hashicorp / learn-terraform-lambda-api-gateway

Learn Terraform - Lambda functions and API Gateway

AWS Lambda functions and API gateway are often used to create serverless applications.

This repo is a companion repo to the AWS Lambda functions and API gateway tutorial.

learn-terraform-lambda-api-gateway's Issues

terraform apply fails

Hello Team,

terraform init is successful but terraform apply fails. please check the below error details

Error: Value for unconfigurable attribute
│ 
│   with aws_s3_bucket.lambda_bucket,
│   on main.tf line 32, in resource "aws_s3_bucket" "lambda_bucket":
│   32:   acl           = "private"
│ 
│ Can't configure a value for "acl": its value will be decided automatically based on the result of applying this configuration.
╵

Please check and any help will be appreciated...

NodeJS 12 is no longer supported

Following the tutorial I get the following error:

│ Error: creating Lambda Function (HelloWorld): operation error Lambda: CreateFunction, https response error StatusCode: 400, RequestID: ed29b9a6-a01c-412c-a1e8-0cfde427101a, InvalidParameterValueException: The runtime parameter of nodejs12.x is no longer supported for creating or updating AWS Lambda functions. We recommend you use the new runtime (nodejs18.x) while creating or updating functions.

Fix: To fix the issue I updated both the provider (~> 5.37.0) and the runtime (nodejs20.x). Maybe just changing the runtime on the docs to (nodejs18.x) would be enough, I just think it may worth update both anyway.

Error: Value for unconfigurable attribute

learn-terraform-lambda-api-gateway/main.tf

Line 32 in ed4863b

acl = "private"

When running Terraform Apply I get the following error:
Error: Value for unconfigurable attribute │ │ with aws_s3_bucket.lambda_bucket, │ on main.tf line 32, in resource "aws_s3_bucket" "lambda_bucket": │ 32: acl = "private" │ │ Can't configure a value for "acl": its value will be decided automatically │ based on the result of applying this configuration.

This is most likely due to deprecated acl parameter.
Workaround/fix: According to AWS S3 bucket provider docs ACL can be configured as a standalone resource aws_s3_bucket_acl

Tutorial leads to `is not authorized to perform: lambda:ListVersionsByFunction` error [Fix included in description]

With the lambda resource described in the tutorial, terraform encounters the following error:

╷
│ Error: reading Lambda Function (HelloWorld) latest version: operation error Lambda: ListVersionsByFunction, 
https response error StatusCode: 403, RequestID: 17d6bae4-1caa-47bb-8483-68d61e3e99fe, api error 
AccessDeniedException: User: arn:aws:iam::339712767340:user/dboardman is not authorized to perform: 
lambda:ListVersionsByFunction on resource: arn:aws:lambda:us-east-1:339712767340:function:HelloWorld because 
no identity-based policy allows the lambda:ListVersionsByFunction action

This is not alleviated by any of the IAM policies you can attach to your Group or User. For instance the AWSLambda_FullAccess contains the lambda:* permissions (all policy permissions). You still encounter the error.

I found a stack overflow thread that describes why this is the case.

Below is an addition that can be added to the example code (and hopefully the tutorial), that will correct this error.

resource "aws_iam_role_policy" "lambda_list_versions" {
  name = "lambda_list_versions"
  role = aws_iam_role.lambda_exec.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "lambda:ListVersionsByFunction"
        Effect = "Allow"
        Resource = "${aws_lambda_function.hello_world.arn}"
      }
    ]
  })
}

You can find this permission in IAM -> Roles -> serverless_lambda. You should see this lambda_list_versions permissions policy.