Maintenance: balance new runtime layers across AWS partitions

[dreamorosi]

Why is this needed?

Lambda assigns layer version numbers sequentially and does not allow publishers to choose a version number. When support for a new Python runtime starts after existing layers have already advanced, the new runtime needs its earlier commercial placeholder versions copied in order before regular partition deployments can keep every runtime aligned.

This currently affects Python 3.14 in AWS China. China production has Python 3.9 through 3.13 aligned at version 25, while Python 3.14 has no production layer history. Publishing commercial version 26 directly would create Python 3.14 version 1 and prevent the regular partition workflow from preserving common version numbers.

The existing commercial Region Bootstrap workflow uses the layer-balancer tool, but it cannot be used unchanged across isolated AWS partitions. Commercial credentials cannot assume roles in AWS China or GovCloud. The partition workflows solve that boundary with separate GitHub OIDC sessions, but only copy one requested version at a time and do not safely resume a historical backfill.

A partition-aware balancer is needed to copy a contiguous source history in order, verify that existing versions match, resume partial runs, and preserve public permissions without changing the regular release deployment flow.

Which area does this relate to?

Automation

Solution

Add a generic Layer Balancer (Partitions) workflow that:

• supports AWS China and GovCloud through their existing GitHub environments and OIDC audiences;
• downloads commercial source artifacts using the read-only production role;
• balances one Python runtime over an explicit version range;
• publishes each architecture and region sequentially while asserting source and target version parity;
• skips existing versions only when their SHA matches;
• repairs missing public permissions and safely resumes partial runs;
• validates the target account and partition before mutation;
• defaults to dry-run and serializes against other partition layer publishers.

For the current China production recovery, balance Python 3.14 versions 1 through 25 first. The regular Layer Deployment (Partitions) workflow can then publish version 26 across every runtime and continue normally from version 27 onward.

Acknowledgment

• This request meets Powertools for AWS Lambda (Python) Tenets
• This should be considered in other Powertools for AWS Lambda languages

---

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.