How to Deploy a Zip Lambda Function With GitHub Actions

Build a deployment zip, authenticate to AWS with OIDC, then call aws lambda update-function-code to ship the new code.

Authenticate with aws-actions/configure-aws-credentials over OIDC, zip your handler and dependencies, and push the bundle with aws lambda update-function-code. The function must already exist; this updates its code.

Steps

• Add an IAM role with a GitHub OIDC trust policy and lambda:UpdateFunctionCode.
• Grant permissions: id-token: write so the job can request the OIDC token.
• Build a zip of your handler plus runtime dependencies.
• Run aws lambda update-function-code --function-name <name> --zip-file fileb://function.zip.

Workflow

name: deploy
on:
  push:
    branches: [main]
permissions:
  id-token: write
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci --omit=dev
      - run: zip -r function.zip index.js node_modules
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-lambda-deploy
          aws-region: us-east-1
      - run: |
          aws lambda update-function-code \
            --function-name my-api \
            --zip-file fileb://function.zip \
            --publish

Gotchas

• Zip uploads over 50 MB must go through S3 with --s3-bucket/--s3-key instead of --zip-file.
• Add aws lambda wait function-updated before invoking, since the update is asynchronous.

Related guides