How to Deploy a Container Image Lambda With GitHub Actions

Build the image from the AWS base image, push to ECR, then point the function at the new image URI.

Lambda container functions run an image from ECR. Build with the public.ecr.aws/lambda base, log in to ECR, push the tagged image, then run aws lambda update-function-code --image-uri.

Steps

• Base your Dockerfile on public.ecr.aws/lambda/<runtime>.
• Authenticate with OIDC and log in to ECR via aws-actions/amazon-ecr-login.
• Build and push the image to your ECR repository.
• Run aws lambda update-function-code --image-uri <repo>:<tag>.

Workflow

permissions:
  id-token: write
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-lambda-deploy
          aws-region: us-east-1
      - id: ecr
        uses: aws-actions/amazon-ecr-login@v2
      - env:
          REPO: ${{ steps.ecr.outputs.registry }}/my-fn
        run: |
          docker build -t "$REPO:${{ github.sha }}" .
          docker push "$REPO:${{ github.sha }}"
          aws lambda update-function-code \
            --function-name my-fn \
            --image-uri "$REPO:${{ github.sha }}"

Gotchas

• The image architecture must match the function (x86_64 vs arm64).
• Use an immutable tag like the commit SHA so a redeploy actually changes the image digest.

Related guides