Cannot Delete Lambda@Edge Functions

[adrians5j]

What happened?

Upon destroying a stack that includes a Lambda@Edge function, the following error is thrown:

aws:lambda:Function (website-router-origin-request):
  error: deleting urn:pulumi:ootb::website::aws:lambda/function:Function::website-router-origin-request: 1 error occurred:
  	* error deleting Lambda Function (website-router-origin-request-1234567): InvalidParameterValueException: Lambda was unable to delete arn:aws:lambda:us-east-1:021556198172:function:website-router-origin-request-1234567:1 because it is a replicated function. Please see our documentation for Deleting Lambda@Edge Functions and Replicas.
  	*

Steps to reproduce

Deploy a stack with Lambda@Edge function. Destroy the stack.

Expected Behavior

The stack should be successfully destroyed.

Actual Behavior

The stack destroy operation errors.

Output of pulumi about

CLI
Version   3.39.3
Go Version  go1.19.1
Go Compiler gc
Plugins
NAME  VERSION
nodejs unknown
Host
OS    darwin
Version 12.3.1
Arch   x86_64
This project is written in nodejs: executable=‘/private/var/folders/ww/_qbgfh_s3bn9gtly6l7bmjc40000gn/T/xfs-37abc537/node’ version=‘v16.13.2’
Current Stack: ootb
TYPE                           URN
pulumi:pulumi:Stack                    urn:pulumi:ootb::website::pulumi:pulumi:Stack::website-ootb
pulumi:providers:aws                   urn:pulumi:ootb::website::pulumi:providers:aws::default_5_13_0
pulumi:providers:aws                   urn:pulumi:ootb::website::pulumi:providers:aws::us-east-1
aws:cloudfront/originAccessIdentity:OriginAccessIdentity urn:pulumi:ootb::website::aws:cloudfront/originAccessIdentity:OriginAccessIdentity::ootb-delivery-origin-identity
aws:cloudwatch/eventRule:EventRule            urn:pulumi:ootb::website::aws:cloudwatch/eventRule:EventRule::ootb-ps-flush-event-rule
aws:cloudwatch/eventRule:EventRule            urn:pulumi:ootb::website::aws:cloudwatch/eventRule:EventRule::ootb-ps-render-subscriber-event-rule
aws:cloudfront/originAccessIdentity:OriginAccessIdentity urn:pulumi:ootb::website::aws:cloudfront/originAccessIdentity:OriginAccessIdentity::ootb-app-origin-identity
aws:s3/bucket:Bucket                   urn:pulumi:ootb::website::aws:s3/bucket:bucket::ootb-delivery
aws:s3/bucket:Bucket                   urn:pulumi:ootb::website::aws:s3/bucket:bucket::ootb-app
aws:iam/role:Role                     urn:pulumi:ootb::website::aws:iam/role:Role::ootb-ps-render-subscriber-role
aws:iam/role:Role                     urn:pulumi:ootb::website::aws:iam/role:Role::ootb-ps-render-lambda-role
aws:iam/role:Role                     urn:pulumi:ootb::website::aws:iam/role:Role::ootb-ps-flush-lambda-role
aws:iam/role:Role                     urn:pulumi:ootb::website::aws:iam/role:Role::ootb-website-router-role
aws:cloudfront/function:Function             urn:pulumi:ootb::website::aws:cloudfront/function:Function::ootb-cfViewerRequest
aws:lambda/function:Function               urn:pulumi:ootb::website::aws:lambda/function:Function::website-router-origin-request
aws:sqs/queue:Queue                    urn:pulumi:ootb::website::aws:sqs/queue:Queue::ootb-ps-render-queue
Found no pending operations associated with ootb
Backend
Name      [rover.homenet.telecomitalia.it](http://rover.homenet.telecomitalia.it/)
URL      file:///Users/ruppert/sandbox/node/im/webiny-ootb/.pulumi/apps/website
User      ruppert
Organizations
Pulumi locates its logs in /var/folders/ww/_qbgfh_s3bn9gtly6l7bmjc40000gn/T/ by default
warning: Failed to get information about the Pulumi program’s dependencies: Could not find either /Users/ruppert/sandbox/node/im/webiny-ootb/.webiny/workspaces/apps/website/pulumi/yarn.lock or /Users/ruppert/sandbox/node/im/webiny-ootb/.webiny/workspaces/apps/website/pulumi/package-lock.json
rover:webiny-ootb ruppert$

Additional context

No response

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[guineveresaenger]

Hi @adrians5j - this is a long-standing upstream issue and unfortunately the only solution seems to be:

1. Delete any Lambda Edge associations from your Pulumi Stack
2. Wait ~1h for AWS to clean up the related resources
3. Rename your Lambda to delete-replace the resource

[adrians5j]

Well, fingers crossed🤞🏻 they figure it out 🙂

Thanks for the response @guineveresaenger.

[adrians5j]

Just wanted to mention that we resolved the issue a while ago, by using Pulumi's retainOnDelete flag on the Lambda function (https://github.com/webiny/webiny-js/pull/3278/files#diff-8461bcd549dcb204ef908554926243c6d5fcdbfb9caf0845806baf5627729a78R109).

Note that users do have to manually delete the function (e.g. via AWS console), but at least the pulumi destroy command finishes successfully.