resource/aws_lambda_permission: Add support for statement_id_prefix

aws/resource_aws_lambda_permission.go

@@ -60,8 +60,16 @@ func resourceAwsLambdaPermission() *schema.Resource {
 				ValidateFunc: validateArn,
 			},
 			"statement_id": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ForceNew:      true,
+				ConflictsWith: []string{"statement_id_prefix"},
+				ValidateFunc:  validatePolicyStatementId,
+			},
+			"statement_id_prefix": {
 				Type:         schema.TypeString,
-				Required:     true,
+				Optional:     true,
 				ForceNew:     true,
 				ValidateFunc: validatePolicyStatementId,
 			},
@@ -74,6 +82,15 @@ func resourceAwsLambdaPermissionCreate(d *schema.ResourceData, meta interface{})
 
 	functionName := d.Get("function_name").(string)
 
+	var statementId string
+	if v, ok := d.GetOk("statement_id"); ok {
+		statementId = v.(string)
+	} else if v, ok := d.GetOk("statement_id_prefix"); ok {
+		statementId = resource.PrefixedUniqueId(v.(string))
+	} else {
+		statementId = resource.UniqueId()
+	}
+
 	// There is a bug in the API (reported and acknowledged by AWS)
 	// which causes some permissions to be ignored when API calls are sent in parallel
 	// We work around this bug via mutex
@@ -84,7 +101,7 @@ func resourceAwsLambdaPermissionCreate(d *schema.ResourceData, meta interface{})
 		Action:       aws.String(d.Get("action").(string)),
 		FunctionName: aws.String(functionName),
 		Principal:    aws.String(d.Get("principal").(string)),
-		StatementId:  aws.String(d.Get("statement_id").(string)),
+		StatementId:  aws.String(statementId),
 	}
 
 	if v, ok := d.GetOk("qualifier"); ok {
@@ -127,7 +144,7 @@ func resourceAwsLambdaPermissionCreate(d *schema.ResourceData, meta interface{})
 		log.Printf("[DEBUG] Created new Lambda permission, but no Statement was included")
 	}
 
-	d.SetId(d.Get("statement_id").(string))
+	d.SetId(statementId)
 
 	err = resource.Retry(5*time.Minute, func() *resource.RetryError {
 		// IAM is eventually cosistent :/

aws/resource_aws_lambda_permission_test.go

@@ -205,6 +205,30 @@ func TestAccAWSLambdaPermission_withRawFunctionName(t *testing.T) {
 	})
 }
 
+func TestAccAWSLambdaPermission_withStatementIdPrefix(t *testing.T) {
+	var statement LambdaPolicyStatement
+	endsWithFuncName := regexp.MustCompile(":function:lambda_function_name_perm$")
+	startsWithPrefix := regexp.MustCompile("^AllowExecutionWithStatementIdPrefix-")
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSLambdaPermissionDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSLambdaPermissionConfig_withStatementIdPrefix,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckLambdaPermissionExists("aws_lambda_permission.with_statement_id_prefix", &statement),
+					resource.TestCheckResourceAttr("aws_lambda_permission.with_statement_id_prefix", "action", "lambda:InvokeFunction"),
+					resource.TestCheckResourceAttr("aws_lambda_permission.with_statement_id_prefix", "principal", "events.amazonaws.com"),
+					resource.TestMatchResourceAttr("aws_lambda_permission.with_statement_id_prefix", "statement_id", startsWithPrefix),
+					resource.TestMatchResourceAttr("aws_lambda_permission.with_statement_id_prefix", "function_name", endsWithFuncName),
+				),
+			},
+		},
+	})
+}
+
 func TestAccAWSLambdaPermission_withQualifier(t *testing.T) {
 	var statement LambdaPolicyStatement
 	endsWithFuncName := regexp.MustCompile(":function:lambda_function_name_perm_qualifier$")
@@ -570,6 +594,42 @@ EOF
 }
 `
 
+var testAccAWSLambdaPermissionConfig_withStatementIdPrefix = `
+resource "aws_lambda_permission" "with_statement_id_prefix" {
+    statement_id_prefix = "AllowExecutionWithStatementIdPrefix-"
+    action = "lambda:InvokeFunction"
+    function_name = "${aws_lambda_function.test_lambda.arn}"
+    principal = "events.amazonaws.com"
+}
+
+resource "aws_lambda_function" "test_lambda" {
+    filename = "test-fixtures/lambdatest.zip"
+    function_name = "lambda_function_name_perm"
+    role = "${aws_iam_role.iam_for_lambda.arn}"
+    handler = "exports.handler"
+    runtime = "nodejs4.3"
+}
+
+resource "aws_iam_role" "iam_for_lambda" {
+    name = "%s"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Principal": {
+        "Service": "lambda.amazonaws.com"
+      },
+      "Effect": "Allow",
+      "Sid": ""
+    }
+  ]
+}
+EOF
+}
+`
+
 var testAccAWSLambdaPermissionConfig_withQualifier = `
 resource "aws_lambda_permission" "with_qualifier" {
     statement_id = "AllowExecutionWithQualifier"

website/docs/r/lambda_permission.html.markdown

@@ -112,12 +112,13 @@ EOF
 
 ## Argument Reference
 
+ * `statement_id` - (Optional) A unique statement identifier. By default generated by Terraform.
+ * `statement_id_prefix` - (Optional) A unique statement identifier. Conflicts with `statement_id`.
  * `action` - (Required) The AWS Lambda action you want to allow in this statement. (e.g. `lambda:InvokeFunction`)
  * `function_name` - (Required) Name of the Lambda function whose resource policy you are updating
  * `principal` - (Required) The principal who is getting this permission.
  	e.g. `s3.amazonaws.com`, an AWS account ID, or any valid AWS service principal
  	such as `events.amazonaws.com` or `sns.amazonaws.com`.
- * `statement_id` - (Required) A unique statement identifier.
  * `qualifier` - (Optional) Query parameter to specify function version or alias name.
  	The permission will then apply to the specific qualified ARN.
  	e.g. `arn:aws:lambda:aws-region:acct-id:function:function-name:2`