diff --git a/apis/lambda/v1beta1/zz_function_terraformed.go b/apis/lambda/v1beta1/zz_function_terraformed.go
index 9c067934d7..c2cab3b267 100755
--- a/apis/lambda/v1beta1/zz_function_terraformed.go
+++ b/apis/lambda/v1beta1/zz_function_terraformed.go
@@ -118,6 +118,7 @@ func (tr *Function) LateInitialize(attrs []byte) (bool, error) {
 		return false, errors.Wrap(err, "failed to unmarshal Terraform state parameters for late-initialization")
 	}
 	opts := []resource.GenericLateInitializerOption{resource.WithZeroValueJSONOmitEmptyFilter(resource.CNameWildcard)}
+	opts = append(opts, resource.WithNameFilter("SourceCodeHash"))
 
 	li := resource.NewGenericLateInitializer(opts...)
 	return li.LateInitialize(&tr.Spec.ForProvider, params)
diff --git a/apis/lambda/v1beta1/zz_function_types.go b/apis/lambda/v1beta1/zz_function_types.go
index 096e1a296f..7e2810fc93 100755
--- a/apis/lambda/v1beta1/zz_function_types.go
+++ b/apis/lambda/v1beta1/zz_function_types.go
@@ -238,7 +238,7 @@ type FunctionInitParameters struct {
 	// Snap start settings block. Detailed below.
 	SnapStart []SnapStartInitParameters `json:"snapStart,omitempty" tf:"snap_start,omitempty"`
 
-	// Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either filename or s3_key. The usual way to set this is filebase64sha256("file.11.12 and later) or base64sha256(file("file.11.11 and earlier), where "file.zip" is the local filename of the lambda function source archive.
+	// Used to trigger updates. Must be set to a base64 encoded SHA256 hash of the package file specified with either filename or s3_key. If you have specified this field manually, it should be the actual (computed) hash of the underlying lambda function specified in the filename, image_uri, s3_bucket fields.
 	SourceCodeHash *string `json:"sourceCodeHash,omitempty" tf:"source_code_hash,omitempty"`
 
 	// Key-value map of resource tags.
@@ -355,7 +355,7 @@ type FunctionObservation struct {
 	// Snap start settings block. Detailed below.
 	SnapStart []SnapStartObservation `json:"snapStart,omitempty" tf:"snap_start,omitempty"`
 
-	// Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either filename or s3_key. The usual way to set this is filebase64sha256("file.11.12 and later) or base64sha256(file("file.11.11 and earlier), where "file.zip" is the local filename of the lambda function source archive.
+	// Used to trigger updates. Must be set to a base64 encoded SHA256 hash of the package file specified with either filename or s3_key. If you have specified this field manually, it should be the actual (computed) hash of the underlying lambda function specified in the filename, image_uri, s3_bucket fields.
 	SourceCodeHash *string `json:"sourceCodeHash,omitempty" tf:"source_code_hash,omitempty"`
 
 	// Size in bytes of the function .zip file.
@@ -528,7 +528,7 @@ type FunctionParameters struct {
 	// +kubebuilder:validation:Optional
 	SnapStart []SnapStartParameters `json:"snapStart,omitempty" tf:"snap_start,omitempty"`
 
-	// Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either filename or s3_key. The usual way to set this is filebase64sha256("file.11.12 and later) or base64sha256(file("file.11.11 and earlier), where "file.zip" is the local filename of the lambda function source archive.
+	// Used to trigger updates. Must be set to a base64 encoded SHA256 hash of the package file specified with either filename or s3_key. If you have specified this field manually, it should be the actual (computed) hash of the underlying lambda function specified in the filename, image_uri, s3_bucket fields.
 	// +kubebuilder:validation:Optional
 	SourceCodeHash *string `json:"sourceCodeHash,omitempty" tf:"source_code_hash,omitempty"`
 
diff --git a/config/lambda/config.go b/config/lambda/config.go
index 31fe96c23c..79d6c73806 100644
--- a/config/lambda/config.go
+++ b/config/lambda/config.go
@@ -61,6 +61,13 @@ func Configure(p *config.Provider) {
 			SelectorFieldName: "SubnetIDSelector",
 		}
 		delete(r.TerraformResource.Schema, "filename")
+		r.LateInitializer = config.LateInitializer{
+			IgnoredFields: []string{"source_code_hash"},
+		}
+		r.MetaResource.ArgumentDocs["source_code_hash"] = "Used to trigger updates. Must be set to " +
+			"a base64 encoded SHA256 hash of the package file specified with either filename or s3_key. " +
+			"If you have specified this field manually, it should be the actual (computed) hash of the " +
+			"underlying lambda function specified in the filename, image_uri, s3_bucket fields."
 	})
 
 	p.AddResourceConfigurator("aws_lambda_function_event_invoke_config", func(r *config.Resource) {
diff --git a/examples/lambda/v1beta1/function.yaml b/examples/lambda/v1beta1/function.yaml
index 70bffb4f88..8a85bf14f6 100644
--- a/examples/lambda/v1beta1/function.yaml
+++ b/examples/lambda/v1beta1/function.yaml
@@ -13,7 +13,7 @@ metadata:
   name: example
 spec:
   forProvider:
-    s3Bucket: upbound-provider-test-data
+    s3Bucket: official-provider-test-data
     s3Key: hello-python.zip
     handler: index.py
     packageType: Zip
diff --git a/package/crds/lambda.aws.upbound.io_functions.yaml b/package/crds/lambda.aws.upbound.io_functions.yaml
index 2db26d552d..37559c0420 100644
--- a/package/crds/lambda.aws.upbound.io_functions.yaml
+++ b/package/crds/lambda.aws.upbound.io_functions.yaml
@@ -644,12 +644,11 @@ spec:
                       type: object
                     type: array
                   sourceCodeHash:
-                    description: Used to trigger updates. Must be set to a base64-encoded
-                      SHA256 hash of the package file specified with either filename
-                      or s3_key. The usual way to set this is filebase64sha256("file.11.12
-                      and later) or base64sha256(file("file.11.11 and earlier), where
-                      "file.zip" is the local filename of the lambda function source
-                      archive.
+                    description: Used to trigger updates. Must be set to a base64
+                      encoded SHA256 hash of the package file specified with either
+                      filename or s3_key. If you have specified this field manually,
+                      it should be the actual (computed) hash of the underlying lambda
+                      function specified in the filename, image_uri, s3_bucket fields.
                     type: string
                   tags:
                     additionalProperties:
@@ -1439,12 +1438,11 @@ spec:
                       type: object
                     type: array
                   sourceCodeHash:
-                    description: Used to trigger updates. Must be set to a base64-encoded
-                      SHA256 hash of the package file specified with either filename
-                      or s3_key. The usual way to set this is filebase64sha256("file.11.12
-                      and later) or base64sha256(file("file.11.11 and earlier), where
-                      "file.zip" is the local filename of the lambda function source
-                      archive.
+                    description: Used to trigger updates. Must be set to a base64
+                      encoded SHA256 hash of the package file specified with either
+                      filename or s3_key. If you have specified this field manually,
+                      it should be the actual (computed) hash of the underlying lambda
+                      function specified in the filename, image_uri, s3_bucket fields.
                     type: string
                   tags:
                     additionalProperties:
@@ -2047,12 +2045,11 @@ spec:
                       type: object
                     type: array
                   sourceCodeHash:
-                    description: Used to trigger updates. Must be set to a base64-encoded
-                      SHA256 hash of the package file specified with either filename
-                      or s3_key. The usual way to set this is filebase64sha256("file.11.12
-                      and later) or base64sha256(file("file.11.11 and earlier), where
-                      "file.zip" is the local filename of the lambda function source
-                      archive.
+                    description: Used to trigger updates. Must be set to a base64
+                      encoded SHA256 hash of the package file specified with either
+                      filename or s3_key. If you have specified this field manually,
+                      it should be the actual (computed) hash of the underlying lambda
+                      function specified in the filename, image_uri, s3_bucket fields.
                     type: string
                   sourceCodeSize:
                     description: Size in bytes of the function .zip file.