Question 81331 in Docker Question posted in
The official documentation can be found here.

Terraform: AWS Lambda with Image not updating – Docker

We have a new terraform script that is pushing a docker image to an AWS Lambda. The script works well and correctly connects the fresh image to the Lambda. I can confirm this by checking the Image URL as shown in the AWS console for the Lambda and it is the newly pushed+connected image. However when testing the lambda it is clearly running the prior code. It seems like the Lambda has been updated but the running in-memory instances didnt get the message.
Question: is there a way to force the in-memory Lambdas to be cycled to the new image?

Here is our TF code for the Lambda:

resource "aws_lambda_function" "my_lambda" {
  function_name = "MyLambda_${var.environment}"
  role          = data.aws_iam_role.iam_for_lambda.arn
  image_uri     = "${data.aws_ecr_repository.my_image.repository_url}:latest"
  memory_size   = 512
  timeout       = 300
  architectures = ["x86_64"]
  package_type  = "Image"
  environment {variables = {stage = var.environment, commit_hash=var.commit_hash}}
}
Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    After more searching I found some discussions (here) that mention the source_code_hash option in terraform for the Lambda creation block (docs here). Its mostly used with a SHA hash of the zip file used for pushing code from an S3 bucket, but in our case we are using a container/image so there is not really a file to get a hash from. However, it turns out that it is just a string that Lambda checks for changes. So we added the following:

    resource "aws_lambda_function" "my_lambda" {
  function_name = "MyLambda_${var.environment}"
  role          = data.aws_iam_role.iam_for_lambda.arn
  image_uri     = "${data.aws_ecr_repository.my_image.repository_url}:latest"
  memory_size   = 512
  timeout       = 300
  architectures = ["x86_64"]
  package_type  = "Image"
  environment {variables = {stage = var.environment, commit_hash=var.commit_hash}}
  source_code_hash = var.commit_hash  << New line
}

    And we use a bitbucket pipeline to inject the git hash into the terraform apply operation. This fix allowed the Lambda to correctly update the running version.


  2. 0

    Alternatively, if you don’t want to depend on bitbucket for this, you can add a data source for the ECR image:

    data "aws_ecr_image" "repo_image" {
  repository_name = "repo-name"
  image_tag = "tag"
}

    And then use its id as a source code hash like this:

    source_code_hash = trimprefix(data.aws_ecr_image.repo_image.id, "sha256:")
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search