Terraform Cloud创建AWS Lambda遇ValidationException，AWS CLI执行成功

问题说明 #

在Terraform Cloud中执行terraform apply创建AWS Lambda函数资源时，操作因无具体描述的ValidationException失败，仅返回400状态码，无其他错误细节。该问题在terraform-provider-aws的仓库中已有对应issue记录。

Lambda函数的Terraform配置 #

module "lambda" {
  source  = "terraform-aws-modules/lambda/aws"
  version = "~> 4.7"

  function_name = "${module.this.s3_bucket_id}-to-cloudwatch"

  handler = "index.handler"
  runtime = "nodejs12.x"
  timeout = 60

  create_package         = false
  local_existing_package = "${path.module}/assets/code.zip"

  environment_variables = {
    LOG_GROUP_NAME     = aws_cloudwatch_log_group.log_group.name
    LOAD_BALANCER_TYPE = var.load_balancer_type
  }

  allowed_triggers = {
    S3EventPermission = {
      principal  = "s3.amazonaws.com"
      source_arn = module.this.s3_bucket_arn
    }
  }

  role_path   = "/tf-managed/"
  policy_path = "/tf-managed/"

  attach_cloudwatch_logs_policy = true
  attach_tracing_policy         = true
  tracing_mode                  = "active"

  attach_policy_statements = true
  policy_statements = {
    describe_log_groups = {
      effect    = "Allow"
      actions   = ["logs:DescribeLogGroups"]
      resources = ["*"]
    }

    create_logs = {
      effect = "Allow"
      actions = [
        "logs:DescribeLogStreams",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
      ]
      resources = [aws_cloudwatch_log_group.log_group.arn]
    }

    get_logs = {
      effect    = "Allow"
      actions   = ["s3:GetObject"]
      resources = ["${module.this.s3_bucket_arn}/*"]
    }
  }
}

Terraform Plan输出内容 #

# module.cluster_nlb.module.log_bucket.module.lambda.aws_lambda_function.this[0] will be created
  + resource "aws_lambda_function" "this" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + filename                       = "../../../modules/lb-log-bucket-with-cloudwatch-export/assets/code.zip"
      + function_name                  = "nlb-access-logs-04916534-to-cloudwatch"
      + handler                        = "index.handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = "arn:aws:iam::585685634436:role/tf-managed/nlb-access-logs-04916534-to-cloudwatch"
      + runtime                        = "nodejs12.x"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + source_code_hash               = "/pwL7Szm/wc/8dP8/Relzc8vy7nkAUQm9jtvgfWJa5c="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 60
      + version                        = (known after apply)

      + environment {
          + variables = {
              + "LOAD_BALANCER_TYPE" = "network"
              + "LOG_GROUP_NAME"     = "/aws/elb/network"
            }
        }

      + ephemeral_storage {
          + size = 512
        }

      + tracing_config {
          + mode = "active"
        }
    }

Terraform Cloud返回的错误信息 #

Error: error creating Lambda Function (1): ValidationException: status code: 400, request id: [...]
with module.cluster_alb.module.log_bucket.module.lambda.aws_lambda_function.this[0]
on .terraform/modules/cluster_alb.log_bucket.lambda/main.tf line 24, in resource "aws_lambda_function" "this":

resource "aws_lambda_function" "this" {

排查操作 #

为获取更详细的错误信息，使用AWS CLI的lambda create-function命令复现该计划的执行，命令执行成功，可正常创建Lambda函数。

使用的AWS CLI命令：

aws lambda create-function \
  --zip-file fileb://../../../modules/lb-log-bucket-with-cloudwatch-export/assets/code.zip \
  --function-name 'nlb-access-logs-04916534-to-cloudwatch' \
  --handler 'index.handler' \
  --memory-size '128' \
  --package-type 'Zip' \
  --no-publish \
  --role 'arn:aws:iam::585685634436:role/tf-managed/nlb-access-logs-04916534-to-cloudwatch' \
  --runtime 'nodejs12.x' \
  --timeout '60' \
  --environment 'Variables={LOG_GROUP_NAME=/aws/elb/network,LOAD_BALANCER_TYPE=network}' \
  --tracing-config 'Mode=Active' \
  --description '' \
  --debug

目前未发现AWS CLI命令与Terraform配置之间存在差异，无法确定Terraform中验证失败的具体原因。

内容的提问来源于stack exchange，提问作者Draon con Color