AWS systems-manager documentation change

Service: systems-manager · 2026-03-13 · Documentation low

File: systems-manager/latest/userguide/ps-integration-lambda-extensions.md

Summary

Added documentation about programmatically retrieving latest Lambda extension ARN versions via SSM parameters and CloudFormation, along with updated architecture section headings

Security assessment

The changes focus on ensuring users reference the latest extension versions automatically. While this improves maintainability, there is no direct mention of vulnerabilities, security patches, or security-specific context. The update appears to be routine documentation improvement for version management.

Diff

diff --git a/systems-manager/latest/userguide/ps-integration-lambda-extensions.md b/systems-manager/latest/userguide/ps-integration-lambda-extensions.md
index 208a55305..c2c59b094 100644
--- a//systems-manager/latest/userguide/ps-integration-lambda-extensions.md
+++ b//systems-manager/latest/userguide/ps-integration-lambda-extensions.md
@@ -236,0 +237,61 @@ You can specify that parameters aren't decrypted by omitting `withDecryption` or
+The latest Amazon Resource Name (ARN) for the Lambda extension is published as a public parameter in Systems Manager Parameter Store for each supported architecture. You can retrieve the latest ARN programmatically using the AWS CLI or CloudFormation to ensure that your application always references the most recent extension version without manual updates. This section explains how to retrieve the ARN programmatically and provides tables listing the current ARN values for each architecture for manual reference.
+
+### Retrieving the latest Lambda extension ARN version
+
+The latest Lambda extension ARN versions are stored as public parameters in the following locations. You can reference these public parameters in your code to retrieve them:
+
+  * **x86_64** : /aws/service/aws-parameters-and-secrets-lambda-extension/x86/latest
+
+  * **arm64** : /aws/service/aws-parameters-and-secrets-lambda-extension/arm64/latest
+
+
+
+
+###### AWS CLI
+
+To retrieve the latest ARN versions using the AWS CLI, run the following commands.
+
+**x86_64**
+    
+    
+    aws ssm get-parameter --name "/aws/service/aws-parameters-and-secrets-lambda-extension/x86/latest" --query "Parameter.Value" --output text
+
+**arm64**
+    
+    
+    aws ssm get-parameter --name "/aws/service/aws-parameters-and-secrets-lambda-extension/arm64/latest" --query "Parameter.Value" --output text
+
+###### AWS CloudFormation
+
+When deploying Lambda functions using CloudFormation, you can resolve parameters directly during stack creation and updates, as shown in the following example YAML templates. This method ensures your function always uses the latest extension version without requiring manual updates.
+
+**x86_64**
+    
+    
+    Resources:
+      MyFunction:
+        Type: AWS::Lambda::Function
+        Properties:
+          FunctionName: my-function
+          Runtime: python3.11
+          Handler: index.handler
+          Code:
+            ZipFile: |
+              def handler(event, context):
+                  return {'statusCode': 200}
+          Layers:
+            - !Sub '{{resolve:ssm:/aws/service/aws-parameters-and-secrets-lambda-extension/x86/latest}}'
+          Role: !GetAtt MyFunctionRole.Arn
+
+**arm64**
+    
+    
+    Layers:
+      - !Sub '{{resolve:ssm:/aws/service/aws-parameters-and-secrets-lambda-extension/arm64/latest}}'
+
+###### Note
+
+The `{{resolve:ssm:parameter-name}}` syntax automatically retrieves the parameter value during stack operations. This ensures you always deploy with the current ARN.
+
+### Latest extension ARNs
+
@@ -248 +309 @@ The following tables provide extension ARNs for supported architectures and Regi
-### Extension ARNs for the x86_64 and x86 architectures
+#### Extension ARNs for the x86_64 and x86 architectures
@@ -294 +355 @@ AWS GovCloud (US-West)| `arn:aws-us-gov:lambda:us-gov-west-1:127562683043:layer:
-### Extension ARNs for ARM64 and Mac with Apple silicon architectures
+#### Extension ARNs for ARM64 and Mac with Apple silicon architectures