fix(local invoke): ensure later Lambda layers overwrite earlier layers in Docker image (#8688)

* fix: ensure later Lambda layers overwrite earlier layers in Docker image

Docker's ADD/COPY with directories may merge rather than overwrite files
in BuildKit, breaking AWS Lambda's layer precedence where later layers
should override earlier ones.

Fix by staging each layer in a temp directory and using 'cp -rf' to
explicitly overwrite files in /opt, matching real Lambda behavior.

Also add cleanup_samcli_images() call to tearDownClass for proper
cleanup between parameterized test classes.

* fix: ensure later Lambda layers overwrite earlier layers in Docker image

Docker's ADD with directories may not overwrite existing files in all
build backends (e.g. BuildKit). This breaks AWS Lambda's layer
precedence where later layers should override earlier ones.

Fix: the first layer still uses ADD directly to /opt. Subsequent layers
are staged in a temp directory and copied with 'cp -rf' to guarantee
overwrite semantics.

Also adds test_two_independent_layers integration test that verifies
two layers providing different modules both work in a single function,
and adds cleanup_samcli_images() to tearDownClass.

* fix: pass LayerAArn/LayerBArn through nested template parents

The nested template parents were not forwarding the new layer
parameters, causing SAM CLI to use the default fake ARNs and
fail with lambda:GetLayerVersion permission errors.

Author: roger-zhangg

samcli/local/docker/lambda_image.py

@@ -498,7 +498,8 @@ def _generate_dockerfile(base_image, layers, architecture):
         ADD aws-lambda-rie /var/rapid
 
         ADD layer1 /opt
-        ADD layer2 /opt
+        ADD layer2 /tmp/layer1
+        RUN cp -rf /tmp/layer1/. /opt/ && rm -rf /tmp/layer1
 
         Parameters
         ----------
@@ -521,8 +522,16 @@ def _generate_dockerfile(base_image, layers, architecture):
             + f"ADD {rie_name} {rie_path}\n"
             + f"RUN mv {rie_path}{rie_name} {rie_path}aws-lambda-rie && chmod +x {rie_path}aws-lambda-rie\n"
         )
-        for layer in layers:
-            dockerfile_content = dockerfile_content + f"ADD {layer.name} {LambdaImage._LAYERS_DIR}\n"
+        for idx, layer in enumerate(layers):
+            if idx == 0:
+                # First layer can be added directly — no existing files to conflict with
+                dockerfile_content += f"ADD {layer.name} {LambdaImage._LAYERS_DIR}\n"
+            else:
+                # Subsequent layers: stage in temp dir, then cp -rf to ensure overwrite.
+                # Docker ADD/COPY may merge directories without overwriting in BuildKit.
+                stage_dir = f"/tmp/layer{idx}"
+                dockerfile_content += f"ADD {layer.name} {stage_dir}\n"
+                dockerfile_content += f"RUN cp -rf {stage_dir}/. {LambdaImage._LAYERS_DIR}/ && rm -rf {stage_dir}\n"
         return dockerfile_content
 
     def _remove_rapid_images(self, repo: str) -> None:

tests/integration/local/invoke/test_integrations_cli.py

@@ -834,11 +834,14 @@ def tearDown(self):
     def setUpClass(cls):
         cls.layer_utils.upsert_layer(LayerUtils.generate_layer_name(), "LayerOneArn", "layer1.zip")
         cls.layer_utils.upsert_layer(LayerUtils.generate_layer_name(), "LayerTwoArn", "layer2.zip")
+        cls.layer_utils.upsert_layer(LayerUtils.generate_layer_name(), "LayerAArn", "layer_a.zip")
+        cls.layer_utils.upsert_layer(LayerUtils.generate_layer_name(), "LayerBArn", "layer_b.zip")
         super(TestLayerVersionBase, cls).setUpClass()
 
     @classmethod
     def tearDownClass(cls):
         cls.layer_utils.delete_layers()
+        cleanup_samcli_images()
         integ_layer_cache_dir = Path().home().joinpath("integ_layer_cache")
         if integ_layer_cache_dir.exists():
             shutil.rmtree(str(integ_layer_cache_dir))
@@ -1008,6 +1011,31 @@ def test_download_two_layers(self, function_logical_id):
 
         self.assertEqual(process_stdout, expected_output)
 
+    def test_two_independent_layers(self):
+        """Test that two layers providing different modules both work in a single function."""
+        command_list = InvokeIntegBase.get_command_list(
+            "TwoIndependentLayersFunction",
+            template_path=self.template_path,
+            no_event=True,
+            region=self.region,
+            layer_cache=str(self.layer_cache),
+            parameter_overrides=self.layer_utils.parameters_overrides,
+        )
+
+        process = Popen(command_list, stdout=PIPE)
+        try:
+            stdout, _ = process.communicate(timeout=TIMEOUT)
+        except TimeoutExpired:
+            process.kill()
+            raise
+
+        process_stdout = stdout.decode("utf-8").strip().split(os.linesep)[-1]
+        import json
+
+        result = json.loads(process_stdout)
+        self.assertEqual(result["a"], "hello from layer A")
+        self.assertEqual(result["b"], "goodbye from layer B")
+
     def test_caching_two_layers(self):
         command_list = InvokeIntegBase.get_command_list(
             "TwoLayerVersionServerlessFunction",

tests/integration/testdata/invoke/layer_zips/layer_a.zip

@@ -19,3 +19,10 @@ def one_layer_hanlder(event, context):
     from simple_python_module.simple_python import which_layer
 
     return which_layer()
+
+
+def two_independent_layers_handler(event, context):
+    from module_a.util import greeting
+    from module_b.util import farewell
+
+    return {"a": greeting(), "b": farewell()}

tests/integration/testdata/invoke/layer_zips/layer_b.zip

@@ -19,6 +19,14 @@ Parameters:
     Default: arn:aws:lambda:us-west-2:111111111111:layer:non_existent_layer:1
     Type: String
 
+  LayerAArn:
+    Default: arn:aws:lambda:us-west-2:111111111111:layer:layer_a:1
+    Type: String
+
+  LayerBArn:
+    Default: arn:aws:lambda:us-west-2:111111111111:layer:layer_b:1
+    Type: String
+
 Resources:
   # AWS::Serverless::Function
   OneLayerVersionServerlessFunction:
@@ -145,6 +153,17 @@ Resources:
       Layers:
         - arn:aws:lambda:us-west-2:111111111101:layer:layerDoesNotExist:1
 
+  TwoIndependentLayersFunction:
+    Type: AWS::Serverless::Function
+    Properties:
+      Handler: layer-main.two_independent_layers_handler
+      Runtime: python3.9
+      CodeUri: .
+      Timeout: 20
+      Layers:
+        - Ref: LayerAArn
+        - Ref: LayerBArn
+
   # AWS::Lambda::LayerVersion
   MyCustomLambdaLayer:
     Type: AWS::Lambda::LayerVersion

tests/integration/testdata/invoke/layers/layer-main.py

@@ -19,6 +19,14 @@ Parameters:
     Default: arn:aws:lambda:us-west-2:111111111111:layer:non_existent_layer:1
     Type: String
 
+  LayerAArn:
+    Default: arn:aws:lambda:us-west-2:111111111111:layer:layer_a:1
+    Type: String
+
+  LayerBArn:
+    Default: arn:aws:lambda:us-west-2:111111111111:layer:layer_b:1
+    Type: String
+
 Resources:
   SubApp:
     Type: AWS::Serverless::Application
@@ -28,4 +36,6 @@ Resources:
         LayerOneArn: !Ref LayerOneArn
         LayerTwoArn: !Ref LayerTwoArn
         ChangedLayerArn: !Ref ChangedLayerArn
-        NonExistentLayerArn: !Ref NonExistentLayerArn
+        NonExistentLayerArn: !Ref NonExistentLayerArn
+        LayerAArn: !Ref LayerAArn
+        LayerBArn: !Ref LayerBArn

tests/integration/testdata/invoke/layers/layer-template.yml

@@ -19,6 +19,14 @@ Parameters:
     Default: arn:aws:lambda:us-west-2:111111111111:layer:non_existent_layer:1
     Type: String
 
+  LayerAArn:
+    Default: arn:aws:lambda:us-west-2:111111111111:layer:layer_a:1
+    Type: String
+
+  LayerBArn:
+    Default: arn:aws:lambda:us-west-2:111111111111:layer:layer_b:1
+    Type: String
+
 Resources:
   SubApp:
     Type: AWS::Serverless::Application
@@ -28,4 +36,6 @@ Resources:
         LayerOneArn: !Ref LayerOneArn
         LayerTwoArn: !Ref LayerTwoArn
         ChangedLayerArn: !Ref ChangedLayerArn
-        NonExistentLayerArn: !Ref NonExistentLayerArn
+        NonExistentLayerArn: !Ref NonExistentLayerArn
+        LayerAArn: !Ref LayerAArn
+        LayerBArn: !Ref LayerBArn