Terraform部署后Lambda Layer内容与S3对象不符问题求助

手动将layer.zip上传到S3后，从S3关联创建Lambda Layer可正常获取正确内容，但用Terraform部署时，S3对象和Lambda Layer版本都显示更新了，但Lambda Layer的实际内容却和S3里的layer.zip不一致。

Terraform配置 #

resource "aws_s3_object" "lambda_layer" {
  bucket              = "cps-request-handler-${var.environment}"
  key                 = "layers.zip"
  source              = "../../../layers.zip"
  etag                = filemd5("../../../layers.zip")
}

resource "aws_lambda_layer_version" "lambda_layer" {
  layer_name          = "cps-request-handler-python"
  s3_bucket           = "cps-request-handler-${var.environment}"
  s3_key              = "layers.zip"
  compatible_runtimes = ["python3.9"]
  description         = "cps-lambda-layer"
  source_code_hash    = filemd5("../../../layers.zip")
}

Terraform执行日志 #

# module.cps-request-handler-kmg-platform-dev.aws_lambda_layer_version.lambda_layer must be replaced
-/+ resource "aws_lambda_layer_version" "lambda_layer" {
      ~ arn                         = "arn:aws:lambda:ap-southeast-2:24:layer:cps-request-handler-python:54" -> (known after apply)
      ~ code_sha256                 = "vanSi466wd7U=" -> (known after apply)
      - compatible_architectures    = [] -> null
      ~ created_date                = "2024-07-08T03:46:08.644+0000" -> (known after apply)
      ~ id                          = "arn:aws:lambda:ap-sou2:layer:cps-request-handler-python:54" -> (known after apply)
      ~ layer_arn                   = "arn:aws:lambda:ap-south2:layer:cps-request-handler-python" -> (known after apply)
      + signing_job_arn             = (known after apply)
      + signing_profile_version_arn = (known after apply)
      ~ source_code_hash            = "b2b5e003591a1dfa31ec684e" -> "112932d48ce97717736487" # forces replacement
      ~ source_code_size            = 61591646 -> (known after apply)
      ~ version                     = "54" -> (known after apply)
        # (7 unchanged attributes hidden)
    }

  # module.cps-confluent-request-handler-kmg-platform-dev.aws_s3_object.lambda_layer will be updated in-place
  ~ resource "aws_s3_object" "lambda_layer" {
      ~ etag                          = "e1f4a9f539372def76d5307d9" -> "112932d48ce97717736487"
        id                            = "layers.zip"
        tags                          = {}
      ~ version_id                    = "3HU.4GNHsj.iASru5O" -> (known after apply)
        # (23 unchanged attributes hidden)
    }

核心原因 #

Terraform执行时，Lambda Layer的创建/更新操作可能先于S3对象的更新完成。当前配置没有明确的依赖关系，Terraform可能并行执行两个资源的操作，导致Lambda Layer读取的仍是S3里的旧版本文件。

修复步骤 #

1. 添加显式依赖关系
   在aws_lambda_layer_version资源中加入depends_on，确保S3对象更新完成后再处理Lambda Layer：

   resource "aws_lambda_layer_version" "lambda_layer" {
     layer_name          = "cps-request-handler-python"
     s3_bucket           = "cps-request-handler-${var.environment}"
     s3_key              = "layers.zip"
     compatible_runtimes = ["python3.9"]
     description         = "cps-lambda-layer"
     source_code_hash    = filemd5("../../../layers.zip")
     # 添加依赖，确保S3对象更新完成后再处理Layer
     depends_on = [aws_s3_object.lambda_layer]
   }
   

2. 改用S3对象的ETAG作为source_code_hash（可选优化）
   直接引用S3对象的ETAG值，避免本地文件哈希与S3文件哈希不一致的潜在问题，同时简化配置：

   # S3对象配置：去掉手动指定的etag，让Terraform自动计算
   resource "aws_s3_object" "lambda_layer" {
     bucket              = "cps-request-handler-${var.environment}"
     key                 = "layers.zip"
     source              = "../../../layers.zip"
   }
   
   # Lambda Layer配置：引用S3对象的属性
   resource "aws_lambda_layer_version" "lambda_layer" {
     layer_name          = "cps-request-handler-python"
     s3_bucket           = aws_s3_object.lambda_layer.bucket
     s3_key              = aws_s3_object.lambda_layer.key
     compatible_runtimes = ["python3.9"]
     description         = "cps-lambda-layer"
     source_code_hash    = aws_s3_object.lambda_layer.etag
     depends_on = [aws_s3_object.lambda_layer]
   }
   

3. 验证执行顺序
   重新执行terraform plan，确认S3对象的更新操作会先于Lambda Layer的替换操作执行，确保Lambda Layer读取的是最新的S3文件。

额外注意事项 #

如果S3桶启用了版本控制，可通过aws_s3_object.lambda_layer.version_id引用最新版本ID，在Lambda Layer配置中指定s3_object_version，进一步确保读取的是目标版本文件：

resource "aws_lambda_layer_version" "lambda_layer" {
  # ...其他配置
  s3_object_version = aws_s3_object.lambda_layer.version_id
}

内容的提问来源于stack exchange，提问作者sindhu yr