aws lambda publish-version: Snapshot a Lambda Version
aws lambda publish-version captures the current function code and configuration as a numbered, immutable version that aliases and traffic-shifting can point at.
Publishing a version freezes a known-good build so an alias can shift traffic to it gradually. In CI you publish after updating code, then move an alias.
What it does
aws lambda publish-version creates a new immutable version from the function $LATEST state and returns its Version number. Versions are read-only; you wire an alias (for example "live") to a version so callers hit a stable target.
Common usage
VER=$(aws lambda publish-version \
--function-name my-fn \
--description "build $GITHUB_SHA" \
--query Version --output text)
aws lambda update-alias \
--function-name my-fn --name live --function-version "$VER"Options
| Flag | What it does |
|---|---|
| --function-name <name> | Function to publish (required) |
| --description <text> | Label the version, e.g. the commit SHA |
| --revision-id <id> | Only publish if $LATEST still matches this revision |
| --code-sha256 <hash> | Only publish if code hash matches (guards races) |
| --query Version --output text | Capture the new version number |
In CI
Pass --revision-id (from the prior update-function-code response) so publish-version fails fast if another deploy raced you, instead of silently versioning the wrong code. Tag the --description with $GITHUB_SHA so each version is traceable to a commit. Pair with an alias rather than invoking versions directly.
Common errors in CI
"An error occurred (ResourceConflictException) when calling the PublishVersion operation: The Revision Id provided does not match the latest Revision Id" means another change landed since you read the revision; re-fetch and retry. "ResourceNotFoundException" means a wrong function name/region. "AccessDeniedException" means missing lambda:PublishVersion. Publishing with no changes since the last version returns the same version number rather than a new one.