Workaround for hashicorp/terraform-provider-aws#7385

main.tf

@@ -1,50 +1,37 @@
-locals {
-  clean = "rm -rf ${path.module}/build/libs"
-  build = "pip install --upgrade ${join(" ", var.libraries)} --target ${path.module}/build/libs/python/lib/python${data.external.default.result.version}/site-packages/."
+data external python-version {
+  program = ["bash", "${path.module}/python_version.sh"]
 }
 
-resource null_resource default {
-  triggers = {
-    command = local.build
-  }
-
-  provisioner local-exec {
-    command = "${local.clean} && ${local.build}"
-  }
+data external pip-install {
+  program = concat(["bash", "${path.module}/pip_install.sh", data.external.python-version.result.version], var.libraries)
 }
 
 data archive_file default {
   output_path = "${path.module}/build/aws-lambda-python-layer.zip"
-  source_dir  = "${path.module}/build/libs"
+  source_dir  = data.external.pip-install.result.path
   type        = "zip"
+}
 
-  depends_on  = [null_resource.default]
+resource random_id default {
+  byte_length = 8
+
+  keepers = {
+    source_code_hash = data.archive_file.default.output_md5
+  }
 }
 
 resource aws_s3_bucket_object default {
   bucket = var.bucket
   source = data.archive_file.default.output_path
   key    = "python-layer-${random_id.default.b64_url}.zip"
-
-  etag   = data.archive_file.default.output_base64sha256
-}
-
-data external default {
-  program = ["bash", "${path.module}/python_version.sh"]
-}
-
-resource random_id default {
-  byte_length = 8
 }
 
 resource aws_lambda_layer_version default {
   s3_bucket  = var.bucket
   s3_key     = aws_s3_bucket_object.default.key
   layer_name = "python-layer-${random_id.default.b64_url}"
 
-  source_code_hash = data.archive_file.default.output_base64sha256
-
   compatible_runtimes = [
-    "python${data.external.default.result.version}"
+    "python${data.external.python-version.result.version}"
   ]
 }

pip_install.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+DIR="$(dirname "${BASH_SOURCE[0]}")/build/libs/python/lib/python$1/site-packages"
+shift
+pip install --quiet --disable-pip-version-check "$@" --target "$DIR"
+jq -n "{ path: \"$DIR\" }"