Stop hardcoding AWS Lambda layer ARNs: use public parameters for the AWS Parameters and Secrets Lambda Extension
To add the AWS Parameters and Secrets Lambda Extension to an AWS Lambda function, you can open the documentation, find the ARN table, locate your AWS Region and architecture, copy the ARN, and paste it into your template. This approach works, but the version number at the end of that ARN changes every time AWS releases an update. If you hardcode that number, your deployment stays pinned to an…
The AWS Parameters and Secrets Lambda Extension is a layer that retrieves values from AWS Systems Manager Parameter Store and AWS Secrets Manager, running alongside your Lambda function as a companion process. It simplifies code by allowing local HTTP calls instead of configuring SDK clients and caching logic. The extension is distributed as a Lambda layer, requiring its ARN for attachment.
The ARN version changes with each release, necessitating manual updates to benefit from new features and bug fixes. Hardcoding this version number can lead to deployment on outdated versions unnoticed for months. Instead, AWS provides public parameters in the Parameter Store for each commercial AWS Region: x86_64 /aws/service/aws-parameters-and-secrets-lambda-extension/x86/latest and ARM64 /aws/service/aws-parameters-and-secrets-lambda-extension/arm64/latest.
These parameters are readable by any AWS account with the ssm:GetParameter permission. To use the extension without hardcoding ARNs, replace the ARN in infrastructure code with the dynamic parameter resolution syntax: !resolve:ssm:/aws/service/aws-parameters-and-secrets-lambda-extension/x86/latest (or arm64 for ARM64 functions).
This ensures the extension always uses the latest version, as the ARN is resolved at deploy time, reducing maintenance overhead and ensuring access to the most recent features and improvements.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
