[Bug]: aws_lambda_function resource causing plugin not to respond.

[lawrencellui]

Terraform Core Version

1.2.3

AWS Provider Version

5.0.0_x5

Affected Resource(s)

aws_lambda_function

Expected Behavior

Should provision the lambda function resource.

Actual Behavior

Error: Plugin did not respond

│ The plugin encountered an error, and failed to respond to the
│ plugin.(*GRPCProvider).ApplyResourceChange call. The plugin logs may
│ contain more details.

Relevant Error/Panic Output Snippet

panic: value is null

goroutine 377 [running]:
github.com/hashicorp/go-cty/cty.Value.AsString({{{0xf099650?, 0xc0002ea291?}}, {0x0?, 0x0?}})
	github.com/hashicorp/go-cty@v1.4.1-0.20200414143053-d3edf31b6320/cty/value_ops.go:1176 +0x125
github.com/hashicorp/terraform-provider-aws/internal/tags.KeyValueTags.ResolveDuplicates(0xc005b27950?, {0xf098620, 0xc005b27950}, 0x0, 0xdbcecdb?, {0x7f9a7d54cbb8, 0xc005343680})
	github.com/hashicorp/terraform-provider-aws/internal/tags/key_value_tags.go:783 +0x649
github.com/hashicorp/terraform-provider-aws/internal/provider.tagsInterceptor.run({0xc001521520?, 0xde5c750?, 0xde5c748?}, {0xf098620, 0xc005b27950}, {0xf0a7648, 0xc005343680}, {0xdb852a0?, 0xc001442000?}, 0x2, ...)
	github.com/hashicorp/terraform-provider-aws/internal/provider/intercept.go:350 +0x99e
github.com/hashicorp/terraform-provider-aws/internal/provider.interceptedHandler[...].func1(0x0?, {0xdb852a0?, 0xc001442000?})
	github.com/hashicorp/terraform-provider-aws/internal/provider/intercept.go:117 +0x343
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).update(0xf098620?, {0xf098620?, 0xc005afd440?}, 0xd?, {0xdb852a0?, 0xc001442000?})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.26.1/helper/schema/resource.go:736 +0x87
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*Resource).Apply(0xc00087eee0, {0xf098620, 0xc005afd440}, 0xc0054ab450, 0xc005343500, {0xdb852a0, 0xc001442000})
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.26.1/helper/schema/resource.go:847 +0x83a
github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema.(*GRPCProviderServer).ApplyResourceChange(0xc0019cec60, {0xf098620?, 0xc005afd320?}, 0xc002152500)
	github.com/hashicorp/terraform-plugin-sdk/v2@v2.26.1/helper/schema/grpc_provider.go:1021 +0xe8d
github.com/hashicorp/terraform-plugin-mux/tf5muxserver.muxServer.ApplyResourceChange({0xc0025325a0, 0xc002532600, {0xc00652ad40, 0x2, 0x2}, {0x0, 0x0, 0x0}, {0x0, 0x0, ...}, ...}, ...)
	github.com/hashicorp/terraform-plugin-mux@v0.10.0/tf5muxserver/mux_server_ApplyResourceChange.go:27 +0x102
github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server.(*server).ApplyResourceChange(0xc002a212c0, {0xf098620?, 0xc005af2e40?}, 0xc005488460)
	github.com/hashicorp/terraform-plugin-go@v0.15.0/tfprotov5/tf5server/server.go:818 +0x574
github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5._Provider_ApplyResourceChange_Handler({0xd8701e0?, 0xc002a212c0}, {0xf098620, 0xc005af2e40}, 0xc0054883f0, 0x0)
	github.com/hashicorp/terraform-plugin-go@v0.15.0/tfprotov5/internal/tfplugin5/tfplugin5_grpc.pb.go:419 +0x170
google.golang.org/grpc.(*Server).processUnaryRPC(0xc005f565a0, {0xf0a8e60, 0xc00660eb60}, 0xc0054e70e0, 0xc00656de90, 0x15cf3500, 0x0)
	google.golang.org/grpc@v1.54.0/server.go:1345 +0xdf0
google.golang.org/grpc.(*Server).handleStream(0xc005f565a0, {0xf0a8e60, 0xc00660eb60}, 0xc0054e70e0, 0x0)
	google.golang.org/grpc@v1.54.0/server.go:1722 +0xa2f
google.golang.org/grpc.(*Server).serveStreams.func1.2()
	google.golang.org/grpc@v1.54.0/server.go:966 +0x98
created by google.golang.org/grpc.(*Server).serveStreams.func1
	google.golang.org/grpc@v1.54.0/server.go:964 +0x28a

Terraform Configuration Files

resource "aws_lambda_function" "main" {
  function_name                  = local.lambda_display_name
  filename                       = var.is_image || var.lambda_s3_sha256 != null ? null : local.lambda_source
  image_uri                      = var.is_image ? "${aws_ecr_repository.main[0].repository_url}@${data.aws_ecr_image.main[0].id}" : null
  s3_bucket                      = var.lambda_s3_bucket != null ? var.lambda_s3_bucket : null
  s3_key                         = var.lambda_s3_key != null ? var.lambda_s3_key : null
  source_code_hash               = var.is_image ? null : var.lambda_s3_sha256 != null ? base64encode(var.lambda_s3_sha256) : filebase64sha256(local.lambda_source)
  description                    = var.lambda_description != null ? var.lambda_description : local.lambda_display_name
  handler                        = var.is_image ? null : var.lambda_handler
  runtime                        = var.is_image ? null : var.lambda_runtime
  memory_size                    = var.lambda_memory
  reserved_concurrent_executions = var.lambda_reserved_concurrency
  timeout                        = var.lambda_timeout
  publish                        = var.lambda_publish
  role                           = var.system != null ? data.aws_iam_role.system[0].arn : aws_iam_role.lambda[0].arn
  kms_key_arn                    = null
  package_type                   = var.is_image ? "Image" : "Zip"

  layers = var.is_image ? null : concat([
    for layer_arn in data.aws_lambda_layer_version.main.*.arn :
    layer_arn
    if var.lambda_layers != null
  ], local.insights_arns)

  tracing_config {
    mode = var.lambda_tracing_config
  }

  dynamic ephemeral_storage {
    for_each = var.lambda_ephemeral_storage == null ? [] : [var.lambda_ephemeral_storage]
    content {
      size = var.lambda_ephemeral_storage
    }
  }

  dynamic "vpc_config" {
    for_each = local.lambda_vpc_config == null ? [] : [local.lambda_vpc_config]
    content {
      subnet_ids         = vpc_config.value.subnet_ids
      security_group_ids = vpc_config.value.security_group_ids
    }
  }

  /*
  dynamic dead_letter_config {
    for_each = local.dead_letter_config == null ? [] : [local.dead_letter_config]
    content {
      target_arn = dead_letter_config.value.target_arn
    }
  }
  */

  dynamic "environment" {
    for_each = length(local.lambda_environment) == 0 ? [] : [local.lambda_environment]
    content {
      variables = local.lambda_environment
    }
  }

  tags = merge(
    module.tags.common_tags,
    local.tags,
    {
      Name                = local.lambda_display_name
      "fq:module"         = "lambda-platform"
      "fq:module-version" = local.module_version
      "fq:commit-hash"    = data.external.git_checkout.result.sha
    }
  )
}

locals {
  account        = data.aws_caller_identity.current.account_id
  module_version = "2.4.0"
  insights_arns = var.lambda_insights_config ? [local.lambda_insights_arns[var.aws_region]] : []
}


data "external" "git_checkout" {
  program = ["${path.module}/scripts/get_sha.sh"]
}

vars.tf

variable system {
  type        = string
  default     = null
}

variable app {
  type        = string
  default     = null
}

variable env {
  type        = string
}

variable pod {
  type        = string
}

variable repo {
  type        = string
}

variable aws_region {
  description = "AWS region to deploy into"
  type        = string
  default     = "us-west-2"
}

variable "vpc_name" {
  description =  "vpc name to deploy into, ex: auxiliary"
  type = string
  default = "auxiliary"
}

locals {
  app = var.app != null ? var.app : var.lambda_name
  tags = {
    "fq:Module" = "lambda-platform"
    "fq:System" = var.system
  }
  standalone_sg = var.vpc_name == "security" ? "fq-security-standalone-lambdas-sg" : "fq-standalone-lambdas-sg"
}

Steps to Reproduce

terraform apply. Seems to be happening on updates to the lambda.

Debug Output

No response

Panic Output

No response

Important Factoids

This worked with the previous 4.x provider. Seems to be happening when tags are not changing. When tags are changing during the run, we don't get the panic.

References

No response

Would you like to implement a fix?

Yes

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[ericdahl]

I'm seeing the same issue and similar stack trace when Applying changes to IAM roles/policies using v5 provider (not Lambda)

[ericdahl]

I can also reproduce this error with a simpler test case, unrelated to Lambda:

provider "aws" {
  region = "us-east-1"
}

variable "foobar" {
    default = null
}

resource "aws_sqs_queue" "queue" {
    tags = {
        Foobar = var.foobar
    }
}

and the resulting error from terraform apply:

tack trace from the terraform-provider-aws_v5.0.0_x5 plugin:

panic: value is null

goroutine 369 [running]:
github.com/hashicorp/go-cty/cty.Value.AsString({{{0xfc98bf0?, 0xc0001a9e91?}}, {0x0?, 0x0?}})
	github.com/hashicorp/go-cty@v1.4.1-0.20200414143053-d3edf31b6320/cty/value_ops.go:1176 +0x125
github.com/hashicorp/terraform-provider-aws/internal/tags.KeyValueTags.ResolveDuplicates(0xc006afe2d4?, {0xfc97bc0, 0xc00810c7b0}, 0x0, 0xc000288c00?, {0x4456b3a8, 0xc000e7a980})
	github.com/hashicorp/terraform-provider-aws/internal/tags/key_value_tags.go:783 +0x649
github.com/hashicorp/terraform-provider-aws/internal/provider.tagsInterceptor.run({0xc0027e9b60?, 0xea5bd80?, 0xea5bd78?}, {0xfc97bc0, 0xc00810c7b0}, {0xfca6c68, 0xc000e7a980}, {0xe784e00?, 0xc000288c00?}, 0x2, ...)
...

(edit) We use null value tags for optional tags that can be provided into modules. With v4 it would silently omit the null tags as expected

[github-actions]

This functionality has been released in v5.0.1 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.