Here is the script, that is doing exactly that. It is implemented based on @cloudbud answer. There is no argument checking. It would be executed like this: ./script QF234ASD342FG my-lambda-at-edge-function us-east-1. In my case, the execution time is less than 10 sec. See update-distribution for details.

#!/bin/bash

set -xeuo pipefail
export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin

distribution_id="$1"
function_name="$2"
region="$3"

readonly lambda_arn=$(
  aws lambda list-versions-by-function \
    --function-name "$function_name" \
    --region "$region" \
    --query "max_by(Versions, &to_number(to_number(Version) || '0'))" \
  | jq -r '.FunctionArn'
)

readonly tmp1=$(mktemp)
readonly tmp2=$(mktemp)

aws cloudfront get-distribution-config \
  --id "$distribution_id" \
> "$tmp1"

readonly etag=$(jq -r '.ETag' < "$tmp1")

cat "$tmp1" \
| jq '(.DistributionConfig.CacheBehaviors.Items[] | select(.PathPattern=="dist/sxf/*") | .LambdaFunctionAssociations.Items[] | select(.EventType=="origin-request") | .LambdaFunctionARN ) |= "'"$lambda_arn"'"' \
| jq '.DistributionConfig' \
> "$tmp2"

# the dist config has to be in the file
# and be referred in specific way.
aws cloudfront update-distribution \
  --id "$distribution_id" \
  --distribution-config "file://$tmp2" \
  --if-match "$etag"

rm -f "$tmp1" "$tmp2"

could not figure out how to update the lambda arn only.

The link that you provided explains the process:

The update process includes getting the current distribution configuration, updating the XML document that is returned to make your changes, and then submitting an UpdateDistribution request to make the updates.

This means that you can't just update lambda arn directly. You have:

1. Call get-distribution-config to obtain full current configuration.

2. Change the lambda arn in the configuration data obtained.

3. Upload the entire new configuration using update-distribution.

The process requires extra attention which is also explained in the docs under Warning:

You must strip out the ETag parameter that is returned.

Additional fields are required when you update a distribution.

and more.

The process is indeed complex. Thus if you can I would recommend trying this on some test/dummy CloudFront distribution rather than directly on the production version.

Something like this:

#!/bin/bash
set -x
TEMPDIR=$(mktemp -d)
CONFIG=$(aws cloudfront get-distribution-config --id CGSKSKLSLSM)
ETAG=$(echo "${CONFIG}" | jq -r '.ETag')
echo "${CONFIG}" | jq '.DistributionConfig' > ${TEMPDIR}/orig.json
echo "${CONFIG}" | jq '.DistributionConfig | .DefaultCacheBehavior.LambdaFunctionAssociations.Items[0].LambdaFunctionARN= "arn:aws:lambda:us-east-1:xxxxx:function:test-func:3"' > ${TEMPDIR}/updated.json
aws cloudfront update-distribution --id CGSKSKLSLSM --distribution-config file://${TEMPDIR}/updated.json --if-match "${ETAG}"