Skip to content

Module: lambda_function

Defines Lambda functions used in automation (e.g., controlled EC2 stop logic) and their invoke permissions. Each lambda key auto‑packages a directory found at src/functions/<lambda_key>/ into src/functions/<lambda_key>.zip during terraform plan/apply.

Lambda Directory Structure

All lambdas use a directory-based structure:

src/functions/
├── ec2_stop_function/
│   └── ec2_stop_function.py
├── manage_route_function/
│   └── manage_route_function.py
├── update_hsweb_url_function/
│   ├── main.py
│   └── update_hsweb_url.bash
└── ...

This structure allows including additional files, scripts, or dependencies alongside the Lambda handler.

Input Map Key Pattern

Root variable: lambdas (map of objects).

Field Type Required Description
function_name string optional Override generated name (prefix + key + suffix).
role string required IAM role key (must exist in iamroles output map).
handler string required Entrypoint. Use <main python file name>.lambda_handler
runtime string required Runtime (e.g., python3.12).
timeout number optional Seconds (default 300).
memory_size number optional MB (default 128).
description string optional Function description.
publish bool optional Publish version (default false).
layers list(string) optional Layer references: keys from the lambda_layers map (resolved to layer version ARNs) or raw layer ARNs.
architectures list(string) optional Instruction set architectures (e.g., ["x86_64"]).
ephemeral_storage number optional /tmp size in MB.
kms_key_arn string optional KMS key ARN used to encrypt environment variables.
environment map(string) optional Environment variables for the function.
vpc_config object optional VPC attachment: subnet_ids (subnet keys <VPC>.<Subnet> or raw IDs) and security_group_ids (SG names resolved within the subnets' VPC, or raw IDs).

Root variable: lambda_permissions defines invoke permissions separate from function definition.

Field Type Required Description
statement_id string required Unique statement identifier
action string required Typically lambda:InvokeFunction
function_name string required Key of the lambda in lambdas map
principal string required Service or account allowed to invoke (e.g. events.amazonaws.com, ssm.amazonaws.com)
source_arn string conditional Restricts invoke source (e.g., EventBridge rule name resolved to ARN)

Behavior

  • Directory-based packaging: For every lambda key X, Terraform packages the entire src/functions/X/ directory into src/functions/X.zip.
  • Multi-file support: Include additional files (scripts, configs, dependencies) in the lambda directory; all contents are packaged together.
  • Source code tracking: source_code_hash uses the archive's base64 SHA256, triggering updates only when directory contents change.
  • Build artifacts: Zip files (src/functions/*.zip) are generated during Terraform operations and ignored by Git.
  • Permissions: Managed via separate lambda_permissions map, allowing multiple services to invoke the same function.
  • Naming: Function name defaults to prefix + key + suffix unless function_name attribute overrides it.

Example

Lambda Function

lambdas = {
  ec2_stop_function = {
    role     = "Lambda_AutomationRole"
    handler  = "ec2_stop_function.lambda_handler"
    runtime  = "python3.12"
    timeout  = 300
  }
  kuiper_api_function = {
    role          = "Kuiper_Lambda_Role"
    handler       = "handler.ps1"
    runtime       = "provided.al2023"
    memory_size   = 1024
    timeout       = 300
    architectures = ["x86_64"]
    layers        = ["powershell_runtime"] # key from the lambda_layers map, or a raw layer ARN
    environment = {
      KUIPER_URL = "https://kuiper.example.com"
    }
    vpc_config = {
      subnet_ids         = ["SharedInfra.SharedInfraPrivateAZ1", "SharedInfra.SharedInfraPrivateAZ2"]
      security_group_ids = ["KuiperLambdaSG"]
    }
  }
}

Lambda Permissions

lambda_permissions = {
  eventbridge_permission = {
    statement_id  = "AllowEventBridgeInvoke"
    action        = "lambda:InvokeFunction"
    function_name = "ec2_stop_function"
    principal     = "events.amazonaws.com"
    source_arn    = "ec2-shutdown-everynight"  # EventBridge rule name
  }
  ssm_permission = {
    statement_id  = "AllowSSMInvoke"
    action        = "lambda:InvokeFunction"
    function_name = "ec2_stop_function"
    principal     = "ssm.amazonaws.com"
  }
}