Ben's Terraform AWS Lambda Module

This is how I do it.

Explore the docs »

Report Bug . Request Feature

About The Project

TODO

Usage

TODO

Version Constraints

This module uses pessimistic version constraints (~>) for its providers to ensure predictable behavior across deployments:

required_providers {
  aws = {
    source  = "hashicorp/aws"
    version = "~> 6.0" # Allows 6.x, prevents 7.0
  }
}

Why pessimistic constraints?

• Prevents unexpected breaking changes from major provider updates
• Ensures consistent behavior across environments
• Makes upgrade impact predictable and controllable

When AWS provider v7.0 releases, this module will require an update to support it. That is intentional — we prefer explicit, tested upgrades over automatic major version bumps.

For consuming this module, you can use any AWS provider version that satisfies both your requirements and this module's constraints. Terraform's dependency resolver will find a compatible version automatically.

Requirements

Name	Version
terraform	>= 1.3.0
aws	~> 6.0

Providers

Name	Version
aws	~> 6.0

Modules

Name	Source	Version
label	bendoerr-terraform-modules/label/null	1.0.1

Resources

Name	Type
aws_cloudwatch_log_group.this	resource
aws_iam_role.this	resource
aws_iam_role_policy.addl	resource
aws_iam_role_policy.cloudwatch_logs	resource
aws_iam_role_policy_attachment.addl	resource
aws_iam_role_policy_attachment.aws_xray_write_only_access	resource
aws_iam_role_policy_attachment.vpc_attachment	resource
aws_lambda_function.this	resource
aws_iam_policy_document.assume_role_policy	data source
aws_iam_policy_document.cloudwatch_logs	data source

Inputs

Name	Description	Type	Default	Required
addl_assume_role_policy_principles	Additional assume role policy principles for the lambda IAM role, such as 'edgelambda.amazonaws.com'.	list(string)	[]	no
addl_inline_policies	A map of additional inline policies to attach to the IAM role. The key is the policy name, and the value is a JSON policy document.	map(string)	{}	no
addl_policies	A list of additional policy ARNs to attach to the Lambda's IAM role	list(string)	[]	no
architectures	Architectures supported by the Lambda function (e.g., x86_64, arm64)	list(string)	[ "x86_64" ]	no
cloudwatch_kms_key_arn	DEPRECATED, use cloudwatch_logs.kms_key_arn instead. KMS Key ARN to encrypt the CloudWatch Logs.	string	null	no
cloudwatch_logs	CloudWatch Logs configuration for the Lambda function. Takes precedence over the deprecated enable_cloudwatch_logs / cloudwatch_retention_in_days / cloudwatch_kms_key_arn variables.	object({ enabled = optional(bool, true) retention_in_days = optional(number, 30) kms_key_arn = optional(string) })	null	no
cloudwatch_retention_in_days	DEPRECATED, use cloudwatch_logs.retention_in_days instead. Number of days to retain log events in the specified log group.	number	30	no
context	Shared context from the 'bendoerr-terraform-modules/terraform-null-context' module.	object({ attributes = list(string) dns_namespace = string environment = string instance = string instance_short = string namespace = string region = string region_short = string role = string role_short = string project = string tags = map(string) })	n/a	yes
description	Description of the Lambda function	string	n/a	yes
enable_cloudwatch_logs	DEPRECATED, use cloudwatch_logs.enabled instead. Flag to enable or disable the creation of CloudWatch Logs.	bool	true	no
enable_tracing	DEPRECATED, use tracing_config.enabled instead. Whether to enable AWS X-Ray tracing for the Lambda function.	bool	false	no
env_kms_key_arn	DEPRECATED, use environment.kms_key_arn instead. The ARN of the KMS key to be used for encrypting environment variables in the Lambda function.	string	null	no
environment	Environment variable configuration for the Lambda function. Takes precedence over the deprecated environment_variables / env_kms_key_arn variables.	object({ variables = optional(map(string), {}) kms_key_arn = optional(string) })	null	no
environment_variables	DEPRECATED, use environment.variables instead. Key-value pairs of environment variables for the Lambda function.	map(string)	{}	no
filename	Path to the file with the AWS Lambda function source code.	string	n/a	yes
handler	The function entrypoint in your code.	string	n/a	yes
layers	List of ARNs of Lambda layers to include	list(string)	[]	no
memory_size	Amount of memory in MB allocated for the Lambda function	number	128	no
name	A descriptive but short name used for labels by the 'bendoerr-terraform-modules/terraform-null-label' module.	string	"thing"	no
permissions_boundary	ARN of the IAM policy to set as the permissions boundary on the Lambda's execution role. Null (the default) leaves the role unbounded. Set this to cap the role's effective permissions when a least-privilege deploy identity manages its inline policies.	string	null	no
publish	Whether to publish a new version of the Lambda function	bool	false	no
runtime	Runtime environment for the Lambda function (e.g., python3.9, nodejs14.x)	string	n/a	yes
source_code_hash	Used to trigger updates when the content of the Lambda function changes (filebase64sha256 of the source code). If not provided, filebase64sha256(var.filename) will be used.	string	null	no
timeout	Timeout in seconds before the Lambda function is terminated	number	3	no
tracing_config	X-Ray tracing configuration for the Lambda function. Takes precedence over the deprecated enable_tracing / tracing_mode variables.	object({ enabled = optional(bool, false) mode = optional(string, "PassThrough") })	null	no
tracing_mode	DEPRECATED, use tracing_config.mode instead. Tracing mode for AWS X-Ray (e.g., PassThrough, Active).	string	"PassThrough"	no
vpc_config	VPC configuration for the Lambda function. When set, takes precedence over the deprecated vpc_subnet_ids / vpc_security_group_ids variables; when null, those are used as a fallback. If neither the object nor the legacy variables are set, the function is not deployed in a VPC.	object({ subnet_ids = list(string) security_group_ids = list(string) })	null	no
vpc_security_group_ids	DEPRECATED, use vpc_config.security_group_ids instead. List of security group IDs for the Lambda function VPC configuration.	list(string)	null	no
vpc_subnet_ids	DEPRECATED, use vpc_config.subnet_ids instead. List of subnet IDs for the Lambda function VPC configuration.	list(string)	null	no

Outputs

Name	Description
cloudwatch_log_group_arn	The ARN of the CloudWatch Log Group for the Lambda function
cloudwatch_log_group_name	The name of the CloudWatch Log Group for the Lambda function
iam_role_arn	ARN of the IAM role attached to the Lambda function
id	The normalized ID from the 'bendoerr-terraform-modules/terraform-null-label' module.
lambda_function_arn	ARN of the deployed Lambda function
lambda_function_invoke_arn	The invoke ARN of the Lambda function
lambda_function_name	Name of the deployed Lambda function
lambda_function_version	The published version of the Lambda function
lambda_layers_arns	The ARNs of the Lambda layers attached to the function
name	The provided name given to the module.
tags	The normalized tags from the 'bendoerr-terraform-modules/terraform-null-label' module.

Roadmap

See the open issues for a list of proposed features (and known issues).

Contributing

Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

• If you have suggestions for adding or removing projects, feel free to open an issue to discuss it, or directly create a pull request after you edit the README.md file with necessary changes.
• Please make sure you check your spelling and grammar.
• Create individual PR for each suggestion.

Creating A Pull Request

1. Fork the Project
2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
3. Commit your Changes (git commit -m 'Add some AmazingFeature')
4. Push to the Branch (git push origin feature/AmazingFeature)
5. Open a Pull Request

License

Distributed under the MIT License. See LICENSE for more information.

Authors

• Benjamin R. Doerr - Terraformer - Benjamin R. Doerr - Built Ben's Terraform Modules

Supported Versions

Only the latest tagged version is supported.

Reporting a Vulnerability

See SECURITY.md.

Acknowledgements

• ShaanCoding (ReadME Generator)
• OpenSSF - Helping me follow best practices
• StepSecurity - Helping me follow best practices
• Infracost - Better than AWS Calculator