Tech debt: make partition layer deployment safe to resume

[dreamorosi]

Why is this needed?

.github/workflows/layers_partitions.yml performs twelve concurrent, irreversible Lambda layer publications without verifying each target layer is at the expected preceding version. It checks the returned version only after publishing, when an incorrect version number can no longer be reused.

The copy matrix also uses the default fail-fast behavior. A failure can cancel sibling jobs after publication but before permission or verification, leaving runtimes and architectures at different versions. The workflow is not idempotent: rerunning a partially successful deployment republishes completed layers at the next version, while rerunning all jobs can conflict with immutable workflow artifacts.

Additional gaps make recovery and operation harder:

• version is not validated and is interpolated directly into shell commands;
• AWS retry behavior is not configured for long cross-partition uploads;
• publication and public-permission creation are coupled in one non-atomic step;
• the reusable trigger omits the required partition input;
• source downloads do not fail or retry cleanly on HTTP errors;
• failed verification does not preserve target metadata artifacts.

These risks can permanently break layer version parity in China or GovCloud. Until addressed, maintainers must use Layer Balancer (Partitions) separately for each runtime because it provides target-position preflight, resumability, SHA checks, visibility mirroring, retries, and non-fail-fast execution.

Which area does this relate to?

Automation

Suggestion

Bring the regular partition deployment workflow up to the balancer safety model:

• validate and normalize all dispatch/call inputs;
• require the target latest version to equal version - 1 before publishing;
• disable matrix fail-fast and consider serial target publication;
• skip existing versions only when their SHA and visibility match the commercial source;
• make artifact uploads and permission creation idempotent;
• configure standard AWS retries;
• preserve partial-run metadata for recovery;
• complete or remove the broken workflow_call interface.

Acknowledgment

• This request meets Powertools for AWS Lambda (Python) Tenets
• This should be considered in other Powertools for AWS Lambda languages

---

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.