lambda Layer to grant access to. Note: permissions only apply to a single version of a layer.
latefinal
Methods
-
failId(
Object error) → void -
Completes this resource ID with an error when registration fails.
inherited
-
failOutputs(
Object error) → void -
Completes all output properties with
error.inherited -
failUrn(
Object error) → void -
Completes this resource URN with an error when registration fails.
inherited
-
getProvider(
String moduleMember) → ProviderResource? -
Returns provider for
moduleMember's package, if configured.inherited -
getResourceName(
) → String -
Returns this resource's logical name.
inherited
-
getResourceType(
) → String -
Returns this resource's Pulumi type token.
inherited
-
noSuchMethod(
Invocation invocation) → dynamic -
Invoked when a nonexistent method or property is accessed.
inherited
-
registerOutput<
T> (String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output< T> -
Registers a dynamic output property for this resource.
inherited
-
resolveId(
String? value, {required bool isKnown}) → void -
Resolves the provider-assigned ID for this resource.
inherited
-
resolveOutputs(
Struct outputs) → void -
Resolves all output properties from a monitor response payload.
inherited
-
resolveUrn(
String value) → void -
Resolves this resource's URN once assigned by the engine.
inherited
-
serializeProperties(
Map< String, dynamic> properties) → Future<Struct> -
Serializes resource properties for RPC transmission.
inherited
-
toString(
) → String -
A string representation of this object.
inherited
Operators
-
operator ==(
Object other) → bool -
The equality operator.
inherited
Static Methods
-
get(
String name, Input< String> id, {LayerVersionPermissionState? state, CustomResourceOptions? options}) → LayerVersionPermission -
Gets an existing LayerVersionPermission resource's state with the given
nameandid.