🚨 AWS Error: 'ResourceConflictException ... An update is in progress' (Lambda) — Cause, Fix, and Troubleshooting Guide

Overview

Lambda function updates are not instantaneous. After UpdateFunctionCode or UpdateFunctionConfiguration, the function enters an in-progress state (LastUpdateStatus: InProgress) while the change propagates. A second update issued before the first finishes is rejected with ResourceConflictException. This most often bites CI/CD pipelines that push code and configuration back-to-back, or two jobs deploying the same function at once.

You will see it from the CLI, an SDK, or Terraform:

An error occurred (ResourceConflictException) when calling the UpdateFunctionCode operation: The operation cannot be performed at this time. An update is in progress for resource: arn:aws:lambda:us-east-1:111122223333:function:app-handler

It occurs whenever two mutating calls overlap on the same function, or when you update before the previous change reaches Successful.

Symptoms

• UpdateFunctionCode, UpdateFunctionConfiguration, PublishVersion, or UpdateAlias fails with ResourceConflictException ... An update is in progress.
• A pipeline that sets env vars then pushes code (or vice versa) fails on the second step.
• Terraform apply fails intermittently on aws_lambda_function under parallelism.
• The function’s State is Pending (cold create) or LastUpdateStatus is InProgress.

aws lambda update-function-configuration --function-name app-handler --timeout 30
aws lambda update-function-code --function-name app-handler --zip-file fileb://app.zip

An error occurred (ResourceConflictException) when calling the UpdateFunctionCode operation: The operation cannot be performed at this time. An update is in progress for resource: ...

Common Root Causes

1. Back-to-back config and code updates

The second call fires before the first update reaches Successful.

2. Two concurrent deploys of the same function

Parallel CI jobs or a re-triggered pipeline both mutate the function.

3. Terraform parallelism

Multiple property changes map to overlapping API calls under default parallelism.

4. Updating during a cold create

The function is still State: Pending from creation when an update arrives.

5. Provisioned concurrency / layer changes still settling

A prior provisioned-concurrency or layer update is still propagating.

How to diagnose

Step 1: Read the function’s state and update status

aws lambda get-function-configuration --function-name app-handler \
  --query '[State,StateReason,LastUpdateStatus,LastUpdateStatusReason]' --output table

LastUpdateStatus: InProgress or State: Pending confirms the function is mid-change.

Step 2: Look for overlapping callers in CloudTrail

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=app-handler \
  --query 'Events[].[EventName,Username]' --output table

Two principals mutating within seconds confirms a concurrent-deploy race.

Fixes

Wait for the previous update between calls

Use the built-in waiters so each mutation completes before the next:

aws lambda update-function-configuration --function-name app-handler --timeout 30
aws lambda wait function-updated --function-name app-handler
aws lambda update-function-code --function-name app-handler --zip-file fileb://app.zip
aws lambda wait function-updated --function-name app-handler

Serialize deploys

Ensure only one pipeline touches a given function at a time (concurrency group / deploy lock); don’t run overlapping deploy jobs.

Reduce Terraform contention and retry

Lower parallelism for the affected resource or rely on the AWS provider’s built-in retry on ResourceConflictException; a bounded exponential backoff (a few retries) absorbs the propagation window.

Wait out a cold create

aws lambda wait function-active --function-name app-handler

What to watch out for

• Always insert aws lambda wait function-updated (or function-active after create) between mutations in scripts — the update window is short but real.
• ResourceConflictException is transient and retryable; a few backoff retries usually succeed without any config change.
• Provisioned concurrency and alias updates count as in-progress changes too — sequence them with the code/config updates.
• Guard pipelines with a concurrency lock so a re-run doesn’t collide with an in-flight deploy.

Related

• AWS Error: Lambda ‘TooManyRequestsException: Rate Exceeded’ — throttling at invoke time rather than update time.
• AWS Error: Lambda ‘Task timed out’ — a runtime failure on the same functions.
• AWS Error: ‘ResourceNotReady’ waiter timeout — the general pattern of waiting on async AWS state transitions.