From cf3fc47bce341490c176f35597743f18316dfd46 Mon Sep 17 00:00:00 2001 From: Jinn Koriech Date: Tue, 23 Apr 2024 15:29:24 +0000 Subject: [PATCH] fix(lambda-permissions): create before destroy When any parameters contain dynamic elements, e.g. `data.aws_region.name`, and that is evaluated in an intermediate module, it is not known until apply time, which causes the permission to he removed and added. During this window, Cloudwatch Logs will see the errors and stop sending events for 10 minutes. By switching to a statement_id_prefix and using a create_before_destroy lifecycle we avoid such interruptions. --- main.tf | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/main.tf b/main.tf index 68c2f9b6..c479bc9a 100644 --- a/main.tf +++ b/main.tf @@ -273,13 +273,17 @@ resource "aws_lambda_permission" "current_version_triggers" { function_name = aws_lambda_function.this[0].function_name qualifier = aws_lambda_function.this[0].version - statement_id = try(each.value.statement_id, each.key) - action = try(each.value.action, "lambda:InvokeFunction") - principal = try(each.value.principal, format("%s.amazonaws.com", try(each.value.service, ""))) - principal_org_id = try(each.value.principal_org_id, null) - source_arn = try(each.value.source_arn, null) - source_account = try(each.value.source_account, null) - event_source_token = try(each.value.event_source_token, null) + statement_id_prefix = try(each.value.statement_id, each.key) + action = try(each.value.action, "lambda:InvokeFunction") + principal = try(each.value.principal, format("%s.amazonaws.com", try(each.value.service, ""))) + principal_org_id = try(each.value.principal_org_id, null) + source_arn = try(each.value.source_arn, null) + source_account = try(each.value.source_account, null) + event_source_token = try(each.value.event_source_token, null) + + lifecycle { + create_before_destroy = true + } } # Error: Error adding new Lambda Permission for lambda: InvalidParameterValueException: We currently do not support adding policies for $LATEST. @@ -288,13 +292,17 @@ resource "aws_lambda_permission" "unqualified_alias_triggers" { function_name = aws_lambda_function.this[0].function_name - statement_id = try(each.value.statement_id, each.key) - action = try(each.value.action, "lambda:InvokeFunction") - principal = try(each.value.principal, format("%s.amazonaws.com", try(each.value.service, ""))) - principal_org_id = try(each.value.principal_org_id, null) - source_arn = try(each.value.source_arn, null) - source_account = try(each.value.source_account, null) - event_source_token = try(each.value.event_source_token, null) + statement_id_prefix = try(each.value.statement_id, each.key) + action = try(each.value.action, "lambda:InvokeFunction") + principal = try(each.value.principal, format("%s.amazonaws.com", try(each.value.service, ""))) + principal_org_id = try(each.value.principal_org_id, null) + source_arn = try(each.value.source_arn, null) + source_account = try(each.value.source_account, null) + event_source_token = try(each.value.event_source_token, null) + + lifecycle { + create_before_destroy = true + } } resource "aws_lambda_event_source_mapping" "this" {