lambda
This component is responsible for provisioning Lambda functions.
Usage
Stack Level: Regional
Stack configuration for defaults:
components:
terraform:
lambda-defaults:
metadata:
type: abstract
settings:
spacelift:
workspace_enabled: true
vars:
enabled: true
Sample App Yaml Entry:
import:
- catalog/lambda/defaults
components:
terraform:
lambda/hello-world-py:
metadata:
component: lambda
inherits:
- lambda/defaults
vars:
name: hello-world-py
function_name: main
description: Hello Lambda from Python!
handler: lambda.lambda_handler # in go this is the compiled binary, python it's filename.function
memory_size: 256
# https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
runtime: python3.9
package_type: Zip # `Zip` or `Image`
policy_json: |
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ListAllBuckets",
"Effect": "Allow",
"Action": "s3:ListAllMyBuckets",
"Resource": "*"
}
]
}
iam_policy:
statements:
- sid: AllowSQSWorkerWriteAccess
effect: Allow
actions:
- sqs:SendMessage
- sqs:SendMessageBatch
resources:
- arn:aws:sqs:*:111111111111:worker-queue
# Filename example
filename: lambdas/hello-world-python/output.zip # generated by zip variable.
zip:
enabled: true
input_dir: hello-world-python
output: hello-world-python/output.zip
# S3 Source Example
# s3_bucket_name: lambda-source # lambda main.tf calculates the rest of the bucket_name
# s3_key: hello-world-go.zip
Notifications:
SQS
sqs_notifications:
my-service-a:
sqs_component:
component: sqs-queue/my-service-a
my-service-b:
sqs_arn: arn:aws:sqs:us-west-2:111111111111:my-service-b
S3
s3_notifications:
my-service-a:
bucket_component:
component: s3-bucket/my-service-a
events: ["s3:ObjectCreated:*"]
my-service-b:
bucket_name: my-service-b
events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"]
Cron (CloudWatch Event)
cloudwatch_event_rules:
schedule-a:
schedule_expression: "rate(5 minutes)"
schedule-b:
schedule_expression: "cron(0 20 * * ? *)"
Variables
Required Variables
Optional Variables
architectures
(list(string)
) optionalInstruction set architecture for your Lambda function. Valid values are ["x86_64"] and ["arm64"].
Default is ["x86_64"]. Removing this attribute, function's architecture stay the same.Default value:
null
cicd_s3_key_format
(string
) optionalThe format of the S3 key to store the latest version/sha of the Lambda function. This is used with cicd_ssm_param_name. Defaults to 'stage/{stage}/lambda/{function_name}/%s.zip'
Default value:
null
cicd_ssm_param_name
(string
) optionalThe name of the SSM parameter to store the latest version/sha of the Lambda function. This is used with cicd_s3_key_format
Default value:
null
cloudwatch_event_rules
optionalCreates EventBridge (CloudWatch Events) rules for invoking the Lambda Function along with the required permissions.
Type:
map(object({
description = optional(string)
event_bus_name = optional(string)
event_pattern = optional(string)
is_enabled = optional(bool)
name_prefix = optional(string)
role_arn = optional(string)
schedule_expression = optional(string)
}))Default value:
{ }
cloudwatch_lambda_insights_enabled
(bool
) optionalEnable CloudWatch Lambda Insights for the Lambda Function.
Default value:
false
cloudwatch_logs_kms_key_arn
(string
) optionalThe ARN of the KMS Key to use when encrypting log data.
Default value:
null
cloudwatch_logs_retention_in_days
(number
) optionalSpecifies the number of days you want to retain log events in the specified log group. Possible values are:
1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653, and 0. If you select 0, the events in the
log group are always retained and never expire.Default value:
null
custom_iam_policy_arns
(set(string)
) optionalARNs of IAM policies to be attached to the Lambda role
Default value:
[ ]
dead_letter_config_target_arn
(string
) optionalARN of an SNS topic or SQS queue to notify when an invocation fails. If this option is used, the function's IAM role
must be granted suitable access to write to the target object, which means allowing either the sns:Publish or
sqs:SendMessage action on this ARN, depending on which service is targeted."Default value:
null
description
(string
) optionalDescription of what the Lambda Function does.
Default value:
null
filename
(string
) optionalThe path to the function's deployment package within the local filesystem. Works well with the
zip
variable. If defined, The s3_-prefixed options and image_uri cannot be used.Default value:
null
function_name
(string
) optionalUnique name for the Lambda Function.
Default value:
null
function_url_enabled
(bool
) optionalCreate a aws_lambda_function_url resource to expose the Lambda function
Default value:
false
handler
(string
) optionalThe function entrypoint in your code.
Default value:
null
iam_policy
optionalIAM policy to attach to the Lambda role, specified as a Terraform object. This can be used with or instead of
var.policy_json
.Type:
object({
policy_id = optional(string, null)
version = optional(string, null)
statements = list(object({
sid = optional(string, null)
effect = optional(string, null)
actions = optional(list(string), null)
not_actions = optional(list(string), null)
resources = optional(list(string), null)
not_resources = optional(list(string), null)
conditions = optional(list(object({
test = string
variable = string
values = list(string)
})), [])
principals = optional(list(object({
type = string
identifiers = list(string)
})), [])
not_principals = optional(list(object({
type = string
identifiers = list(string)
})), [])
}))
})Default value:
null
iam_policy_description
(string
) optionalDescription of the IAM policy for the Lambda IAM role
Default value:
"Minimum SSM read permissions for Lambda IAM Role"
image_config
(any
) optionalThe Lambda OCI image configurations
block with three (optional) arguments:- entry_point - The ENTRYPOINT for the docker image (type
list(string)
). - command - The CMD for the docker image (type
list(string)
). - working_directory - The working directory for the docker image (type
string
).
Default value:
{ }
- entry_point - The ENTRYPOINT for the docker image (type
image_uri
(string
) optionalThe ECR image URI containing the function's deployment package. Conflicts with
filename
,s3_bucket_name
,s3_key
, ands3_object_version
.Default value:
null
kms_key_arn
(string
) optionalAmazon Resource Name (ARN) of the AWS Key Management Service (KMS) key that is used to encrypt environment variables.
If this configuration is not provided when environment variables are in use, AWS Lambda uses a default service key.
If this configuration is provided when environment variables are not in use, the AWS Lambda API does not save this
configuration and Terraform will show a perpetual difference of adding the key. To fix the perpetual difference,
remove this configuration.Default value:
""
lambda_at_edge_enabled
(bool
) optionalEnable Lambda@Edge for your Node.js or Python functions. The required trust relationship and publishing of function versions will be configured in this module.
Default value:
false
lambda_environment
optionalEnvironment (e.g. ENV variables) configuration for the Lambda function enable you to dynamically pass settings to your function code and libraries.
Type:
object({
variables = map(string)
})Default value:
null
layers
(list(string)
) optionalList of Lambda Layer Version ARNs (maximum of 5) to attach to the Lambda Function.
Default value:
[ ]
memory_size
(number
) optionalAmount of memory in MB the Lambda Function can use at runtime.
Default value:
128
package_type
(string
) optionalThe Lambda deployment package type. Valid values are
Zip
andImage
.Default value:
"Zip"
permissions_boundary
(string
) optionalARN of the policy that is used to set the permissions boundary for the role
Default value:
""
policy_json
(string
) optionalIAM policy to attach to the Lambda role, specified as JSON. This can be used with or instead of
var.iam_policy
.Default value:
null
publish
(bool
) optionalWhether to publish creation/change as new Lambda Function Version.
Default value:
false
reserved_concurrent_executions
(number
) optionalThe amount of reserved concurrent executions for this lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations.
Default value:
-1
runtime
(string
) optionalThe runtime environment for the Lambda function you are uploading.
Default value:
null
s3_bucket_component
optionalThe bucket component to use for the S3 bucket containing the function's deployment package. Conflicts with
s3_bucket_name
,filename
andimage_uri
.Type:
object({
component = string
tenant = optional(string)
stage = optional(string)
environment = optional(string)
})Default value:
null
s3_bucket_name
(string
) optionalThe name suffix of the S3 bucket containing the function's deployment package. Conflicts with filename and image_uri.
This bucket must reside in the same AWS region where you are creating the Lambda function.Default value:
null
s3_key
(string
) optionalThe S3 key of an object containing the function's deployment package. Conflicts with filename and image_uri.
Default value:
null
s3_notifications
optionalA map of S3 bucket notifications to trigger the Lambda function
Type:
map(object({
bucket_name = optional(string)
bucket_component = optional(object({
component = string
environment = optional(string)
tenant = optional(string)
stage = optional(string)
}))
events = optional(list(string))
filter_prefix = optional(string)
filter_suffix = optional(string)
source_account = optional(string)
}))Default value:
{ }
s3_object_version
(string
) optionalThe object version containing the function's deployment package. Conflicts with filename and image_uri.
Default value:
null
source_code_hash
(string
) optionalUsed to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either
filename or s3_key. The usual way to set this is filebase64sha256('file.zip') where 'file.zip' is the local filename
of the lambda function source archive.Default value:
""
sqs_notifications
optionalA map of SQS queue notifications to trigger the Lambda function
Type:
map(object({
sqs_arn = optional(string)
sqs_component = optional(object({
component = string
environment = optional(string)
tenant = optional(string)
stage = optional(string)
}))
batch_size = optional(number)
source_account = optional(string)
on_failure_arn = optional(string)
maximum_concurrency = optional(number)
}))Default value:
{ }
ssm_parameter_names
(list(string)
) optionalList of AWS Systems Manager Parameter Store parameter names. The IAM role of this Lambda function will be enhanced
with read permissions for those parameters. Parameters must start with a forward slash and can be encrypted with the
default KMS key.Default value:
null
timeout
(number
) optionalThe amount of time the Lambda Function has to run in seconds.
Default value:
3
tracing_config_mode
(string
) optionalTracing config mode of the Lambda function. Can be either PassThrough or Active.
Default value:
null
vpc_config
optionalProvide this to allow your function to access your VPC (if both 'subnet_ids' and 'security_group_ids' are empty then
vpc_config is considered to be empty or unset, see https://docs.aws.amazon.com/lambda/latest/dg/vpc.html for details).Type:
object({
security_group_ids = list(string)
subnet_ids = list(string)
})Default value:
null
zip
optionalZip Configuration for local file deployments
Type:
object({
enabled = optional(bool, false)
output = optional(string, "output.zip")
input_dir = optional(string, null)
})Default value:
{
"enabled": false,
"output": "output.zip"
}
Context Variables
The following variables are defined in the context.tf
file of this module and part of the terraform-null-label pattern.
context.tf
file of this module and part of the terraform-null-label pattern.Outputs
arn
ARN of the lambda function
function_name
Lambda function name
invoke_arn
Invoke ARN of the lambda function
qualified_arn
ARN identifying your Lambda Function Version (if versioning is enabled via publish = true)
role_arn
Lambda IAM role ARN
role_name
Lambda IAM role name
Dependencies
Requirements
terraform
, version:>= 1.3.0
archive
, version:>= 2.3.0
aws
, version:>= 4.9.0
random
, version:>= 3.0.0
Providers
archive
, version:>= 2.3.0
aws
, version:>= 4.9.0
random
, version:>= 3.0.0
Modules
Name | Version | Source | Description |
---|---|---|---|
cloudwatch_event_rules_label | 0.25.0 | cloudposse/label/null | n/a |
iam_policy | 2.0.2 | cloudposse/iam-policy/aws | n/a |
iam_roles | latest | ../account-map/modules/iam-roles | n/a |
lambda | 0.6.1 | cloudposse/lambda-function/aws | n/a |
s3_bucket | 1.8.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |
s3_bucket_notifications_component | 1.8.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |
sqs_iam_policy | 2.0.2 | cloudposse/iam-policy/aws | n/a |
sqs_queue | 1.8.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |
this | 0.25.0 | cloudposse/label/null | n/a |
Resources
The following resources are used by this module:
aws_cloudwatch_event_rule.event_rules
(resource)aws_cloudwatch_event_target.sns
(resource)aws_iam_role_policy_attachment.default
(resource)aws_iam_role_policy_attachment.sqs_default
(resource)aws_lambda_event_source_mapping.event_source_mapping
(resource)aws_lambda_function_url.lambda_url
(resource)aws_lambda_permission.allow_cloudwatch_to_call_lambda
(resource)aws_lambda_permission.s3_notification
(resource)aws_s3_bucket_notification.s3_notifications
(resource)random_pet.zip_recreator
(resource)
Data Sources
The following data sources are used by this module:
archive_file.lambdazip
(data source)aws_ssm_parameter.cicd_ssm_param
(data source)
References
- cloudposse/terraform-aws-components - Cloud Posse's upstream component