terraform-provider-aws 3.13.0 and later including 3.25.0 cause lambdas in a VPC to be updated on every apply

[akloss-cibo]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

% ../terraform version
Terraform v0.14.5
+ provider registry.terraform.io/hashicorp/aws v3.25.0
%

Affected Resource(s)

• aws_lambda_function
• aws_iam_role 👈 I have observed a similar problem with aws_iam_role in 3.12.0 as well.

Terraform Configuration Files

resource "aws_lambda_function" "function" {
  function_name    = "test-lambda"
  handler          = "cloudfront_alert.handler"
  publish          = true
  filename         = "lambda.zip"
  source_code_hash = filebase64sha256("lambda.zip")
  runtime          = "nodejs10.x"
  role = "arn:aws:iam::4********:role/AWSLambdaVPCAccessExecution"
  # Lambda's without vpc_config do not appear to be affected
  vpc_config {
    security_group_ids = [
      "sg-0*********",
    ]
    subnet_ids         = [
      "subnet-0c***********,
    ]
  }
}
provider "aws" {
  profile = "default"
  region  = "us-east-1"
}

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
      version = "3.13.0"
    }
  }
}

Debug Output

The debug output has a lot of sensitive data in it, including AWS credentials, so I'm including regular output.

https://gist.github.com/akloss-cibo/6eaf77d79ea9d91837baa94fca74173d

Expected Behavior

The lambda function should be updated once, and then left alone.

Actual Behavior

In every apply, the lambda function shows a change, which is then applied although is functionally a no-op.

Steps to Reproduce

1. Create a file, lambda.tf with terraform config from above. Substitute in a correct IAM role, and correct VPC information
2. Run zip lambda.zip lambda.tf to create a dummy zip
3. Run terraform init
4. Run terraform apply -auto-approve to create the lambda function
5. Run terraform apply again. Observe that the plan shows a trivial change. Apply that change. Repeat.

References

• Update plan output to reflect publish(version, qualified_arn) when config changes #15121

[kitos9112]

Hi, hitting this issue as well. Strangely enough it only happens when a Lambda function is configured with VPC settings. It's super annoying because it's forcing codeDeploy deployments every time :(

❯ terraform --version
Terraform v0.14.6
+ provider registry.terraform.io/hashicorp/aws v3.25.0
+ provider registry.terraform.io/hashicorp/external v2.0.0
+ provider registry.terraform.io/hashicorp/local v2.0.0
+ provider registry.terraform.io/hashicorp/null v3.0.0
+ provider registry.terraform.io/hashicorp/random v3.0.1

After having initialized the module and applied it. No changes to the resources, and trigger a terraform apply:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.lambda_function_no_vpc_instantdeploy.module.lambda_function.aws_lambda_function.this[0] will be updated in-place
  ~ resource "aws_lambda_function" "this" {
        id                             = "TestLambdaVPC-"
      ~ qualified_arn                  = "arn:aws:lambda:eu-west-2:12345678:function:TestLambdaVPC:3" -> (known after apply)
        tags                           = {}
      ~ version                        = "3" -> (known after apply)
        # (18 unchanged attributes hidden)
        # (3 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[askaribragimov]

Looks like without publish = true it does not happen. But publish = true is required if you need Provisioned Concurrency. So, still a problem

[bill-rich]

Hi @akloss-cibo & @kitos9112,
I haven't been able to reproduce this issue with the provided configuration. Is anyone still experiencing this problem? If so, please post a copy of your configuration to help with reproducing the issue.

[kitos9112]

@bill-rich haven't tested it with the new provider yet. I'll give it a go this morning and comment back.

[akloss-cibo]

Fixed for me starting in 3.45.0.

[breathingdust]

This seems to have been resolved, so closing for now. 👍 Please comment on the issue to reopen if this behaviour can be demonstrated in a version greater than 3.45.0.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.