r/Terraform • u/Exotic-Analysis347 • 1d ago

AWS AWS Lambda S3 Reference-Mode Terraform module

https://registry.terraform.io/modules/aquavis12/lambda-s3-reference/aws/latest

Terraform module which creates a Lambda function that runs in reference mode: the function reads its deployment package directly from an S3 bucket you own, and GitHub Actions deploys new code through an OIDC-trusted role. The module also provisions the artifact bucket, the IAM roles, the GitHub OIDC trust, and an optional deny policy that blocks direct console or CLI edits.

0 Upvotes

25% Upvoted

2 comments sorted by

2

u/vincentdesmet 1d ago

what if the artifact bucket belongs to a platform team?
does this module handle bundling?
what if the lambda needs to hook into, any or several of:

  • stepfunctions target
  • API GW integration target (function body changes should trigger re-deployment)
  • s3 bucket notification target
  • eventBridge target (let’s say if i want to filter on the s3 payload body?)
  • sqs target?
-…

I’m curious to know how modules could handle this?

-5

u/Exotic-Analysis347 1d ago

Platform-owned bucket: Module creates its own today, so it'd clash. Fix is a "bring your own bucket" toggle where the platform team owns the bucket + policy. Catch: bucket policy is one resource per bucket, so a shared bucket needs one broad functions/* grant instead of each app overwriting it.

Bundling: No, on purpose. It takes a pre-built zip. Building is the pipeline's job, and Terraform ignores code changes after the first deploy anyway.

Hooking into other services: The module hands you the function ARN + invoke ARN + role, you wire targets around it.

  • Step Functions / API Gateway → added both as opt-in flags.
  • API GW redeploy on code change → can't come from Terraform. Reference mode hides code changes from it, so that trigger lives in CI.
  • S3 / EventBridge / SNS → just need an invoke permission, added an allowed_invokers input for that.
  • EventBridge on the S3 body → heads up, not possible. It only sees the envelope (bucket, key, size), never contents. Filter on key/prefix and inspect inside the Lambda.
  • SQS → event source mapping (Terraform owns it fine) + queue perms on the role.