What changed
On July 15, 2026, AWS Lambda added self-managed S3 code storage for zip-based functions and layers. Instead of always copying a deployment package into Lambda-managed storage, builders can set `S3ObjectStorageMode=REFERENCE` so Lambda reads a specific versioned object directly from a customer-owned S3 bucket. AWS also raised the default Lambda-managed code-storage quota from 75GB to 300GB per Region per account.
Why it matters
This changes both scale limits and the trust boundary around Lambda deployment artifacts. Large function fleets can avoid consuming Lambda’s managed code-storage quota, while security and compliance teams can apply their own KMS keys, Object Lock, access logging, lifecycle rules and replication to the canonical artifact. The trade-off is operational responsibility: in reference mode the S3 object must remain available and readable, so deleting it, changing bucket policy or disabling a KMS key can push the function into an inactive state and break future cold starts or re-optimization.
Reference mode removes Lambda’s intermediate copy
Historically, Lambda copied zip deployment packages from a customer S3 bucket into internal Lambda-managed storage. With `REFERENCE`, the object in the builder’s bucket becomes the source Lambda reads directly. The deployment package no longer counts against Lambda-managed code storage, and AWS says function creation or update can be modestly faster because the copy step disappears.
The artifact becomes part of your production control plane
Customer ownership of the source object unlocks normal S3 controls such as versioning, SSE-KMS or DSSE-KMS, Object Lock, lifecycle configuration, CloudTrail or access logging, and cross-Region replication. That makes deployment code auditable and governable in the same account as the rest of a team’s release artifacts.
Availability responsibility moves with the control
Reference mode is not just a storage optimization. Lambda periodically needs the source object when re-optimizing function code. AWS documents that if the object becomes unavailable because it was deleted, permissions changed or a KMS key was disabled, the function can transition to `Inactive`. Restoring access and updating the function is then required to recover it.
The old copy path still exists
The default remains `COPY`, and builders can switch existing functions back and forth by updating function code. That makes the new mode opt-in rather than a forced migration, which is useful for teams that value Lambda-managed artifact durability over direct control.