feat: automatic Lambda runtime detection from layer metadata

data.tf

@@ -70,6 +70,10 @@ locals {
   )
 }
 
+data "aws_lambda_layer_version" "this" {
+  layer_version_arn = local.default_layer_arn
+}
+
 # Deprecation warnings for conflicting API key configurations.
 # These will become hard validation errors in a future major release.
 check "dd_api_key_not_used_with_secret_arn" {

main.tf

@@ -199,7 +199,7 @@ resource "aws_lambda_function" "forwarder" {
   description   = "Pushes logs, metrics and traces from AWS to Datadog."
   role          = local.iam_role_arn
   handler       = "lambda_function.lambda_handler"
-  runtime       = var.layer_version == "latest" ? "python3.14" : (can(tonumber(var.layer_version)) && tonumber(var.layer_version) >= 94 ? "python3.14" : "python3.13")
+  runtime       = reverse(sort(tolist(data.aws_lambda_layer_version.this.compatible_runtimes)))[0]
   architectures = ["arm64"]
   memory_size   = var.memory_size
   timeout       = var.timeout

tests/create_api_key_secret_flag.tftest.hcl

@@ -23,6 +23,14 @@ mock_provider "aws" {
       dns_suffix = "amazonaws.com"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {

tests/default_config.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {
@@ -188,4 +196,3 @@ run "environment_variables_test" {
     error_message = "DD_API_KEY_SSM_NAME should not be present when using Secrets Manager"
   }
 }
-

tests/enhanced_features.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {

tests/enrich_fetch_variables.tftest.hcl

@@ -22,6 +22,14 @@ mock_provider "aws" {
       arn = "arn:aws:s3:::existing-datadog-bucket"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {

tests/existing_iam_role_without_bucket.tftest.hcl

@@ -20,6 +20,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Test: existing IAM role with SSM parameter (no bucket specified) - should work

tests/existing_resources.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {

tests/forwarder_version_tag.tftest.hcl

@@ -17,6 +17,16 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.12",
+        "python3.14",
+        "python3.13"
+      ]
+    }
+  }
 }
 
 variables {
@@ -45,6 +55,12 @@ run "version_tag_with_latest" {
     condition     = local.forwarder_version != null
     error_message = "local.forwarder_version should be set when using latest"
   }
+
+  # Layer runtime should be set to the latest version of compatible_runtimes
+  assert {
+    condition     = aws_lambda_function.forwarder.runtime == "python3.14"
+    error_message = "Lambda runtime should be python3.14"
+  }
 }
 
 # Test with specific layer_version
@@ -55,6 +71,15 @@ run "version_tag_with_specific_layer" {
     layer_version = "92"
   }
 
+  override_data {
+    target = data.aws_lambda_layer_version.this
+    values = {
+      compatible_runtimes = [
+        "python3.13",
+      ]
+    }
+  }
+
   # Lambda should have dd_forwarder_version tag
   assert {
     condition     = contains(keys(aws_lambda_function.forwarder.tags), "dd_forwarder_version")
@@ -72,6 +97,12 @@ run "version_tag_with_specific_layer" {
     condition     = can(regex(":92$", aws_lambda_function.forwarder.layers[0]))
     error_message = "Lambda layer ARN should end with :92"
   }
+
+  # Runtime should match the compatible_runtimes returned by the layer data source
+  assert {
+    condition     = aws_lambda_function.forwarder.runtime == "python3.13"
+    error_message = "Lambda runtime should be python3.13"
+  }
 }
 
 # Test that user tags are preserved alongside dd_forwarder_version
@@ -102,4 +133,3 @@ run "version_tag_with_user_tags" {
     error_message = "dd_forwarder_version tag should be added alongside user tags"
   }
 }
-

tests/multi_region.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {

tests/optional_env_vars.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {

tests/s3_log_bucket_arns.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Test: Default behavior - s3:GetObject should allow all buckets for backward compatibility

tests/secrets_management.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Path 1: dd_api_key only (auto-create secret)

tests/sqs_failed_events.tftest.hcl

@@ -18,6 +18,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 # Test: SQS URL auto-enables DD_STORE_FAILED_EVENTS and skips S3 bucket creation

tests/vpc_config.tftest.hcl

@@ -17,6 +17,14 @@ mock_provider "aws" {
       partition = "aws"
     }
   }
+
+  mock_data "aws_lambda_layer_version" {
+    defaults = {
+      compatible_runtimes = [
+        "python3.14",
+      ]
+    }
+  }
 }
 
 variables {