How to ensure using the latest lambda layer version when deploying with CloudFormation and SAM?

This is strange. Layers is just a way to package code that is deployed with the function. Once a function is created or updated, it includes the layer code and it doesn't change until the function is updated again. This means that if a function took an old version of the layer, it should fail all the time. While a function is being deployed, some of the invocations will go to the old version of the function, but that version also includes the old version of the layer. Once the deployment is done the invocations will go to the new version, which includes new layer version.

Saying the above, I would recommend that each function includes its own dependencies directly and not use layers for that. This way your functions' code will be smaller as each will only include the dependencies it requires. Also, if you change something in one function that needs a change in the dependencies, it will not affect the other functions using the same layer.

After a couple of tests it turns out that the issue is caused by the order of the changes from changeset. Looks like changes are applied one by one. For example for the following changeset it updates the old function code while still using the old layer and then updates the function layer with the latest version because Layers change item comes after Code change item.

{
  "resourceChange":{
    "logicalResourceId":"ExampleFunction",
    "action":"Modify",
    "physicalResourceId":"example-function",
    "resourceType":"AWS::Lambda::Function",
    "replacement":"False",
    "moduleInfo":null,
    "details":[
      {
        "target":{
          "name":"Layers",
          "requiresRecreation":"Never",
          "attribute":"Properties"
        },
        "causingEntity":null,
        "evaluation":"Dynamic",
        "changeSource":"DirectModification"
      },
      {
        "target":{
          "name":"Code",
          "requiresRecreation":"Never",
          "attribute":"Properties"
        },
        "causingEntity":null,
        "evaluation":"Static",
        "changeSource":"DirectModification"
      },
      {
        "target":{
          "name":"Layers",
          "requiresRecreation":"Never",
          "attribute":"Properties"
        },
        "causingEntity":"CoreLayer123abc456",
        "evaluation":"Static",
        "changeSource":"ResourceReference"
      }
    ],
    "changeSetId":null,
    "scope":[
      "Properties"
    ]
  },
  "hookInvocationCount":null,
  "type":"Resource"
}

But in some deployments the order is the other way around, such as:

{
  "resourceChange":{
    ...
    "details":[
      ...
      {
        "target":{
          "name":"Layers",
          "requiresRecreation":"Never",
          "attribute":"Properties"
        },
        "causingEntity":"CoreLayer123abc456",
        "evaluation":"Static",
        "changeSource":"ResourceReference"
      },
      {
        "target":{
          "name":"Code",
          "requiresRecreation":"Never",
          "attribute":"Properties"
        },
        "causingEntity":null,
        "evaluation":"Static",
        "changeSource":"DirectModification"
      }
    ],
    ...
}

In this case it updates the old function with the latest layer version and then updates the function code with the updated one. So for a couple of seconds old code is invoked with the latest layer version.

So does it possible to apply all these changes in only one single step? Similar to Atomicity in databases