While a lambda is still processing (archive unpacking etc), the lambda state should be set to "Pending" (currently "Active") and invocations to that lambda should fail (currently, it can end up in a inconsistent state in this case, like lambdas being executed without layers).

Lambda state should reflect the current internal state, and invocations should fail if not active.
f"The statement id {sid} provided already exists. Please provide a new "
                "statement id, or remove the existing statement."
            )
            return error_response(msg, 400, error_type="ResourceConflictException")
        new_policy["Statement"].extend(previous_policy["Statement"])
        iam_client.delete_policy(PolicyArn=previous_policy["PolicyArn"])
    policy_name = get_lambda_policy_name(resource_name, qualifier=qualifier)
    LOG.debug('Creating IAM policy "%s" for Lambda resource %s', policy_name, resource_arn)
    iam_client.create_policy(
        PolicyName=policy_name,
        PolicyDocument=json.dumps(new_policy),
        Description='Policy for Lambda function "%s"' % resource_name,
    )
    return jsonify(result)
@app.route("%s/functions/<function>/policy/<statement>" % API_PATH_ROOT, methods=["DELETE"])
def remove_permission(function, statement):
    qualifier = request.args.get("Qualifier")
    iam_client = aws_stack.connect_to_service("iam")
    policy = get_lambda_policy(function, qualifier=qualifier)
    if not policy:
        return not_found_error('Unable to find policy for Lambda function "%s"' % function)
    statement_index = next(
        (i for i, item in enumerate(policy["Statement"]) if item["Sid"] == statement), None
    )
    if statement_index is None:
        return not_found_error(f"Statement {statement} is not found in resource policy.")
    iam_client.delete_policy(PolicyArn=policy["PolicyArn"])
    policy["Statement"].pop(statement_index)
    description = policy.get("Description")
    policy_name = policy.get("PolicyName")