Skip to content

thisismana/terraform-aws-lambda

BranchesTags
 
 

Repository files navigation

AWS Lambda Terraform module

Terraform Module Registry Terraform Version License: MIT

Terraform module to create AWS Lambda and accompanying resources for an efficient and secure development of Lambda functions like:

  • inline declaration of triggers for DynamodDb, EventBridge (CloudWatch Events), Kinesis, SNS or SQS including all required permissions
  • IAM role with permissions following the principle of least privilege
  • CloudWatch Logs and Lambda Insights configuration
  • blue/green deployments with AWS CodePipeline and CodeDeploy

Features

History

Implementation of this module started at Spring Media/Welt. Users of spring-media/lambda/aws should migrate to this module as a drop-in replacement to benefit from new features and bugfixes.

How do I use this module?

The module can be used for all runtimes supported by AWS Lambda.

Deployment packages can be specified either directly as a local file (using the filename argument), indirectly via Amazon S3 (using the s3_bucket, s3_key and s3_object_versions arguments) or using container images (using image_uri and package_type arguments), see documentation for details.

simple

see example for details

provider "aws" {
  region = "eu-west-1"
}

module "lambda" {
  source           = "moritzzimmer/lambda/aws"
  version          = "5.15.1"

  filename         = "my-package.zip"
  function_name    = "my-function"
  handler          = "my-handler"
  runtime          = "go1.x"
  source_code_hash = filebase64sha256("${path.module}/my-package.zip")
}

using container images

see example for details

module "lambda" {
  source        = "moritzzimmer/lambda/aws"
  version       = "5.15.1"

  function_name = "my-function"
  image_uri     = "111111111111.dkr.ecr.eu-west-1.amazonaws.com/my-image"
  package_type  = "Image"
}

with Amazon EventBridge (CloudWatch Events) rules

CloudWatch Event Rules to trigger your Lambda function by EventBridge patterns or on a regular, scheduled basis can be declared inline. The module will create the required Lambda permissions automatically.

see example for details

module "lambda" {
  // see above

  cloudwatch_event_rules = {
    scheduled = {
      schedule_expression = "rate(1 minute)"

      // optionally overwrite arguments like 'description'
      // from https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule
      description = "Triggered by CloudTrail"

      // optionally overwrite `cloudwatch_event_target_arn` in case an alias should be used for the event rule
      cloudwatch_event_target_arn = aws_lambda_alias.example.arn
    }

    pattern = {
      event_pattern = <<PATTERN
      {
        "detail-type": [
          "AWS Console Sign In via CloudTrail"
        ]
      }
      PATTERN
    }
  }
}

with event source mappings

Event Source Mappings to trigger your Lambda function by DynamoDb, Kinesis and SQS can be declared inline. The module will add the required read-only IAM permissions depending on the event source type to the function role automatically. In addition, permissions to send discarded batches to SNS or SQS will be added automatically, if destination_arn_on_failure is configured.

see examples for details

module "lambda" {
  // see above

  event_source_mappings = {
    table_1 = {
      event_source_arn  = aws_dynamodb_table.table_1.stream_arn

      // optionally overwrite arguments like 'batch_size'
      // from https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping
      batch_size        = 50
      starting_position = "LATEST"

      // optionally configure a SNS or SQS destination for discarded batches, required IAM
      // permissions will be added automatically by this module,
      // see https://docs.aws.amazon.com/lambda/latest/dg/invocation-eventsourcemapping.html
      destination_arn_on_failure = aws_sqs_queue.errors.arn

      // optionally overwrite function_name in case an alias should be used in the
      // event source mapping, see https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html
      function_name = aws_lambda_alias.example.arn
    }

    table_2 = {
      event_source_arn = aws_dynamodb_table.table_2.stream_arn
    }
  }
}

with SNS subscriptions

SNS Topic Subscriptions to trigger your Lambda function by SNS can de declared inline. The module will create the required Lambda permissions automatically.

see example for details

module "lambda" {
  // see above

  sns_subscriptions = {
    topic_1 = {
      topic_arn = aws_sns_topic.topic_1.arn

      // optionally overwrite `endpoint` in case an alias should be used for the SNS subscription
      endpoint  = aws_lambda_alias.example.arn
    }

    topic_2 = {
      topic_arn = aws_sns_topic.topic_2.arn
    }
  }
}

with access to AWS Systems Manager Parameter Store

Required IAM permissions to get parameter(s) from AWS Systems Manager Parameter Store (by path or name) can added to the Lambda role:

module "lambda" {
  // see above

  ssm = {
      parameter_names = [aws_ssm_parameter.string.name, aws_ssm_parameter.secure_string.name]
  }
}

with CloudWatch Logs configuration

The module will create a CloudWatch Log Group for your Lambda function.

The retention period and a CloudWatch Logs subscription filter (e.g. to stream logs to Amazon Elasticsearch Service) including required permissions can be declared inline:

module "lambda" {
  // see above

  log_retention_in_days     = 7
  logfilter_destination_arn = "arn:aws:lambda:eu-west-1:647379381847:function:cloudwatch_logs_to_es_production"
}

with CloudWatch Lambda Insights

Amazon CloudWatch Lambda Insights can be enabled for zip and image function deployment packages of these runtimes:

module "lambda" {
  // see above

  cloudwatch_lambda_insights_enabled = true
}

This module will add the required IAM permissions to the function role automatically for both package types.

In case of a zip deployment package, this module will also add the appropriate extension layer to your function (use cloudwatch_lambda_insights_extension_version to set the version of this layer).

For image deployment packages, the Lambda Insights extension needs to be added to the container image:

FROM public.ecr.aws/lambda/nodejs:12

RUN curl -O https://lambda-insights-extension.s3-ap-northeast-1.amazonaws.com/amazon_linux/lambda-insights-extension.rpm && \
    rpm -U lambda-insights-extension.rpm && \
    rm -f lambda-insights-extension.rpm

COPY app.js /var/task/

Deployments

Controlled, blue/green deployments of Lambda functions with (automatic) rollbacks and traffic shifting can be implemented using Lambda aliases and AWS CodeDeploy.

The optional deployment submodule can be used to create the required AWS resources and permissions for creating and starting such CodeDeploy deployments as part of an AWS CodePipeline, see examples for details.

Examples

Bootstrap new projects

In case you are using go for developing your Lambda functions, you can also use func to bootstrap your project and get started quickly.

How do I contribute to this module?

Contributions are very welcome! Check out the Contribution Guidelines for instructions.

How is this module versioned?

This Module follows the principles of Semantic Versioning. You can find each new release in the releases page.

During initial development, the major version will be 0 (e.g., 0.x.y), which indicates the code does not yet have a stable API. Once we hit 1.0.0, we will make every effort to maintain a backwards compatible API and use the MAJOR, MINOR, and PATCH versions on each release to indicate any incompatibilities.

Requirements

Name Version
terraform >= 0.12.0
aws >= 3.19

Providers

Name Version
aws 3.54.0

Modules

Name Source Version
event-cloudwatch ./modules/event/cloudwatch-event n/a
event-dynamodb ./modules/event/dynamodb n/a
event-kinesis ./modules/event/kinesis n/a
event-s3 ./modules/event/s3 n/a
event-sns ./modules/event/sns n/a
event-sqs ./modules/event/sqs n/a
lambda ./modules/lambda n/a

Resources

Name Type
aws_cloudwatch_event_rule.lambda resource
aws_cloudwatch_event_target.lambda resource
aws_cloudwatch_log_group.lambda resource
aws_cloudwatch_log_subscription_filter.cloudwatch_logs_to_es resource
aws_iam_policy.event_sources resource
aws_iam_policy.kms_policy resource
aws_iam_policy.ssm resource
aws_iam_policy.ssm_policy resource
aws_iam_role_policy_attachment.event_sources resource
aws_iam_role_policy_attachment.kms_policy_attachment resource
aws_iam_role_policy_attachment.ssm resource
aws_iam_role_policy_attachment.ssm_policy_attachment resource
aws_lambda_event_source_mapping.event_source resource
aws_lambda_permission.cloudwatch_events resource
aws_lambda_permission.cloudwatch_logs resource
aws_lambda_permission.sns resource
aws_sns_topic_subscription.subscription resource
aws_caller_identity.current data source
aws_iam_policy_document.event_sources data source
aws_iam_policy_document.kms_policy_document data source
aws_iam_policy_document.ssm data source
aws_iam_policy_document.ssm_policy_document data source
aws_region.current data source

Inputs

Name Description Type Default Required
cloudwatch_event_rules Creates EventBridge (CloudWatch Events) rules invoking your Lambda function. Required Lambda invocation permissions will be generated. map(any) {} no
cloudwatch_lambda_insights_enabled Enable CloudWatch Lambda Insights for your Lambda function. bool false no
cloudwatch_lambda_insights_extension_version Version of the Lambda Insights extension for Lambda functions using zip deployment packages, see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Lambda-Insights-extension-versions.html. number 14 no
description Description of what your Lambda Function does. string "" no
environment Environment (e.g. env variables) configuration for the Lambda function enable you to dynamically pass settings to your function code and libraries 
object({
    variables = map(string)
  })
 null no
event (deprecated - use cloudwatch_event_rules [EventBridge/CloudWatch Events], event_source_mappings [DynamoDb, Kinesis, SQS] or sns_subscriptions [SNS] instead) Event source configuration which triggers the Lambda function. Supported events: cloudwatch-scheduled-event, dynamodb, kinesis, s3, sns, sqs map(string) {} no
event_source_mappings Creates event source mappings to allow the Lambda function to get events from Kinesis, DynamoDB and SQS. The IAM role of this Lambda function will be enhanced with necessary minimum permissions to get those events. any {} no
filename The path to the function's deployment package within the local filesystem. If defined, The s3_-prefixed options and image_uri cannot be used. string null no
function_name A unique name for your Lambda Function. string n/a yes
handler The function entrypoint in your code. string "" no
ignore_external_function_updates Ignore updates to your Lambda function executed externally to the Terraform lifecycle. Set this to true if you're using CodeDeploy, aws CLI or other external tools to update your Lambda function code. bool false no
image_config The Lambda OCI image configurations block with three (optional) arguments:

- entry_point - The ENTRYPOINT for the docker image (type list(string)).
- command - The CMD for the docker image (type list(string)).
- working_directory - The working directory for the docker image (type string).		 any {} no
image_uri The ECR image URI containing the function's deployment package. Conflicts with filename, s3_bucket, s3_key, and s3_object_version. string null no
kms_key_arn Amazon Resource Name (ARN) of the AWS Key Management Service (KMS) key that is used to encrypt environment variables. If this configuration is not provided when environment variables are in use, AWS Lambda uses a default service key. If this configuration is provided when environment variables are not in use, the AWS Lambda API does not save this configuration and Terraform will show a perpetual difference of adding the key. To fix the perpetual difference, remove this configuration. string "" no
lambda_at_edge Enable Lambda@Edge for your Node.js or Python functions. Required trust relationship and publishing of function versions will be configured. bool false no
layers List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. list(string) [] no
log_retention_in_days Specifies the number of days you want to retain log events in the specified log group. number 14 no
logfilter_destination_arn The ARN of the destination to deliver matching log events to. Kinesis stream or Lambda function ARN. string "" no
memory_size Amount of memory in MB your Lambda Function can use at runtime. number 128 no
package_type The Lambda deployment package type. Valid values are Zip and Image. string "Zip" no
publish Whether to publish creation/change as new Lambda Function Version. bool false no
reserved_concurrent_executions The amount of reserved concurrent executions for this lambda function. A value of 0 disables lambda from being triggered and -1 removes any concurrency limitations. number -1 no
runtime The runtime environment for the Lambda function you are uploading. string "" no
s3_bucket The S3 bucket location containing the function's deployment package. Conflicts with filename and image_uri. This bucket must reside in the same AWS region where you are creating the Lambda function. string null no
s3_key The S3 key of an object containing the function's deployment package. Conflicts with filename and image_uri. string null no
s3_object_version The object version containing the function's deployment package. Conflicts with filename and image_uri. string null no
sns_subscriptions Creates subscriptions to SNS topics which trigger your Lambda function. Required Lambda invocation permissions will be generated. map(any) {} no
source_code_hash Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either filename or s3_key. The usual way to set this is filebase64sha256('file.zip') where 'file.zip' is the local filename of the lambda function source archive. string "" no
ssm List of AWS Systems Manager Parameter Store parameter names. The IAM role of this Lambda function will be enhanced with read permissions for those parameters. Parameters must start with a forward slash and can be encrypted with the default KMS key. 
object({
    parameter_names = list(string)
  })
 null no
ssm_parameter_names DEPRECATED: use ssm object instead. This variable will be removed in version 6 of this module. (List of AWS Systems Manager Parameter Store parameters this Lambda will have access to. In order to decrypt secure parameters, a kms_key_arn needs to be provided as well.) list [] no
tags A mapping of tags to assign to the Lambda function and all resources supporting tags. map(string) {} no
timeout The amount of time your Lambda Function has to run in seconds. number 3 no
tracing_config_mode Tracing config mode of the Lambda function. Can be either PassThrough or Active. string null no
vpc_config Provide this to allow your function to access your VPC (if both 'subnet_ids' and 'security_group_ids' are empty then vpc_config is considered to be empty or unset, see https://docs.aws.amazon.com/lambda/latest/dg/vpc.html for details). 
object({
    security_group_ids = list(string)
    subnet_ids         = list(string)
  })
 null no

Outputs

Name Description
arn The Amazon Resource Name (ARN) identifying your Lambda Function.
cloudwatch_log_group_arn The Amazon Resource Name (ARN) identifying the CloudWatch log group used by your Lambda function.
cloudwatch_log_group_name The name of the CloudWatch log group used by your Lambda function.
function_name The unique name of your Lambda Function.
invoke_arn The ARN to be used for invoking Lambda Function from API Gateway - to be used in aws_api_gateway_integration's uri
role_name The name of the IAM role attached to the Lambda Function.
version Latest published version of your Lambda Function.

About

A Terraform module to create AWS Lambda ressources.

registry.terraform.io/modules/moritzzimmer/lambda/aws

Resources

Readme

License

MIT license

Contributing

Contributing
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

78 tags

Packages

No packages published

Languages

  • HCL 94.4%
  • Makefile 3.1%
  • Go 2.5%