Module: lambda_layer

Publishes Lambda layer versions from directories under src/functions/. For every layer key X, the module zips src/functions/X/ into src/functions/X-layer.zip during terraform plan/apply and publishes it as a layer version.

Input Map Key Pattern

Root variable: lambda_layers (map of objects).

Field	Type	Required	Description
layer_name	string	optional	Override generated name (prefix + key + suffix).
description	string	optional	Layer description.
compatible_runtimes	list(string)	optional	Runtimes the layer supports (e.g., ["provided.al2023"]).
license_info	string	optional	License identifier.
s3_bucket	string	optional	Stage the layer zip in this S3 bucket before publishing. Required when the zip exceeds the inline publish limit.
required_files	list(string)	optional	Paths (relative to src/functions/<key>/) that must exist before the layer is zipped — use for build-script outputs so an un-built layer fails the plan instead of publishing incomplete.

Behavior

• Directory-based packaging: For every layer key X, Terraform packages the entire src/functions/X/ directory into src/functions/X-layer.zip.
• S3 staging: When s3_bucket is set, the zip is uploaded to s3://<bucket>/lambda-layers/<key>-layer.zip and the layer version is published from S3; otherwise it is published inline.
• Versioning: source_code_hash uses the archive's base64 SHA256, so a new layer version is published only when directory contents change.
• Naming: Layer name defaults to prefix + key + suffix unless layer_name overrides it.
• Consumption: Reference the layer key from a lambda's layers list (see Lambda Function); the key resolves to the published layer version ARN.

70 MB inline publish limit

PublishLayerVersion rejects inline uploads larger than 70 MB. Set s3_bucket for large layers (such as the PowerShell runtime) or the publish fails at apply.

Build step prerequisite

The powershell_runtime layer content is assembled by src/functions/powershell_runtime/build.sh, which downloads and extracts the pwsh binaries into a git-ignored powershell/ directory. Run it before terraform plan/apply — the CI plan/apply workflows do this automatically via the build-powershell-layer composite action (cached, and skipped for environments without lambda_layers). The layer's required_files = ["powershell/pwsh"] entry makes an un-built plan fail with an explicit error instead of publishing a layer that lacks the PowerShell binaries.

Example

lambda_layers = {
  powershell_runtime = {
    description         = "PowerShell 7 custom runtime (bootstrap + pwsh) for provided.al2023 functions"
    compatible_runtimes = ["provided.al2023"]
    s3_bucket           = "epc-installersawss3-c" # layer zip exceeds the 70 MB inline publish limit
    required_files      = ["powershell/pwsh"]     # fail the plan if build.sh has not populated the layer content
  }
}