Confused by function_name in aws_lambda_permission

[hanks]

Terraform Version

Terraform v0.8.1

Affected Resource(s)

• aws_lambda_permission

In the docs https://www.terraform.io/docs/providers/aws/r/lambda_permission.html#function_name, it says:

function_name - (Required) Name of the Lambda function whose resource policy you are updating

But in the sample code:

resource "aws_lambda_permission" "allow_cloudwatch" {
    statement_id = "AllowExecutionFromCloudWatch"
    action = "lambda:InvokeFunction"
    # use arn here
    function_name = "${aws_lambda_function.test_lambda.arn}"
    ...
}

Maybe rename function_name argument to arn will be better

[stack72]

Hi @hanks

Apologies for the confusion here - this has since been updated in the documentation to be:

resource "aws_lambda_permission" "allow_cloudwatch" {
    statement_id = "AllowExecutionFromCloudWatch"
    action = "lambda:InvokeFunction"
    function_name = "${aws_lambda_function.test_lambda.name}"
    principal = "events.amazonaws.com"
    source_account = "111122223333"
    source_arn = "arn:aws:events:eu-west-1:111122223333:rule/RunDaily"
    qualifier = "${aws_lambda_alias.test_alias.name}"
}

Hope this helps

Paul

[mscottx88]

For any soul that may find themselves here, wondering WTF when you think you've followed all the docs. There is still moar to do.

First of all, the AWS docs do not talk about no permissions, so you'll need that. Secondly, terraform cannot create a subscription to a function name, that's wrong in da docs. Finally, an SNS subscription cannot go to :$LATEST so you have to replace() that. Don't forget the :.

If you've lost three days dev and come here, give me a 🎉

resource "aws_sns_topic" "cloudwatch_notifications" {
  name = "aws-${var.service_name}-${var.stage}-alarm"
}

data "aws_lambda_function" "cloudwatch_lambda" {
  function_name = "sls-${var.service_name}-${var.stage}-cloudwatch-alarms"
}

resource "aws_lambda_permission" "with_sns" {
  statement_id  = "AllowExecutionFromSNS"
  action        = "lambda:InvokeFunction"
  function_name = "${replace(data.aws_lambda_function.cloudwatch_lambda.arn, ":$LATEST", "")}"
  principal     = "sns.amazonaws.com"
  source_arn    = "${aws_sns_topic.cloudwatch_notifications.arn}"
}

resource "aws_sns_topic_subscription" "cloudwatch_subscription" {
  topic_arn = "${aws_sns_topic.cloudwatch_notifications.arn}"
  protocol  = "lambda"
  endpoint  = "${replace(data.aws_lambda_function.cloudwatch_lambda.arn, ":$LATEST", "")}"
}

[bflad]

The automatically appended :$LATEST qualifier in the aws_lambda_function data source arn attribute is just about to be removed in version 2.0.0 of the Terraform AWS Provider in the next week or two: hashicorp/terraform-provider-aws#5812

If there are other issues you would like to raise, I would recommend opening a new issue in the Terraform AWS Provider (https://github.com/terraform-providers/terraform-provider-aws/issues) so we can appropriately triage them as well. 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.