Maintenance: mirror source layer permissions across AWS partitions

[dreamorosi]

Why is this needed?

Partition layer workflows currently add a public lambda:GetLayerVersion permission to every copied layer version. That is correct for released commercial layers, but not for private alignment placeholders used to advance a new runtime to the shared layer version number.

Python 3.14 commercial versions 1 through 26 are private placeholders. Publishing those versions publicly in AWS China or GovCloud exposes artifacts that are not usable Powertools releases and makes partition behavior differ from the commercial source.

The new partition layer balancer inherited this unconditional permission behavior from the regular partition deployment workflow and the existing commercial layer-balancer. China Gamma testing exposed the mismatch before any Python 3.14 placeholders were published to China production.

Which area does this relate to?

Automation

Solution

Capture the commercial source version policy during the read-only download stage and carry it with the layer artifact. Partition publishing should add a public permission only when the commercial source version has an unconditional public lambda:GetLayerVersion statement.

Apply the same behavior to both Layer Balancer (Partitions) and Layer Deployment (Partitions) so placeholders remain private while released versions remain public. Verify the resulting target policy after publication.

Acknowledgment

• This request meets Powertools for AWS Lambda (Python) Tenets
• This should be considered in other Powertools for AWS Lambda languages

---

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.