403 — Lambda Environment Variables and Function Updates

Intermediate

Update Lambda environment variables without redeploying code, deploy code changes with update-function-code, and publish an immutable function version — all from the CLI.

Learning Objectives

Declare Lambda environment variables at function creation using the --environment flag

Read environment variables from within a Python Lambda handler using os.environ.get

Inspect a function's environment variables using get-function-configuration

Update environment variables without redeploying code using update-function-configuration

Deploy a code change to a running function using update-function-code and the function-updated waiter

Publish an immutable function version using publish-version and distinguish it from $LATEST

List all published versions of a function with list-versions-by-function

Step 1

Set up or reuse the IAM execution role

Lesson 403 uses the same devops-lambda-role execution role from Lessons 401 and 402. If you completed either lesson without cleaning up the role, skip the creation commands below and retrieve the ARN directly using the tip. If the role was deleted, run all commands to create it from scratch.

Commands to Run

cat > lambda-trust.json << 'POLICY'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "lambda.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY

ROLE_ARN=$(aws iam create-role \
  --role-name devops-lambda-role \
  --assume-role-policy-document file://lambda-trust.json \
  --query Role.Arn \
  --output text)

aws iam attach-role-policy \
  --role-name devops-lambda-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

echo "Role ARN: $ROLE_ARN"

What This Does

The trust policy declares lambda.amazonaws.com as the trusted service, allowing Lambda to call sts:AssumeRole and obtain temporary credentials for running your function.

AWSLambdaBasicExecutionRole is the minimum managed policy required by all Lambda functions — it grants the CloudWatch Logs permissions to create log groups, create log streams, and write log events.

ROLE_ARN is captured from the create-role output and used in step 3.

Expected Outcome

echo prints the role ARN:

Role ARN: arn:aws:iam::123456789012:role/devops-lambda-role

If you see EntityAlreadyExists: Role with name devops-lambda-role already exists, the role is still present from a previous lesson.

Retrieve the ARN and continue: ROLE_ARN=$(aws iam get-role --role-name devops-lambda-role --query Role.Arn --output text) && echo $ROLE_ARN

Pro Tips

1
Billing callout: IAM role creation and policy attachment are always free. Lambda has an always-free allowance of 1 million requests/month that never expires — all exercises in this lesson stay well within that limit.
2
If devops-lambda-role still exists from Lesson 401 or 402, skip the creation commands and retrieve the ARN directly: ROLE_ARN=$(aws iam get-role --role-name devops-lambda-role --query Role.Arn --output text)
3
ROLE_ARN must be set in the current terminal session — it is used in step 3 when creating the function. If you close and reopen a terminal, re-run the get-role command above before proceeding.

Was this step helpful?