mobile file icon

README.md

close sidebar menu icon

Browse the Repo

file-type-icon.circleci
file-type-iconexamples
file-type-iconmodules
file-type-iconkeep-warm
file-type-iconlambda-edge
file-type-iconlambda
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvars.tf
file-type-iconscheduled-lambda-job
file-type-icontest
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.md
file-type-iconowners.txt
file-type-iconterraform-cloud-enterprise-private-module-...

Browse the Repo

file-type-icon.circleci
file-type-iconexamples
file-type-iconmodules
file-type-iconkeep-warm
file-type-iconlambda-edge
file-type-iconlambda
file-type-iconREADME.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvars.tf
file-type-iconscheduled-lambda-job
file-type-icontest
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconLICENSE.txt
file-type-iconREADME.md
file-type-iconowners.txt
file-type-iconterraform-cloud-enterprise-private-module-...
AWS Lambda

AWS Lambda

Deploy Lambda functions with Terraform. Supports uploading deployment packages, configuring environment variables, and scheduled functions.

Code Preview

View on GitHub:

https://github.com/gruntwork-i...da/tree/v0.10.1/modules/lambda

Preview the Code

mobile file icon

README.md

down

Lambda Function Module

This module makes it easy to deploy and manage an AWS Lambda function. Lambda gives you a way to run code on-demand in AWS without having to manage servers.

How do you use this module?

  • See the root README for instructions on using Terraform modules.
  • See the lambda-s3 example folder for sample usage.
  • See vars.tf for all the variables you can set on this module.

The general idea is to:

  1. Create a folder that contains your source code in one of the supported languages: Python, JavaScript, Java, etc (see Lambda programming model for the complete list).
  2. Use this lambda module to automatically zip that folder, upload it to AWS, and configure it as a Lambda function.
  3. Trigger your Lambda function using one of the following options:
    1. AWS Console UI.
    2. AWS API.
    3. AWS CLI.
    4. API Gateway API you expose.
    5. An event source, such as a new message on an SNS topic or a new file uploaded to S3.

What is AWS Lambda?

AWS Lambda lets you run code without provisioning or managing servers. You define a function in a supported language (currently: Python, JavaScript, Java, and C#), upload the code to Lambda, specify how that function can be triggered, and then AWS Lambda takes care of all the details of deploying and scaling the infrastructure to run that code.

How do you add additional IAM policies and permissions?

By default, the lambda module configures your lambda function with an IAM role that allows it to write logs to CloudWatch Logs. The ID of the IAM role is exported as the output iam_role_id and the ID of the lambda function is exported as the output function_arn, so you can add custom rules using the aws_iam_role_policy or aws_lambda_permission resources, respectively. For example, to allow your lambda function to be triggered by SNS:

module "my_lambda_function" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-lambda.git//modules/lambda?ref=v1.0.8"
  # (params omitted)
}

resource "aws_lambda_permission" "with_sns" {
  statement_id = "AllowExecutionFromSNS"
  action = "lambda:InvokeFunction"
  function_name = "${module.my_lambda_function.function_arn}"
  principal = "sns.amazonaws.com"
  source_arn = "${aws_sns_topic.default.arn}"
}

How do you give the lambda function access to a VPC?

By default, your Lambda functions do not have access to your VPCs or subnets. If the lambda function needs to be able to talk to something directly within your VPC, you need to:

  1. Set the run_in_vpc parameter to true.
  2. Specify the ID of the VPC your Lambda function should be able to access via the vpc_id parameter.
  3. Specify the IDs of the subnets your Lambda function should be able to access via the subnet_ids parameter.

Here's an example:

module "my_lambda_function" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-lambda.git//modules/lambda?ref=v1.0.8"
  
  run_in_vpc = true
  vpc_id = "${data.terraform_remote_state.vpc.id}"
  subnet_ids = "${data.terraform_remote_state.vpc.private_app_subnet_ids}"
  
  # (other params omitted)
}

When you set run_in_vpc to true, this module also creates a Security Group for your Lambda function. By default, this security group does not allow any inbound or outbound requests, so if the Lambda function needs to make requests to the outside world, you will need to add the corresponding rules to that security group (its ID is available as the output variable security_group_id):

module "my_lambda_function" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-lambda.git//modules/lambda?ref=v1.0.8"
  
  run_in_vpc = true
  vpc_id = "${data.terraform_remote_state.vpc.id}"
  subnet_ids = "${data.terraform_remote_state.vpc.private_app_subnet_ids}"
  
  # (other params omitted)
}

resource "aws_security_group_rule" "allow_all_outbound_to_vpc" {
  type = "egress"
  from_port = 0
  to_port = 0
  protocol = "-1"
  cidr_blocks = ["${data.terraform_remote_state.vpc.vpc_cidr_block}"]
  security_group_id = "${module.my_lambda_function.security_group_id}"
}

Check out the lambda-vpc example for working sample code. Make sure to note the Known Issues section in that example's README.

How do you share Lambda functions across multiple AWS accounts?

If you want to have a central S3 bucket that you use as a repository for your Lambda functions in one AWS account (e.g., shared-services) and you want to allow all the other accounts (e.g., dev, stage, prod) to access that S3 bucket, you need to do the following:

  1. In the shared-services account, add a bucket policy to allow access to the bucket from other AWS accounts:
    {
   "Version": "2012-10-17",
   "Statement": [
       {
           "Sid": "ReadOnlyAccessForExternalAccounts",
           "Effect": "Allow",
           "Principal": {
               "AWS": [
                   "arn:aws:iam::222222222222:root",
                   "arn:aws:iam::333333333333:root",
                   "arn:aws:iam::444444444444:root"                       
               ]
           },
           "Action": [
               "s3:GetObjectVersion",
               "s3:GetObject"
           ],
           "Resource": "arn:aws:s3:::bucket-name/*"
       }
   ]
}
    s3:GetObjectVersion is only required if you want to use s3 object versioning when deploying lambdas. You also need to enable bucket versioning in such case.
  2. If you want to enable encryption for S3 objects you must use a customer master key, or CMK (see the kms-master-key module) rather than the default key, and ensure that both the shared-services account and all the other accounts (dev, stage, prod) have access to that CMK.
  3. The IAM User or IAM Role which will be running terraform apply for the other accounts (dev, stage, prod) must also be explicitly granted access to the S3 bucket in (1) and the CMK in (2).

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Contact Us

Ready to hand off the Gruntwork?

Buy Now