An application’s CloudFormation template references a Lambda deployment package stored in S3 by specifying the S3 object key. Each time the stack is updated, the Lambda function does not change even though the zip is updated in S3. How can the developer ensure CloudFormation updates the function when the code changes?

CloudFormation updates resources only when their properties change in the template. If the S3 object key remains the same, CloudFormation assumes the Lambda code hasn't changed, even if the content of the S3 object has been updated. To force an update, you must either change the S3 object key referenced in the template (e.g., by using a versioned key or a new key for each deployment) or, more effectively, include the S3 object version. By specifying the S3 object version, CloudFormation detects the change in the version ID and triggers an update to the Lambda function. Creating a new Lambda alias or uploading to a different S3 bucket without updating the template reference will not trigger a CloudFormation update. Associating a code signing configuration is for security and integrity, not for triggering updates.