Terraform error updating CloudFront Distribution InvalidLambdaFunctionAssociation: The function cannot have environment variables

Question

I am trying to build a terraform template that creates an AWS S3 Bucket, Cloudfront Distribution and a Lambda function that should be associated with the Cloudfront Distribution.

As soon as I add "lambda_function_association" to the Cloudfront ressource I experience following error.

Error: error updating CloudFront Distribution (XXXXXXXXXXXXXXX): InvalidLambdaFunctionAssociation: The function cannot have environment variables. Function: arn:aws:lambda:us-east-1:XXXXXXXXXXXXX:function:testtools:4
status code: 400, request id: 3ce25af1-8341-41c0-8d35-4c3c91c2c001
with aws_cloudfront_distribution.testtools,
on main.tf line 42, in resource "aws_cloudfront_distribution" "testtools":
42: resource "aws_cloudfront_distribution" "testtools" {

lambda_function_association {
     event_type = "origin-response"
     lambda_arn = "${aws_lambda_function.testtools.qualified_arn}"
     include_body = false
}

I think it is related to the lambda_arn that is used inside the function association.

resource "aws_cloudfront_distribution" "testtools" {

    depends_on = [aws_s3_bucket.testtools, aws_lambda_function.testtools]

        origin {
            domain_name = aws_s3_bucket.testtools.bucket_regional_domain_name
            origin_id   = var.s3_origin_id

            s3_origin_config {
                origin_access_identity = aws_cloudfront_origin_access_identity.testtools.cloudfront_access_identity_path
            }
        }

        enabled             = true
        is_ipv6_enabled     = true
        comment             = "testtools"
        default_root_object = "index.html"
        provider            = aws

        logging_config {
            include_cookies = false
            bucket          = "testtools.s3.amazonaws.com"
            prefix          = "testtools"
        }

        aliases = ["testtools.int.test.net"]

        default_cache_behavior {
            allowed_methods  = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
            cached_methods   = ["GET", "HEAD"]
            target_origin_id = var.s3_origin_id

            forwarded_values {
                query_string = false

                cookies {
                    forward = "none"
                }
            }

            viewer_protocol_policy = "allow-all"
            min_ttl                = 0
            default_ttl            = 3600
            max_ttl                = 86400

            lambda_function_association {
                event_type = "origin-response"
                lambda_arn = "${aws_lambda_function.testtools.qualified_arn}"
                include_body = false
            }

        }

        price_class = "PriceClass_200"

        restrictions {
            geo_restriction {
                restriction_type = "whitelist"
                locations        = ["DE", "AU", "CH", "BG"]
            }
        }

        tags = {
            Environment = "production"
        }

        viewer_certificate {
            acm_certificate_arn = var.ssl_cert_arn
            ssl_support_method = "sni-only"
            minimum_protocol_version = "TLSv1"
        }
}

resource "aws_lambda_function" "testtools" {
        filename      = "lambda_function_payload.zip"
        function_name = "testtools"
        role          = aws_iam_role.testtools.arn
        handler       = "index.test"
        publish       = true
        provider      = aws.useast1
        source_code_hash = filebase64sha256("lambda_function_payload.zip")

        runtime = "nodejs12.x"

        environment {
            variables = {
                foo = "bar"
            }
        }
}

Answer 1

When using a Lambda@edge, your lambda has a lot more restrictions that it has to adhere to. Some restrictions also depend on whether you're linking the lambda to origin req/res or viewer req/res.

One of these restrictions is that you can't use environment variables. You can find more info on this page: Lambda@Edge function restrictions