如何在Terraform中压缩文件夹而非内容构建AWS Lambda Layer

问题原因 #

你的Terraform代码生成的Lambda Layer压缩包不符合AWS要求：Lambda运行时需要Layer的zip包内根目录存在名为python的文件夹，所有依赖必须放在这个文件夹下。但当前代码直接压缩python文件夹内的内容，导致解压后没有python目录，Python无法找到导入的模块，从而抛出Runtime.ImportModuleError。

解决方案 #

需要修改Terraform的archive_file配置，确保打包时将python文件夹本身包含在zip根目录中，同时添加清理步骤避免残留文件干扰：

1. 调整null_resource的清理与安装命令 #

在安装依赖前先清理旧的python目录和python.zip文件，保证每次构建都是干净的：

resource "null_resource" "lambda_layer" {
  triggers = {
    requirements = filesha1("${path.module}/files/requirements.txt")
  }

  provisioner "local-exec" {
    command = <<EOT
      rm -rf ${path.module}/python ${path.module}/python.zip
      python3 -m pip install -r ${path.module}/files/requirements.txt -t ${path.module}/python
    EOT
  }
}

2. 修改archive_file的打包配置 #

将source_dir指向path.module（python文件夹的父目录），并指定只打包python文件夹，这样生成的zip根目录会包含python目录：

data "archive_file" "layer" {
  type         = "zip"
  source_dir   = "${path.module}"
  source_files = ["python"]
  output_path  = "${path.module}/python.zip"
  depends_on   = [null_resource.lambda_layer]
}

完整修改后的代码片段 #

# Lambda函数定义
resource "aws_lambda_function" "sql_automation_lambda" {
  function_name    = "${var.project_name}${var.environment}-NAME"
  handler          = "lambda_handler.lambda_handler"
  role             = IAM_ROLE
  runtime          = "python3.9"
  filename         = PATH
  layers           = [aws_lambda_layer_version.my_layer.arn]
}

# 生成Layer依赖并清理旧文件
resource "null_resource" "lambda_layer" {
  triggers = {
    requirements = filesha1("${path.module}/files/requirements.txt")
  }

  provisioner "local-exec" {
    command = <<EOT
      rm -rf ${path.module}/python ${path.module}/python.zip
      python3 -m pip install -r ${path.module}/files/requirements.txt -t ${path.module}/python
    EOT
  }
}

# 打包Layer内容（包含python目录）
data "archive_file" "layer" {
  type         = "zip"
  source_dir   = "${path.module}"
  source_files = ["python"]
  output_path  = "${path.module}/python.zip"
  depends_on   = [null_resource.lambda_layer]
}

# 创建Lambda Layer版本
resource "aws_lambda_layer_version" "my_layer" {
  layer_name          = "python"
  filename            = data.archive_file.layer.output_path
  source_code_hash    = data.archive_file.layer.output_base64sha256
  compatible_runtimes = ["python3.11", "python3.10", "python3.8", "python3.9", "python3.7"]
}

验证 #

修改后重新执行terraform apply，生成的python.zip解压后根目录会包含python文件夹，Lambda运行时就能正确识别并导入依赖模块了。

内容的提问来源于stack exchange，提问作者polo