s3_existing_package not working as expected

[ffleandro]

Description

local_existing_package updates the lambda correctly, but s3_existing_package doesn't.

In my terraform scripts I manually upload the lambda code into an s3 bucket using:

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = ">= 3.6.0"

  bucket        = "my-bucket-name"
  acl           = "private"
  force_destroy = true

  # S3 bucket-level Public Access Block configuration
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_object" "app_dist_zip" {
  depends_on = [module.s3_bucket]
  bucket = module.s3_bucket.s3_bucket_id
  key    = local.app_package_name
  acl    = "private"
  source = "../device-service/dist/${local.app_package_name}"
  etag = filemd5("../device-service/dist/${local.app_package_name}")
  source_hash = filemd5("../device-service/dist/${local.app_package_name}")
}

I've confirmed that the s3 object is properly updated every time the md5 of the zip file changes.

However, the lambda never updates when this object changes, even if I run a few times sequentially. Initially I thought the lambda was using the source_hash of the file that exists on S3 before the upload so a second attempt would fix this since now the s3 object is already online.

This is my lambda example:

module "lambda_service" {
  source  = "terraform-aws-modules/lambda/aws"
  version = ">= 4.7.2"
  depends_on = [module.s3_bucket]

  function_name = "my-lambda-name"
  description   = "My Lambda Description"
  handler       = "index.httpHandler"
  runtime       = "nodejs16.x"
  publish       = true

  create_package = false
  hash_extra = aws_s3_object.app_dist_zip.source_hash
  s3_existing_package = {
    bucket = module.s3_bucket.s3_bucket_id
    key    = aws_s3_object.app_dist_zip.id
  }
  #  local_existing_package = "../device-service/dist/${local.app_package_name}"

  attach_tracing_policy    = true
  attach_policy_statements = true

  policy_statements = {
    dynamodb = {
      (...)
    }
  }

  allowed_triggers = {
    AllowExecutionFromAPIGateway = {
      service    = "apigateway"
      source_arn = "${module.api_gateway.apigatewayv2_api_execution_arn}/*/*/*"
    }
  }

  environment_variables = {
    (...)
  }
}

• [x] ✋ I have searched the open/closed issues and my issue is not listed.

Versions

• Module version [Required]: 4.7.2

• Terraform version:

  
  Terraform v1.3.7
  on darwin_amd64

• provider registry.terraform.io/hashicorp/aws v4.50.0

• provider registry.terraform.io/hashicorp/external v2.2.3

• provider registry.terraform.io/hashicorp/local v2.3.0

• provider registry.terraform.io/hashicorp/null v3.2.1

Expected behavior

module.lambda_service.lambda_function_source_code_hash would change everytime a new file is uploaded to the s3 bucket.

Actual behavior

module.lambda_service.lambda_function_source_code_hash doesn't change if a new file is uploaded to the s3 bucket.

[Untanky]

Having the same issue 👍🏻

[dgbarmac]

I have the same problem. It did not work even after specifying a new version for the s3 file. My aim is to separate the IAC and Lambda code and this problem do not allow such thing.

[antonbabenko]

Make sure to specify version_id for Lambda function to track changes there when key of S3 object is not changed but only version:

s3_existing_package = {
    bucket = module.s3_bucket.s3_bucket_id
    key    = aws_s3_object.app_dist_zip.id

    version_id = aws_s3_object.app_dist_zip.version_id # <-- this one
}

S3 bucket versioning should be enabled, too.

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.