Skip to main content
Version: v1.4

AWS LAMBDA

Description

Terraform module, which takes care of a lot of AWS Lambda/serverless tasks (build dependencies, packages, updates, deployments) in countless combinations

Specification

Properties

NameDescriptionTypeRequiredDefault
allowed_triggersMap of allowed triggers to create Lambda permissionsmap(any)false
architecturesInstruction set architecture for your Lambda function. Valid values are ["x86_64"] and ["arm64"].list(string)false
artifacts_dirDirectory name where artifacts should be storedstringfalse
assume_role_policy_statementsMap of dynamic policy statements for assuming Lambda Function role (trust relationship)anyfalse
attach_async_event_policyControls whether async event policy should be added to IAM role for Lambda Functionboolfalse
attach_cloudwatch_logs_policyControls whether CloudWatch Logs policy should be added to IAM role for Lambda Functionboolfalse
attach_dead_letter_policyControls whether SNS/SQS dead letter notification policy should be added to IAM role for Lambda Functionboolfalse
attach_network_policyControls whether VPC/network policy should be added to IAM role for Lambda Functionboolfalse
attach_policiesControls whether list of policies should be added to IAM role for Lambda Functionboolfalse
attach_policyControls whether policy should be added to IAM role for Lambda Functionboolfalse
attach_policy_jsonControls whether policy_json should be added to IAM role for Lambda Functionboolfalse
attach_policy_jsonsControls whether policy_jsons should be added to IAM role for Lambda Functionboolfalse
attach_policy_statementsControls whether policy_statements should be added to IAM role for Lambda Functionboolfalse
attach_tracing_policyControls whether X-Ray tracing policy should be added to IAM role for Lambda Functionboolfalse
build_in_dockerWhether to build dependencies in Dockerboolfalse
cloudwatch_logs_kms_key_idThe ARN of the KMS Key to use when encrypting log data.stringfalse
cloudwatch_logs_retention_in_daysSpecifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.numberfalse
cloudwatch_logs_tagsA map of tags to assign to the resource.map(string)false
compatible_architecturesA list of Architectures Lambda layer is compatible with. Currently x86_64 and arm64 can be specified.list(string)false
compatible_runtimesA list of Runtimes this layer is compatible with. Up to 5 runtimes can be specified.list(string)false
createControls whether resources should be createdboolfalse
create_async_event_configControls whether async event configuration for Lambda Function/Alias should be createdboolfalse
create_current_version_allowed_triggersWhether to allow triggers on current version of Lambda Function (this will revoke permissions from previous version because Terraform manages only current resources)boolfalse
create_current_version_async_event_configWhether to allow async event configuration on current version of Lambda Function (this will revoke permissions from previous version because Terraform manages only current resources)boolfalse
create_functionControls whether Lambda Function resource should be createdboolfalse
create_layerControls whether Lambda Layer resource should be createdboolfalse
create_packageControls whether Lambda package should be createdboolfalse
create_roleControls whether IAM role for Lambda Function should be createdboolfalse
create_unqualified_alias_allowed_triggersWhether to allow triggers on unqualified alias pointing to $LATEST versionboolfalse
create_unqualified_alias_async_event_configWhether to allow async event configuration on unqualified alias pointing to $LATEST versionboolfalse
dead_letter_target_arnThe ARN of an SNS topic or SQS queue to notify when an invocation fails.stringfalse
descriptionDescription of your Lambda Function (or Layer)stringfalse
destination_on_failureAmazon Resource Name (ARN) of the destination resource for failed asynchronous invocationsstringfalse
destination_on_successAmazon Resource Name (ARN) of the destination resource for successful asynchronous invocationsstringfalse
docker_build_rootRoot dir where to build in Dockerstringfalse
docker_filePath to a Dockerfile when building in Dockerstringfalse
docker_imageDocker image to use for the buildstringfalse
docker_pip_cacheWhether to mount a shared pip cache folder into docker environment or notanyfalse
docker_with_ssh_agentWhether to pass SSH_AUTH_SOCK into docker environment or notboolfalse
environment_variablesA map that defines environment variables for the Lambda Function.map(string)false
ephemeral_storage_sizeAmount of ephemeral storage (/tmp) in MB your Lambda Function can use at runtime. Valid value between 512 MB to 10,240 MB (10 GB).numberfalse
event_source_mappingMap of event source mappinganyfalse
file_system_arnThe Amazon Resource Name (ARN) of the Amazon EFS Access Point that provides access to the file system.stringfalse
file_system_local_mount_pathThe path where the function can access the file system, starting with /mnt/.stringfalse
function_nameA unique name for your Lambda Functionstringfalse
handlerLambda Function entrypoint in your codestringfalse
hash_extraThe string to add into hashing function. Useful when building same source path for different functions.stringfalse
ignore_source_code_hashWhether to ignore changes to the function's source code hash. Set to true if you manage infrastructure and code deployments separately.boolfalse
image_config_commandThe CMD for the docker imagelist(string)false
image_config_entry_pointThe ENTRYPOINT for the docker imagelist(string)false
image_config_working_directoryThe working directory for the docker imagestringfalse
image_uriThe ECR image URI containing the function's deployment package.stringfalse
kms_key_arnThe ARN of KMS key to use by your Lambda Functionstringfalse
lambda_at_edgeSet this to true if using Lambda@Edge, to enable publishing, limit the timeout, and allow edgelambda.amazonaws.com to invoke the functionboolfalse
lambda_roleIAM role ARN attached to the Lambda Function. This governs both who / what can invoke your Lambda Function, as well as what resources our Lambda Function has access to. See Lambda Permission Model for more details.stringfalse
layer_nameName of Lambda Layer to createstringfalse
layer_skip_destroyWhether to retain the old version of a previously deployed Lambda Layer.boolfalse
layersList of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function.list(string)false
license_infoLicense info for your Lambda Layer. Eg, MIT or full url of a license.stringfalse
local_existing_packageThe absolute path to an existing zip-file to usestringfalse
maximum_event_age_in_secondsMaximum age of a request that Lambda sends to a function for processing in seconds. Valid values between 60 and 21600.numberfalse
maximum_retry_attemptsMaximum number of times to retry when the function returns an error. Valid values between 0 and 2. Defaults to 2.numberfalse
memory_sizeAmount of memory in MB your Lambda Function can use at runtime. Valid value between 128 MB to 10,240 MB (10 GB), in 64 MB increments.numberfalse
number_of_policiesNumber of policies to attach to IAM role for Lambda Functionnumberfalse
number_of_policy_jsonsNumber of policies JSON to attach to IAM role for Lambda Functionnumberfalse
package_typeThe Lambda deployment package type. Valid options: Zip or Imagestringfalse
policiesList of policy statements ARN to attach to Lambda Function rolelist(string)false
policyAn additional policy document ARN to attach to the Lambda Function rolestringfalse
policy_jsonAn additional policy document as JSON to attach to the Lambda Function rolestringfalse
policy_jsonsList of additional policy documents as JSON to attach to Lambda Function rolelist(string)false
policy_pathPath of policies to that should be added to IAM role for Lambda Functionstringfalse
policy_statementsMap of dynamic policy statements to attach to Lambda Function roleanyfalse
provisioned_concurrent_executionsAmount of capacity to allocate. Set to 1 or greater to enable, or set to 0 to disable provisioned concurrency.numberfalse
publishWhether to publish creation/change as new Lambda Function Version.boolfalse
putin_khuyloDo you agree that Putin doesn't respect Ukrainian sovereignty and territorial integrity? More info: https://en.wikipedia.org/wiki/Putin_khuylo!boolfalse
recreate_missing_packageWhether to recreate missing Lambda package if it is missing locally or notboolfalse
reserved_concurrent_executionsThe amount of reserved concurrent executions for this Lambda Function. A value of 0 disables Lambda Function from being triggered and -1 removes any concurrency limitations. Defaults to Unreserved Concurrency Limits -1.numberfalse
role_descriptionDescription of IAM role to use for Lambda Functionstringfalse
role_force_detach_policiesSpecifies to force detaching any policies the IAM role has before destroying it.boolfalse
role_nameName of IAM role to use for Lambda Functionstringfalse
role_pathPath of IAM role to use for Lambda Functionstringfalse
role_permissions_boundaryThe ARN of the policy that is used to set the permissions boundary for the IAM role used by Lambda Functionstringfalse
role_tagsA map of tags to assign to IAM rolemap(string)false
runtimeLambda Function runtimestringfalse
s3_aclThe canned ACL to apply. Valid values are private, public-read, public-read-write, aws-exec-read, authenticated-read, bucket-owner-read, and bucket-owner-full-control. Defaults to private.stringfalse
s3_bucketS3 bucket to store artifactsstringfalse
s3_existing_packageThe S3 bucket object with keys bucket, key, version pointing to an existing zip-file to usemap(string)false
s3_object_storage_classSpecifies the desired Storage Class for the artifact uploaded to S3. Can be either STANDARD, REDUCED_REDUNDANCY, ONEZONE_IA, INTELLIGENT_TIERING, or STANDARD_IA.stringfalse
s3_object_tagsA map of tags to assign to S3 bucket object.map(string)false
s3_object_tags_onlySet to true to not merge tags with s3_object_tags. Useful to avoid breaching S3 Object 10 tag limit.boolfalse
s3_prefixDirectory name where artifacts should be stored in the S3 bucket. If unset, the path from artifacts_dir is usedstringfalse
s3_server_side_encryptionSpecifies server-side encryption of the object in S3. Valid values are "AES256" and "aws:kms".stringfalse
source_pathThe absolute path to a local file or directory containing your Lambda source codeanyfalse
store_on_s3Whether to store produced artifacts on S3 or locally.boolfalse
tagsA map of tags to assign to resources.map(string)false
timeoutThe amount of time your Lambda Function has to run in seconds.numberfalse
tracing_modeTracing mode of the Lambda Function. Valid value can be either PassThrough or Active.stringfalse
trusted_entitiesList of additional trusted entities for assuming Lambda Function role (trust relationship)anyfalse
use_existing_cloudwatch_log_groupWhether to use an existing CloudWatch log group or create newboolfalse
vpc_security_group_idsList of security group ids when Lambda Function should run in the VPC.list(string)false
vpc_subnet_idsList of subnet ids when Lambda Function should run in the VPC. Usually private or intra subnets.list(string)false
writeConnectionSecretToRefThe secret which the cloud resource connection will be written towriteConnectionSecretToReffalse

writeConnectionSecretToRef

NameDescriptionTypeRequiredDefault
nameThe secret name which the cloud resource connection will be written tostringtrue
namespaceThe secret namespace which the cloud resource connection will be written tostringfalse