Bug: cn-north-1 lambda layer is not publicly available

[dsheehan]

Expected Behaviour

Lambda layer for power tools is publicly available in cn-north-1 region.

This was advertised as a big feature of the v3.16.0 release:
https://github.com/aws-powertools/powertools-lambda-python/releases/tag/v3.16.0

We are thrilled to announce that Powertools for AWS Lambda (Python) now offers AWS Lambda layers in the AWS China region cn-north-1.

And described here in the getting started: https://docs.aws.amazon.com/powertools/python/latest/getting-started/install/#aws-china-regions

arn:aws-cn:lambda:cn-north-1:498634801083:layer:AWSLambdaPowertoolsPythonV3-{python_version}-x86_64:27

aws --region cn-north-1 lambda get-layer-version-by-arn --arn "arn:aws-cn:lambda:cn-north-1:498634801083:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:27"

An error occurred (AccessDeniedException) when calling the GetLayerVersionByArn operation: User: REDACTED is not authorized to perform: lambda:GetLayerVersion on resource: arn:aws-cn:lambda:cn-north-1:498634801083:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:27 because no resource-based policy allows the lambda:GetLayerVersion action

By comparison, OTel in cn-north-1 works fine:
aws --region cn-north-1 lambda get-layer-version-by-arn --arn "arn:aws-cn:lambda:cn-north-1:440179912924:layer:AWSOpenTelemetryDistroPython:7"

Current Behaviour

Lambda layer for power tools is not publicly available in cn-north-1 region.

Code snippet

aws --region cn-north-1 lambda get-layer-version-by-arn --arn "arn:aws-cn:lambda:cn-north-1:498634801083:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:27"

Possible Solution

Ensure the layer ARN is published publicly.

Steps to Reproduce

aws --region cn-north-1 lambda get-layer-version-by-arn --arn "arn:aws-cn:lambda:cn-north-1:498634801083:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:27"

Powertools for AWS Lambda (Python) version

27

AWS Lambda function runtime

3.12

Packaging format used

Lambda Layers

Debugging logs

[boring-cyborg]

Thanks for opening your first issue here! We'll come back to you as soon as we can.
In the meantime, check out the #python channel on our Powertools for AWS Lambda Discord: Invite link

[dsheehan]

I also tried to see if the ARN was listed via ssm:
aws --region cn-north-1 ssm get-parameter --name /aws/service/powertools/python/x86_64/python3.12/latest
Also access denied

For comparison (with global credentials), this works:
aws --region us-west-2 ssm get-parameter --name /aws/service/powertools/python/x86_64/python3.12/latest

[dsheehan]

Feature originally introduced in: #6900 in response to: #5269

[leandrodamascena]

Hi @dsheehan, thank you for raising this issue! We don't publish parameters for the China/US gov partitions, so the aws ssm command shouldn't work on those partitions.

Regarding the layer, I've identified that we're not synchronizing the latest versions in China and the US partitions. I'll work to fix this, but there's no ETA yet.

Could you test with layer versions 22 and 23?

I'll keep this issue opened until I fix this.

[dsheehan]

With some digging, it looks it might need to be manually triggered here?
https://github.com/aws-powertools/powertools-lambda-python/actions/workflows/layers_partitions.yml

With the latest release 3 month ago (Oct 2025): https://github.com/aws-powertools/powertools-lambda-python/actions/runs/18696289660

This appears to work:
aws --region cn-north-1 lambda get-layer-version-by-arn --arn "arn:aws-cn:lambda:cn-north-1:498634801083:layer:AWSLambdaPowertoolsPythonV3-python312-x86_64:25"

As a stop-gap can we update the documentation to cite version 25?
https://docs.aws.amazon.com/powertools/python/latest/getting-started/install/#aws-china-regions