Search code examples
dockeraws-lambdaterraformterraform-provider-aws

Terraform: AWS Lambda with Image not updating


We have a new terraform script that is pushing a docker image to an AWS Lambda. The script works well and correctly connects the fresh image to the Lambda. I can confirm this by checking the Image URL as shown in the AWS console for the Lambda and it is the newly pushed+connected image. However when testing the lambda it is clearly running the prior code. It seems like the Lambda has been updated but the running in-memory instances didnt get the message.
Question: is there a way to force the in-memory Lambdas to be cycled to the new image?

Here is our TF code for the Lambda:

resource "aws_lambda_function" "my_lambda" {
  function_name = "MyLambda_${var.environment}"
  role          = data.aws_iam_role.iam_for_lambda.arn
  image_uri     = "${data.aws_ecr_repository.my_image.repository_url}:latest"
  memory_size   = 512
  timeout       = 300
  architectures = ["x86_64"]
  package_type  = "Image"
  environment {variables = {stage = var.environment, commit_hash=var.commit_hash}}
}

Solution

  • After more searching I found some discussions (here) that mention the source_code_hash option in terraform for the Lambda creation block (docs here). Its mostly used with a SHA hash of the zip file used for pushing code from an S3 bucket, but in our case we are using a container/image so there is not really a file to get a hash from. However, it turns out that it is just a string that Lambda checks for changes. So we added the following:

    resource "aws_lambda_function" "my_lambda" {
      function_name = "MyLambda_${var.environment}"
      role          = data.aws_iam_role.iam_for_lambda.arn
      image_uri     = "${data.aws_ecr_repository.my_image.repository_url}:latest"
      memory_size   = 512
      timeout       = 300
      architectures = ["x86_64"]
      package_type  = "Image"
      environment {variables = {stage = var.environment, commit_hash=var.commit_hash}}
      source_code_hash = var.commit_hash  << New line
    }
    

    And we use a bitbucket pipeline to inject the git hash into the terraform apply operation. This fix allowed the Lambda to correctly update the running version.