Introduction

AWS Lambda reports CodeSha256 as a base64-encoded SHA-256 digest of the uploaded deployment package bytes. The important detail is that this is not the hexadecimal digest many local hash tools print by default. If you want to calculate the same value before uploading, you must hash the exact ZIP file bytes and then base64-encode the raw digest.

What CodeSha256 Represents

When you upload a ZIP deployment package to Lambda, AWS stores a SHA-256 digest of that ZIP archive. The CodeSha256 field is useful when you want to:

• verify that a build artifact matches the deployed code
• check whether a package changed without unpacking it
• compare expected and actual deployment results in automation

The value is tied to the actual ZIP bytes. If you rebuild the ZIP differently, even with identical file contents, the digest can change because ZIP metadata and file ordering matter.

The Common Mistake: Hex Instead of Base64

A typical local SHA-256 command prints something like this:

shasum -a 256 function.zip

That produces a hexadecimal string. Lambda does not expose CodeSha256 in that form. Lambda uses base64 of the raw digest bytes.

So you need two steps:

1. compute SHA-256 over the ZIP file bytes
2. base64-encode the resulting 32-byte digest

Command-Line Example

On systems with OpenSSL, this is a practical pipeline:

openssl dgst -sha256 -binary function.zip | openssl base64

That output should match Lambda's CodeSha256 for the exact same ZIP archive.

If you prefer to inspect both forms:

shasum -a 256 function.zip
openssl dgst -sha256 -binary function.zip | openssl base64

The first line is hex for humans. The second line is the format Lambda uses.

Python Example

A small Python script avoids shell differences across platforms.

1import base64
2import hashlib
3
4
5def lambda_codesha256(path):
6    with open(path, "rb") as f:
7        digest = hashlib.sha256(f.read()).digest()
8    return base64.b64encode(digest).decode("ascii")
9
10
11print(lambda_codesha256("function.zip"))

This computes the SHA-256 digest of the file contents and base64-encodes it exactly the way you need.

Match the Exact Artifact, Not the Unzipped Directory

A subtle but important point: hash the ZIP file you will upload, not the source directory.

These are not equivalent:

• hashing each source file in the project
• hashing the final deployment ZIP

Lambda stores the digest of the uploaded package blob. If your build process changes timestamps, file order, compression settings, or included metadata, the ZIP bytes change and the CodeSha256 changes too.

That is why reproducible packaging matters in deployment pipelines.

Why the Value Can Change Unexpectedly

Developers are sometimes surprised that two ZIP files built from the same source tree produce different digests. That can happen because ZIP creation is not automatically deterministic.

Examples of causes:

• file modification timestamps differ
• file order inside the archive differs
• compression settings differ
• extra hidden files are included in one build but not the other

If you want stable hashes across builds, make the archive creation process deterministic.

Where You See CodeSha256

After deployment, AWS surfaces this value in Lambda metadata, for example through the CLI or API responses. That makes it useful in CI checks that compare the local expected artifact with the deployed package fingerprint.

The correct comparison works only if both sides refer to the exact same ZIP file bytes.

Common Pitfalls

The biggest mistake is comparing Lambda's base64 CodeSha256 against a local hexadecimal SHA-256 output.

Another mistake is hashing the source directory contents instead of the actual ZIP archive that is uploaded.

A third issue is overlooking nondeterministic ZIP creation, which can make identical source code produce different package hashes.

Summary

• Lambda CodeSha256 is the base64-encoded SHA-256 digest of the uploaded ZIP file bytes
• Do not compare it with a plain hexadecimal hash output without converting formats
• Hash the exact deployment ZIP, not the extracted source files
• Use openssl dgst -sha256 -binary ... | openssl base64 or a small Python script to reproduce the value locally
• If the hash changes unexpectedly, inspect how the ZIP package is being built rather than the application code alone