Bug: AWS::Serverless::Function specified within Fn::ForEach does not have ImageUri set correctly

[tanderson-symplr]

Description:

template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform:
  - AWS::LanguageExtensions
  - AWS::Serverless-2016-10-31
Description: Lambda Function with Fn::ForEach using FuncType parameter

Parameters:
  FuncType:
    Type: CommaDelimitedList
    Default: "func1"
    Description: List of function types to create

Resources:
  # Another standalone function (not using ForEach)
  StandaloneFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: StandaloneFunction
      PackageType: Image
      MemorySize: 128
      ImageConfig:
        Command:
          - app.lambda_handler
      Environment:
        Variables:
          FUNCTION_TYPE: standalone
    Metadata:
      Dockerfile: Dockerfile
      DockerContext: ./hello_world
      DockerTag: standalone-latest

  # Use Fn::ForEach to create multiple Lambda functions based on FuncType parameter
  Fn::ForEach::LoopFunction:
    - FunctionName
    - !Ref FuncType
    - '${FunctionName}Function':
        Type: AWS::Serverless::Function
        Properties:
          FunctionName: !Sub '${FunctionName}Function'
          PackageType: Image
          MemorySize: 128
          ImageUri: "foo"
          ImageConfig:
            Command:
              - app.lambda_handler
          Environment:
            Variables:
              FUNCTION_TYPE: !Sub '${FunctionName}'
        Metadata:
          Dockerfile: Dockerfile
          DockerContext: ./hello_world
          DockerTag: !Sub '${FunctionName}-latest'

samconfig.toml

# More information about the configuration file can be found here:
# https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/serverless-sam-cli-config.html
version = 0.1

[default.global.parameters]
stack_name = "fn-foreach-bug"
language_extensions = true

[default.build.parameters]
cached = true
parallel = true

[default.validate.parameters]
lint = true

[default.deploy.parameters]
capabilities = "CAPABILITY_IAM"
confirm_changeset = true
resolve_s3 = true
image_repository = "<valid_uri>"

[default.package.parameters]
resolve_s3 = true

[default.sync.parameters]
watch = true

[default.local_start_api.parameters]
warm_containers = "EAGER"

[default.local_start_lambda.parameters]
warm_containers = "EAGER"

Steps to reproduce:

Execute
sam build
sam deploy --debug

Observed result:

ImageUri for func1function:func1-latest does not have <valid_uri> before it. Upon attempting to deploy, an image not found error is thrown.

2026-07-06 13:46:54,587 | 2 resources found in the stack
2026-07-06 13:46:54,588 | Found Serverless function with name='StandaloneFunction' and
ImageUri='<valid_uri>:standalonefunction-688312777049-standalone-latest'
2026-07-06 13:46:54,588 | --base-dir is not presented, adjusting uri ./hello_world relative to
/var/folders/f9/037ssx6j50z73x70tvx8s8hw0000gn/T/tmpplkx7u27
2026-07-06 13:46:54,588 | --base-dir is not presented, adjusting uri . relative to
/var/folders/f9/037ssx6j50z73x70tvx8s8hw0000gn/T/tmpplkx7u27
2026-07-06 13:46:54,589 | Found Serverless function with name='func1Function' and
ImageUri='func1function:func1-latest'

I have to set ImageUri: "foo" on the function definition, otherwise sam deploy --debug errors out with

Error: Unable to upload artifact None referenced by ImageUri parameter of func1Function resource.
Image not found for ImageUri parameter of func1Function resource.

I have also tried with --image-repositories, but that errors out too, although in a different way. Am I doing something wrong here or is this a bug?

Expected result:

<valid_uri> is included in the func1function:func1-latest ImageUri.

2026-07-06 13:46:54,587 | 2 resources found in the stack
2026-07-06 13:46:54,588 | Found Serverless function with name='StandaloneFunction' and
ImageUri='<valid_uri>:standalonefunction-688312777049-standalone-latest'
2026-07-06 13:46:54,588 | --base-dir is not presented, adjusting uri ./hello_world relative to
/var/folders/f9/037ssx6j50z73x70tvx8s8hw0000gn/T/tmpplkx7u27
2026-07-06 13:46:54,588 | --base-dir is not presented, adjusting uri . relative to
/var/folders/f9/037ssx6j50z73x70tvx8s8hw0000gn/T/tmpplkx7u27
2026-07-06 13:46:54,589 | Found Serverless function with name='func1Function' and
ImageUri='<valid_uri>:func1function:func1-latest'

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS:
2. sam --version:
3. AWS region:

{
  "version": "1.162.1",
  "system": {
    "python": "3.14.6",
    "os": "macOS-26.5.1-arm64-arm-64bit-Mach-O"
  },
  "additional_dependencies": {
    "container_engine": "Docker(v28.3.3)",
    "aws_cdk": "Not available",
    "terraform": "1.15.2"
  },
  "available_beta_feature_env_vars": [
    "SAM_CLI_BETA_FEATURES",
    "SAM_CLI_BETA_BUILD_PERFORMANCE",
    "SAM_CLI_BETA_TERRAFORM_SUPPORT",
    "SAM_CLI_BETA_PACKAGE_PERFORMANCE",
    "SAM_CLI_BETA_UV_PACKAGE_MANAGER"
  ]
}

Add --debug flag to command you are running

[bnusunny]

Confirmed as a bug — thanks for the clear repro. Root cause and fix in #9123.