Ability to ignore changes to image_uri when function updates are performed outside of Terraform

[danielwhatmuff]

Is your request related to a new offering from AWS?

No

Is your request related to a problem? Please describe.

When managing docker/ECR based lambda deployments outside of Terraform (e.g. through CI/CD using the AWS CLI aws lambda update-function-code --image-uri ...) it would be good to have the ability to ignore image_uri.

This would enable consumers to continue making changes to function configuration and IAM policy etc using Terraform but continously deploy new image versions to the function via CI/CD.

Describe the solution you'd like.

Support a new boolean variable to ignore changes to image_uri e.g. ignore_image_uri. Similar to the ignore_source_code_hash variable used for ignoring changes to zip based functions. Due to the frustrating limitation of not being able to conditionally define lifecycle ignore_changes, this would likely need to be two lambda resource blocks - one with, one without the ignore.

Describe alternatives you've considered.

No known alternative, ignore_source_code_hash does not ignore changes to image_uri.

Additional context

A workflow I use to manage Lambda functions is to initially provision functions using Terraform with a placeholder image held in ECR and then setup CI/CD to iterate the docker image version. When changes to IAM policy or concurrency are made in Terraform there is unwanted drift detected with image_uri.

[StanDeeks]

Would also love this.

[github-actions[bot]]

This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days

[jgalliers]

Commenting here to remove stale, this is absolutely a requirement for our use case also. We need to initialise the "shell" of the lambda using Terraform but then use a separate CI/CD process to actually build and release the referenced container

[johnecapps]

+1

I'll fork this for now and make my own edits since I'll never need to track the image_uri.

[fergo2910]

+1 Also forking since I do need this change too. It's important to have it

[apenney]

+1, this would be very helpful!

[github-actions[bot]]

This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days

[jussapaavo]

Not stale, also looking for solution to this.

[tylerbartlett-fq]

i cant use this because of this same issue, environment variables as well.

[github-actions[bot]]

This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days

[ggrangia]

+1

[young-arbital]

+1

[ntse]

For anyone who needs a workaround, this is what I do:

module "foo" {
  source  = "terraform-aws-modules/lambda/aws"

  function_name = "foo"
  image_uri     = "${var.image_uri}:${data.aws_ssm_parameter.image_tag.value}"

  [...]
}

resource "aws_ssm_parameter" "image_tag" {
  name  = "/lambdas/foo/image_tag"
  type  = "String"
  value = "latest"

  lifecycle {
    ignore_changes = [value]
  }
}

data "aws_ssm_parameter" "image_tag" {
  name = aws_ssm_parameter.image_tag.name
}

The application's pipeline builds and pushes a new container image to ECR, then calls aws lambda update-function-code to point the Lambda to that image. It also updates the image_tag SSM parameter so that Terraform’s computed image_uri remains in sync, avoiding drift while still letting Terraform manage the function’s other config.

[simonweil]

We are facing this issue too @fergo2910 @johnecapps can you share your fork?

[lumenisaac]

Also facing this issue.

[juliancuretti-bc]

+1

[ofirshtrull]

Can't we just mimic the ignore_source_code_hash? Sadly, I cannot do it as I need the fix for an older version, as I cannot upgrade the aws provider, so I cannot test this

But I found a quick workaround

data "aws_lambda_function" "api_function_xsmall" {
  count         = local.create_xsmall_lambda ? 1 : 0
  function_name = format("%s-api-xsmall", var.env)
}

Then added to the module

image_uri      = coalesce(try(data.aws_lambda_function.api_function_xsmall[0].image_uri, null), local.lambda_image_uri)

So if it's the first time installing it will take the version of latest version or anything else you want, but after that it will always take the current version

[talsh-oasis]

+1 This can be very useful.

[axel-wejungle]

+1 Here i need ignore env variables