Trigger Terraform Lambda Code Uploads: A Guide

• Introduction
• Step-by-Step Guide
• Code Example
• Additional Notes
• Summary
• Conclusion
• References

When working with Terraform and AWS Lambda, it's crucial to ensure that your infrastructure code accurately reflects the state of your Lambda functions. This includes automatically deploying updates to your functions whenever the underlying code changes. This article outlines several best practices to ensure Terraform recognizes code changes and updates your Lambda function accordingly.

To ensure Terraform recognizes code changes and updates your Lambda function, follow these steps:

1. Use source_code_hash:

   resource "aws_lambda_function" "example" {
     function_name = "my-function"
     s3_bucket     = "my-bucket"
     s3_key         = "my-function.zip"
     source_code_hash = filebase64sha256("my-function.zip")
     # ... other configurations
   }

   This calculates the hash of your zip file and updates the Lambda function only when the code changes.

2. Trigger updates with null_resource:

   If you need more control or want to trigger updates based on other resources, use null_resource:

   resource "null_resource" "lambda_update" {
     triggers = {
       code_hash = filebase64sha256("my-function.zip")
     }
   
     provisioner "local-exec" {
       command = "echo 'Code updated, triggering Lambda deployment...'"
     }
   }
   
   resource "aws_lambda_function" "example" {
     # ... other configurations
     depends_on = [null_resource.lambda_update]
   }

   This example triggers an update whenever the hash of "my-function.zip" changes.

3. Avoid using timestamps for triggering:

   While tempting, using timestamps can lead to unpredictable deployments. Stick to content-based triggers like source_code_hash.

4. Consider using deployment packages:

   For larger Lambda functions or complex deployments, consider using deployment packages (zip files containing your code and dependencies). This can simplify dependency management and deployments.

5. Leverage Terraform modules:

   For reusable Lambda function deployments, create Terraform modules that encapsulate the function code, configuration, and deployment logic.

By following these steps, you can ensure that Terraform efficiently manages your Lambda function deployments and updates them only when necessary.

This document provides Terraform code examples for updating Lambda functions. It shows how to use source_code_hash to trigger updates only when the code changes, how to use a null_resource to manually trigger updates based on file changes, and how to use Terraform modules to create reusable Lambda function deployments. It also mentions using deployment packages for simplified dependency management but doesn't provide code for that.

This document provides code examples for the strategies outlined in the article to ensure Terraform recognizes code changes and updates your Lambda function.

1. Using source_code_hash:

resource "aws_lambda_function" "example" {
  function_name = "my-function"
  s3_bucket     = "my-bucket"
  s3_key         = "my-function.zip"
  source_code_hash = filebase64sha256("my-function.zip")

  # ... other configurations like runtime, handler, memory etc.
  runtime = "python3.9"
  handler = "index.handler"
  memory_size = 128
}

This code snippet calculates the SHA256 hash of your my-function.zip file and uses it as the source_code_hash. Terraform will only update the Lambda function when the content of the zip file changes, resulting in a different hash.

2. Triggering updates with null_resource:

resource "null_resource" "lambda_update" {
  triggers = {
    code_hash = filebase64sha256("my-function.zip")
  }

  provisioner "local-exec" {
    command = "echo 'Code updated, triggering Lambda deployment...'"
  }
}

resource "aws_lambda_function" "example" {
  function_name = "my-function"
  s3_bucket     = "my-bucket"
  s3_key         = "my-function.zip"

  # ... other configurations

  depends_on = [null_resource.lambda_update]
}

This example introduces a null_resource named lambda_update. This resource has a trigger that monitors the SHA256 hash of your my-function.zip file. Whenever the hash changes, indicating a code update, the null_resource triggers and runs the specified command. The aws_lambda_function resource depends on this null_resource, ensuring that any change in the code triggers a Lambda function update.

3. Using deployment packages:

While not directly shown in code, this approach involves packaging your Lambda function code and its dependencies into a zip file. This zip file is then uploaded to S3 and referenced in your Terraform code. This approach simplifies dependency management and deployments, especially for larger Lambda functions.

4. Leveraging Terraform modules:

# modules/lambda-function/main.tf
resource "aws_lambda_function" "example" {
  function_name = var.function_name
  s3_bucket     = var.s3_bucket
  s3_key         = var.s3_key
  source_code_hash = filebase64sha256(var.s3_key)

  # ... other configurations
}

# main.tf
module "my_lambda_function" {
  source = "./modules/lambda-function"

  function_name = "my-function"
  s3_bucket     = "my-bucket"
  s3_key         = "my-function.zip"
}

This example demonstrates creating a reusable Terraform module for deploying Lambda functions. The module encapsulates the Lambda function resource and its configuration. You can reuse this module across different projects and environments, promoting consistency and reducing code duplication.

By implementing these strategies, you can ensure that Terraform efficiently manages your Lambda function deployments and updates them only when necessary, based on actual code changes. This approach leads to more predictable and reliable deployments.

This section provides additional context and considerations for the strategies outlined in the document:

General Considerations:

• Deployment Frequency: The choice of triggering mechanism depends on how often your Lambda function code changes. For infrequent changes, source_code_hash might suffice. For more frequent updates or integration with CI/CD pipelines, null_resource offers more flexibility.
• Idempotency: Ensure your Terraform code remains idempotent, meaning applying it multiple times produces the same end state. The provided examples prioritize this by relying on content-based triggers.
• Error Handling: Implement robust error handling in your Lambda functions and Terraform code. This includes logging, retries, and appropriate notifications in case of deployment failures.

Specific to source_code_hash:

• Cache Busting: If you modify dependencies without changing your function's code, the hash might remain the same, preventing an update. Consider adding a version number or timestamp to your zip file name to force a hash change when needed.

Specific to null_resource:

• Trigger Granularity: You can configure multiple triggers within null_resource to monitor different files or resources. This allows for finer control over when to update your Lambda function.
• External Triggers: Consider using external data sources within null_resource to trigger updates based on events outside your Terraform code, such as a successful build in your CI/CD pipeline.

Specific to Deployment Packages:

• Package Tools: Utilize tools like AWS SAM or the Serverless Framework to streamline the creation and management of deployment packages. These tools often offer features like local testing and simplified dependency management.

Specific to Terraform Modules:

• Versioning: Implement versioning for your Terraform modules to track changes and ensure consistent deployments across different environments.
• Module Registry: Publish your reusable Lambda function modules to a private or public registry for easy sharing and collaboration within your organization or the wider community.

Security Best Practices:

• Least Privilege: Grant your Lambda function only the necessary permissions it needs to operate. Avoid using overly permissive IAM roles.
• Secrets Management: Store sensitive information, such as API keys or database credentials, securely using services like AWS Secrets Manager and access them within your Lambda function.

By incorporating these additional notes and best practices, you can establish a robust and efficient workflow for managing your Lambda function deployments with Terraform.

| Strategy | Description

By implementing these strategies and considering the additional notes, you can establish a robust and efficient workflow for managing your Lambda function deployments with Terraform, ensuring that your infrastructure code accurately reflects the state of your Lambda functions and updates are deployed automatically and reliably whenever the underlying code changes. This approach leads to more predictable deployments and allows you to focus on building and improving your applications.

• r/Terraform on Reddit: Lambda function vs Lambda code - trying to ... | Posted by u/Marquis77 - 11 votes and 19 comments
• Terraform lambda source_code_hash update with same code ... | Oct 5, 2018 ... This works for me and also doesn't trigger an update on the Lambda function when the code hasn't changed data "archive_file" "lambda_zip" ...
• Deploy and Update Lambda from S3 : r/Terraform | Posted by u/codeBabooon - 2 votes and 14 comments
• Ability to zip AWS Lambda function on the fly · Issue #8344 ... | Hi there, We're using small AWS Lambda functions to perform routine operations on our AWS infrastructure. We have separate aws_lambda module which contains configuration & source code of all our fu...
• Terraform AWS Lambda Function | undefined
• Lambda redeployment from S3 not publishing new code changes ... | Community Note Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request Please do not leave "+1" or other comments that d...
• Hard Lessons From Deploying Lambdas With Terraform ... | Because sometimes simple tasks require advanced techniques
• Multiple Lambda Triggers from one S3 Bucket · Issue #16131 ... | Terraform Version 0.10.2 Terraform Configuration Files resource "aws_s3_bucket_notification" "bucket_trigger_lambda" { count = "${length(var.s3_file_prefixs)}" bucket = "${var.s3_bucket_id}" lambda...
• Use Terraform to create an AWS Lambda function that runs your ... | In this guide, I will show you how to quickly set up infrastructure needed to deploy TypeScript code to an AWS Lambda function.