aws_lambda_function apply fails when role cannot be assumed

[camlow325]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

› terraform -v
Terraform v0.12.20
+ provider.aws v2.69.0

Affected Resource(s)

• aws_lambda_function

Terraform Configuration Files

data "archive_file" "lambda_zip" {
  type        = "zip"
  output_path = "/tmp/lambda.zip"
  source {
    content  = <<EOF
def lambda_handler(event,context):
    print("hello world")
EOF
    filename = "main.py"
  }
}

resource "aws_lambda_function" "test" {
  function_name    = "test"
  handler          = "main.lambda_handler"
  filename         = data.archive_file.lambda_zip.output_path
  source_code_hash = data.archive_file.lambda_zip.output_base64sha256
  role             = aws_iam_role.test.arn
  runtime          = "python3.6"
}

resource "aws_iam_role" "test" {
  name = "test"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

Debug Output

Panic Output

Expected Behavior

Lambda and role created successfully and the terraform apply should succeed.

Actual Behavior

Most of the time, the expected behavior occurs. Intermittently, though, the role is created successfully in AWS but the lambda function fails to be created properly, with the following error in the terraform apply output:

Error: Error creating Lambda function: InvalidParameterValueException: The role defined for the function cannot be assumed by Lambda.
{
  RespMetadata: {
    StatusCode: 400,
    RequestID: "xxx"
  },
  Message_: "The role defined for the function cannot be assumed by Lambda.",
  Type: "User"
}

  on main.tf line xxx, in resource "aws_lambda_function" "this":
   7: resource "aws_lambda_function" "this" {

Steps to Reproduce

1. terraform apply

Important Factoids

In each case where the failure has occurred, a Terraform apply attempted just after the first failed apply has been successful for us.

From looking at the Terraform output, it appears that the provider makes CreateFunction calls to AWS for up to one minute before failing. #3765 appears to have the change which constrained the retries to 1 minute. Perhaps this could be bumped up to allow a bit more time for the lambda creation to hopefully succeed.

References

• resource/aws_lambda_function: Only retry IAM errors for one minute #3765

[bflad]

The fix to use our standard 2 minute IAM retry timeout has been merged and will release with version 3.0.0 of the Terraform AWS Provider, likely in about a week. Thanks to @camlow325 for the implementation. 👍

[ghost]

This has been released in version 3.0.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!