How can I use the AWS CLI to migrate a Lambda function to another AWS account or Region?

Short description

To migrate a Lambda function to a second AWS account or Region, use the AWS Command Line Interface (AWS CLI):

1. Run the GetFunction command to download the Lambda function deployment package.
2. Configure the AWS CLI for the second AWS account or Region that you want to move the function to.
   Note: You can also configure a new AWS CLI profile for your second AWS account or Region.
3. Run the CreateFunction command to create a new function in the second AWS account or Region.

Note: You can also migrate a Lambda function using the Lambda console or an AWS Serverless Application Model (AWS SAM).

The following resolution allows you to migrate only one function at a time across accounts or Regions. You can't directly and natively migrate Lambda functions in bulk.

Resolution

Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.

Run the GetFunction command to download the Lambda function deployment package

1. Run the following GetFunction command:

   aws lambda get-function --function-name my-function

   Important: Replace my-function with the name of the function that you want to migrate.

2. In the command response, open the URL link after "Location". The link appears in a code block similar to the following example:

   "Code": {        "RepositoryType": "S3",
           "Location": "https://awslambda-us-west-2-tasks.s3.us-west-2.amazonaws.com/snapshots/123456789012/my-function..."
       },

   Note: The link after "Location": downloads the deployment package.

Configure the AWS CLI for the second AWS account or Region that you want to move the function to

1. Run the following Configure command:

   aws configure --profile profilename

   Important: Change profilename to a recognizable name for your second AWS account or Region.
2. Enter the following input values to pass the AWS Identity and Access Management (IAM) user credentials of the second AWS account and the Region:
   AWS Access Key ID [None]: Enter the access key of an IAM user in the second AWS account. Or, if you're migrating the function to another Region, then enter the access key of an IAM user in your first AWS account.
   AWS Secret Access Key [None]: Enter the secret access key of the same IAM user.
   Default region name [None]: Enter the AWS Region that you're migrating your function to.

For more information, see Configure the AWS CLI.

Run the CreateFunction command to create a new function in the second AWS account or Region.

Note: You need the Lambda function deployment package and execution role to run the CreateFunction command.

1. Run the following CreateFunction command with the AWS CLI profile that you configured:

   aws lambda create-function \    --function-name my-function \
       --runtime nodejs18.x \    
       --zip-file fileb://my-function.zip \   
       --handler my-function.handler \
       --role arn:aws:iam::123456789012:role/service-role/MyTestFunction-role-tges6bf4 \
       --profile profilename

   Note: In this command, replace the following values with the information from the function that you want to migrate:
   For function-name, enter the name of your function.
   For runtime, enter the runtime of your function.
   For zip-file, enter the file path of your function's deployment package.
   For handler, enter the handler name of your function.
   For role, enter the Lambda execution role ARN that's in the AWS account that you want to migrate your function to.
   For profile, enter the AWS CLI profile name you created when you ran the Configure command.
   If you want to migrate a function to another Region but keep it in the same account, then you can keep the execution role.
2. To confirm that the migration worked, run the following list-functions command:

   aws lambda list-functions \    --profile profilename

   Note: Replace profilename with the AWS CLI profile name that you created when you ran the Configure command.