Skip to content

Releases: cloudposse-terraform-components/aws-lambda

v1.538.1

05 Jun 16:17
@cloudposse-releaser cloudposse-releaser
v1.538.1
a7c02ca
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.538.1 Latest
Latest
fix(lambda): prevent strcontains null error on zip deploys @johncblandii (#54) ## Summary
  • Fix a plan-time failure that occurred whenever the function was deployed from a zip (image_uri == null) while cicd_ssm_param_name was set.
  • Add a fast, credential-free terraform test unit suite that reproduces the regression and guards the image_uri resolution logic going forward.

Changes

  • src/main.tf: make the local.image_uri resolution null-safe. Terraform/OpenTofu's && does not short-circuit, so strcontains(var.image_uri, "%s") was evaluated even when var.image_uri was null, failing with Invalid value for "str" parameter: argument must not be null. The string fed to strcontains() now goes through an inner ternary (var.image_uri == null ? "" : var.image_uri), which does short-circuit. (Note: coalesce(var.image_uri, "") is not a valid fix here — coalesce also rejects empty strings and would error when image_uri is null.)
  • test/unit/image_uri/: new native terraform test fixture mirroring the local.image_uri logic, runnable without AWS credentials. The component itself can only be planned via the atmos/Terratest harness (it depends on account-map and remote-state modules), so this isolates the pure logic that broke.
  • test/README.md: document the integration (atmos test run) and new unit test workflows.

Testing

  • Unit tests added (test/unit/image_uri/image_uri_unit_test.tftest.hcl, 4 cases)
  • Verified the test fails against the buggy logic, reproducing the exact production error (Invalid value for "str" parameter)
  • Verified the test passes against the fix — Success! 4 passed, 0 failed
  • terraform fmt -check -recursive clean

Run the unit tests with:

```bash
terraform -chdir=test/unit/image_uri init
terraform -chdir=test/unit/image_uri test
```

Notes

Covered scenarios: zip deploy with SSM param set (the regression), templated image_uri formatted with the SSM value, static image_uri passthrough, and image_uri passthrough when no SSM param is configured.

The unit fixture mirrors the src/main.tf expression rather than executing it directly (the component can't init standalone in plain CI). Cross-reference comments in both files note they must stay in sync.

Summary by CodeRabbit

  • Bug Fixes

    • Fixed null-value handling in image URI computation to prevent errors when certain parameters are undefined.

  • Tests

    • Added comprehensive unit tests validating image URI resolution behavior across multiple scenarios.

  • Documentation

    • Added testing layer documentation covering integration and native unit tests with setup instructions.

🤖 Automatic Updates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.46.0 @[renovate[bot]](https://github.com/apps/renovate) (#50) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.45.0 → 0.46.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.46.0

Compare Source

What's Changed

Enhancements
Chores

New Contributors

Read more

Contributors

johncblandii
Assets 2
Loading

v1.538.0

25 Feb 14:28
@cloudposse-releaser cloudposse-releaser
v1.538.0
d88afb2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.538.0
Guard resources against enabled: false @milldr (#49) ## What

Gate function_name, function_url_enabled, and cloudwatch_event_rules locals on local.enabled so dependent resources are not created when the component is disabled. Guard filename zip reference with local.enabled to prevent index errors. Switch all for_each in triggers_cloudwatch_event_rules.tf from var.cloudwatch_event_rules to local.cloudwatch_event_rules.

Why

Setting enabled: false on a Lambda component causes plan/destroy errors because resources like CloudWatch event rules, function URLs, and zip archives still attempt to reference or create resources that don't exist.

Summary by CodeRabbit

  • Bug Fixes
    • Fixed Lambda function and CloudWatch event rule resources from being created when feature gates are disabled.
    • Improved conditional resource provisioning logic to respect configuration settings.

Contributors

milldr
Loading

v1.537.2

05 Feb 11:50
@cloudposse-releaser cloudposse-releaser
v1.537.2
b6de051
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.537.2

🚀 Enhancements

Improve s3_key assignment based on conditions @goruha (#47) ## what * Improve s3_key assignment based on conditions

why

  • Ensure s3_key set null if s3_bucket_name is null
import:
  - catalog/lambda/defaults

components:
  terraform:
    lambda/hello-world-py:
      metadata:
        component: lambda
        inherits:
          - lambda/defaults
      vars:
        name: hello-world-py
        function_name: main
        description: Hello Lambda from Python!
        handler: lambda.lambda_handler # in go this is the compiled binary, python it's filename.function
        memory_size: 256
        # https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
        runtime: python3.9
        package_type: Zip # `Zip` or `Image`
        policy_json: null

        # Filename example
        filename: lambdas/hello-world-python/output.zip # generated by zip variable.
        zip:
          enabled: true
          input_dir: hello-world-python
          output: hello-world-python/output.zip

        # S3 Source Example
        # s3_bucket_name: lambda-source # lambda main.tf calculates the rest of the bucket_name
        # s3_key: hello-world-go.zip

this stack configuration lead to error

│ Error: Missing required argument
│ 
│   with module.lambda.aws_lambda_function.this[0],
│   on .terraform/modules/lambda/main.tf line 40, in resource "aws_lambda_function" "this":
│   40:   s3_key                         = var.s3_key
│ 
│ "s3_key": all of `s3_bucket,s3_key` must be specified

Summary by CodeRabbit

  • Improvements
    • Improved deployment configuration handling so storage key assignment is skipped when no storage bucket is configured, preventing invalid configuration and preserving prior behavior when a bucket is present.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#46) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.45.0 @[renovate[bot]](https://github.com/apps/renovate) (#45) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.44.0 -> 0.45.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.45.0

Compare Source

What's Changed

Breaking Changes
Enhancements
Bug Fixes
Chores
Read more

Contributors

goruha
Loading

v1.537.1

08 Dec 18:37
@cloudposse-releaser cloudposse-releaser
v1.537.1
970aa71
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.537.1

🚀 Enhancements

Change scaling_config to dynamic block @wavemoran (#44) ## what * Changes the `scaling_config` block to a dynamic config that defaults to `null`

why

  • If an SQS trigger is used, but no scaling_config variable is passed, we'll see a constant no-op drift in Terraform trying to apply scaling_config that looks like:

    # aws_lambda_event_source_mapping.event_source_mapping["foo"] will be updated in-place
~ resource "aws_lambda_event_source_mapping" "event_source_mapping" {
      id                                 = "1234"
      tags                               = {}
      # (21 unchanged attributes hidden)

    + scaling_config {}
  }

references

Summary by CodeRabbit

  • Refactor
    • Improved Lambda event source mapping configuration to make scaling settings optional, enabling deployments to only apply concurrency limits when explicitly configured.

✏️ Tip: You can customize this high-level summary in your review settings.

🤖 Automatic Updates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.44.0 @[renovate[bot]](https://github.com/apps/renovate) (#43) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.43.0 -> 0.44.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.44.0

Compare Source

What's Changed

Support for Cosign signatures has been removed from this release. The checksums.txt.keyless.sig and checksums.txt.pem will not be included in the release.
These files are not used in normal use cases, so in most cases this will not affect you, but if you are affected, you can use Artifact Attestations instead.

Breaking Changes
  • Bump github.com/terraform-linters/tflint-plugin-sdk from 0.22.0 to 0.23.1 by @​dependabot[bot] in #​966
    • Requires TFLint v0.46+
Enhancements
Chores

New Contributors

Full Changelog: terraform-linters/tflint-ruleset-aws@v0.43.0...v0.44.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#42) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.43.0 @[renovate[bot]](https://github.com/apps/renovate) (#41) Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more [here](https://redirect.github.com/renovatebot/renovate/discussions/37842).

This PR contains the following updates:

Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.42.0 -> 0.43.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.43.0

Compare Source

What's Changed

Breaking Changes
Enhancements
Chores

...

Read more

Contributors

goruha and wavemoran
Loading

v1.537.0

31 Jul 17:58
@cloudposse-releaser cloudposse-releaser
v1.537.0
10f807b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.537.0
Bugfix: Invalid Policy @Benbentwo (#36) ## TL;DR Bugfixing the policy in the SQS file. This bug is present since #6 where Mergify & Rennovate updated our module to 2.0.2 but that was a breaking change. We do not yet have tests for this component which wouldve caught it.

This pull request updates the structure of the iam_policy in the sqs_iam_policy module to use a list format instead of a map. This change ensures compatibility with downstream modules that expect a list format.

Changes to iam_policy structure:

  • src/triggers_sqs_queue.tf: Updated iam_policy from a map to a list of maps in the sqs_iam_policy module. This involves wrapping the policy definition in square brackets to convert it into a list. [1] [2]

Summary by CodeRabbit

  • Chores
    • Updated configuration format for IAM policy settings to improve compatibility. No changes to functionality or user experience.

Contributors

Benbentwo
Loading

v1.536.3

31 Jul 17:33
@cloudposse-releaser cloudposse-releaser
v1.536.3
4b5ae9d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.3
Feature: Allow lambda images to utilize the `ssm_param_name` variable @Benbentwo (#34) This pull request introduces enhancements to the Terraform module for managing AWS Lambda functions. Key updates include support for dynamically formatting `image_uri` using SSM parameters, a refactor of the `iam_policy` variable to improve compatibility and usability, and minor adjustments to ensure consistent behavior. Below are the most important changes grouped by theme:

Lambda Deployment Enhancements:

  • Added logic to dynamically format image_uri using the value of an SSM parameter when cicd_ssm_param_name is set. This allows deploying Lambda functions with tags stored in SSM parameters (src/main.tf, src/main.tfR20-R23).
  • Updated the module "lambda" block to use the newly defined local.image_uri instead of directly referencing var.image_uri (src/main.tf, src/main.tfL73-R77).

IAM Policy Improvements:

  • References: https://github.com/cloudposse/terraform-aws-iam-policy/blob/main/variables.tf#L1-L34
  • Refactored the iam_policy variable type from a single object to a list of objects for better compatibility with the Terraform aws_iam_policy_document data source (src/variables.tf, src/variables.tfL266-R266).
  • Updated the iam_policy variable description to clarify usage and added nullable = false with a default value of an empty list for stricter validation (src/variables.tf, src/variables.tfL290-R297).

Summary by CodeRabbit

  • New Features

    • Enabled dynamic substitution in the image URI using values from AWS SSM parameters for Lambda deployments.

  • Improvements

    • Updated IAM policy input to accept a list of policy objects instead of a single object, allowing for more flexible policy definitions.
    • Improved documentation for the IAM policy variable to clarify its structure and usage.

🤖 Automatic Updates

chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.41.0 @[renovate[bot]](https://github.com/apps/renovate) (#33) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.40.0 -> 0.41.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.41.0

Compare Source

What's Changed

Breaking Changes
Enhancements
Chores
Read more

Contributors

Benbentwo
Loading

v1.536.2

26 Jun 19:09
@cloudposse-releaser cloudposse-releaser
v1.536.2
44b3665
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.2
chore(deps): restrict aws provider version to < 6.0.0 @Benbentwo (#30) This pull request includes a version constraint update for the AWS provider in the Terraform configuration file `src/versions.tf`. The change ensures compatibility with versions up to but not including 6.0.0.
  • src/versions.tf: Updated the version constraint for the aws provider to >= 4.9.0, < 6.0.0 to ensure compatibility with future versions while avoiding potential breaking changes in version 6.0.0.

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#31) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Enable merge queue @goruha (#29) ## what - Added `auto-merge` workflow - Update `settings.yaml` - Fix CodeOwners files

why

  • Support auto merge PRs
  • Create merge queue
  • Implement new CodeOwners policy
Enable merge queue @goruha (#28) ## what - Added `auto-merge` workflow - Update `settings.yaml` - Fix CodeOwners files

why

  • Support auto merge PRs
  • Create merge queue
  • Implement new CodeOwners policy
chore(deps): update tflint plugin terraform-linters/tflint-ruleset-aws to v0.40.0 @[renovate[bot]](https://github.com/apps/renovate) (#4) This PR contains the following updates:
Package Type Update Change
terraform-linters/tflint-ruleset-aws plugin minor 0.23.1 -> 0.40.0

Release Notes

terraform-linters/tflint-ruleset-aws (terraform-linters/tflint-ruleset-aws)

v0.40.0

Compare Source

What's Changed

Enhancements
Chores

Full Changelog: terraform-linters/tflint-ruleset-aws@v0.39.0...v0.40.0

v0.39.0

Compare Source

What's Changed

Enhancements
Bug Fixes
Chores
Read more

Contributors

goruha and Benbentwo
Loading

v1.536.1

31 May 16:24
@cloudposse-releaser cloudposse-releaser
v1.536.1
7a97e90
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.1

🤖 Automatic Updates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#26) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update README.md and docs @[cloudposse-releaser[bot]](https://github.com/apps/cloudposse-releaser) (#25) ## what This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

chore(deps): update terraform cloudposse/iam-policy/aws to v2 @[renovate[bot]](https://github.com/apps/renovate) (#6) This PR contains the following updates:
Package Type Update Change
cloudposse/iam-policy/aws (source) module major 1.0.1 -> 2.0.2

Release Notes

cloudposse/terraform-aws-iam-policy (cloudposse/iam-policy/aws)

v2.0.2

Compare Source

feat: support policy attachments @​nitrocode (#​52)
what
  • feat: support policy attachments
why
  • It's very convenient to be able to attach managed policies or attach inline policies to roles in a single module
  • All cloudposse modules that use IAM roles and policies have to reinvent this technology and support both inline and managed. For a while, cloudposse defaulted to creating managed policies which isnt best practice. Each module is getting updated to support inline as an option. To make this easier, this module can support a toggle and then this module can be adopted into the other modules to make it easier to support both cases.
references
Update Readme @​Benbentwo (#​46)
what
  • Small appearance tweaks to readme
why
  • cleanup from interpolation by GitHub
🤖 Automatic Updates
Migrate new test account @​osterman (#​51)
what
  • Update .github/settings.yml
  • Update .github/chatops.yml files
why
  • Re-apply .github/settings.yml from org level to get terratest environment
  • Migrate to new test account
References
  • DEV-388 Automate clean up of test account in new organization
  • DEV-387 Update terratest to work on a shared workflow instead of a dispatch action
  • DEV-386 Update terratest to use new testing account with GitHub OIDC
Update .github/settings.yml @​osterman (#​50)
what
  • Update .github/settings.yml
  • Drop .github/auto-release.yml files
why
  • Re-apply .github/settings.yml from org level
  • Use organization level auto-release settings
references
  • DEV-1242 Add protected tags with Repository Rulesets on GitHub
Update release workflow to allow pull-requests: write @​osterman (#​48)
what
  • Update workflow (.github/workflows/release.yaml) to have permission to comment on PR
why
  • So we can support commenting on PRs with a link to the release
Update GitHub Workflows to use shared workflows from '.github' repo @​osterman (#​47)
what
  • Update workflows (.github/workflows) to use shared workflows from .github repo
why
  • Reduce nested levels of reusable workflows
Update GitHub Workflows to Fix ReviewDog TFLint Action @​osterman (#​45)
what
  • Update workflows (.github/workflows) to add issue: write permission needed by ReviewDog tflint action
why
  • The ReviewDog action will comment with line-level suggestions based on linting failures
Update GitHub workflows @​osterman (#​44)
what
  • Update workflows (.github/workflows/settings.yaml)
why
  • Support new readme generation workflow.
  • Generate banners
Use GitHub Action Workflows from `cloudposse/.github` Repo @​osterman (#​41)
what
  • Install latest GitHub Action Workflows
why
  • Use shared workflows from cldouposse/.github repository
  • Simplify management of workflows from centralized hub of configuration
Add GitHub Settings @​osterman (#​36)
what
  • Install a repository config (.github/settings.yaml)
why
  • Programmatically manage GitHub repo settings
Update README.md and docs @​cloudpossebot (#​33)
what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

Update Scaffolding @​osterman (#​34)
what
  • Reran make readme to rebuild README.md from README.yaml
  • Migrate to square badges
  • Add scaffolding for repo settings and Mergify
why
  • Upstream template changed in the .github repo
  • Work better with repository rulesets
  • Modernize look & feel
Update README.md and docs @​cloudpossebot (#​32)
what

This is an auto-generated PR that updates the README.md and docs

why

To have most recent changes of README.md and doc from origin templates

v2.0.1

Compare Source

🐛 Bug Fixes

Remove problematic conditional @​Nuru (#​31)

what

  • Remove problematic conditional

why

  • local.deprecated_statements_values can be a tuple, and Terraform does not have a concept of an empty or null tuple to use as an alternative in a conditional, so you can get an error like:
The true and false result expressions must have consistent types. The 'true' tuple has length 0, but the 'false' tuple has length 2.

references

v2.0.0: Revert breaking change in 1.0, add new breaking change

Compare Source

Revert deprecated input to type "any" @​Nuru (#​30)

Breaking Change

The iam_policy input introduced in v1.0.0 has been changed from type object to type list(object). This allows multiple policy objects to be provided, but more importantly, allows no input or allows the iam_policy input to be used along with the deprecated iam_policy_statements input.

Reversion of Breaking Change

In v1.0.0, the iam_policy_statements input was deprecated, but it was also converted from type any to type map(object), which was how it was documented. However, it was, in practice, allowed to be a list or a map, and many users were supplying lists. This made it an unintentional breaking change for those users.

In this release, iam_policy_statements (while still deprecated) is reverted to type any and accepts both a map and a list.

what

  • Revert iam_policy_statements back to type = any
  • Convert iam_policy input to list
  • Update documentation

why

  • Preserve backward compatibility with pre v1.0 module
  • Enable all inputs to be used in any combination
  • Reflect changes to usage, remove leftovers from initial template

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): update terraform cloudposse/stack-config/yaml to v1.8.0 @[renovate[bot]](https://github.com/apps/...
Read more

Contributors

goruha
Loading

v1.536.0

31 Mar 11:07
@cloudposse-releaser cloudposse-releaser
v1.536.0
5272408
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.536.0
fix: 'Missing required argument' when using image_uri @supersidor (#16) ## what

While applying Lambda component from image_uri next error reported: "s3_key": all of s3_bucket,s3_key must be specified
The reason for this problem is that locals.s3_key is always not null, which conflicts with not null image_url
(see cloudposse/lambda-function/aws).
The solution is to add a additional check when generating locals.s3_key

how to reproduce

components:
  terraform:
    lambda2-test/lambda:
      metadata:
        component: lambda
      vars:
        name: my-service-lambda-test
        service_name: lambda2-test
        package_type: Image
        timeout: 15
        image_uri: "778631511111.dkr.ecr.us-east-1.amazonaws.com/hello:latest"
        image_config:
          command:
            - "test.handler.handler"

why

Lambda component should work with image_url variable

references

Summary by CodeRabbit

  • Chores
    • Updated internal asset handling to better manage image inputs, ensuring more streamlined processing in the background.
Update teams access @goruha (#14) ## what * Update teams access

Summary by CodeRabbit

  • Chores
    • Minor whitespace update in configuration file

Contributors

goruha and supersidor
Loading

v1.535.0

04 Jan 11:26
@goruha goruha
v1.535.0
561fed7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Choose a tag to compare

View all tags
v1.535.0

Migrate component from cloudposse/terraform-aws-components

Loading