terraform-aws-lambda

Production-grade Lambda with packaging, SnapStart, function URLs, event sources, canary deployments, and observability

Terraform ≥ 1.5.0 AWS Provider ≥ 5.20.0 arm64 Default X-Ray + KMS

Executive Summary

This module deploys AWS Lambda functions with comprehensive support for three packaging modes (local Zip via archive_file, S3, and container images from ECR), SnapStart for Java cold start optimization, HTTPS function URLs with configurable CORS, event source mappings for SQS/DynamoDB Streams/Kinesis with filter criteria, async invocation destinations (success/failure), alias-based canary deployments with provisioned concurrency, VPC integration for private subnet deployment, X-Ray tracing, KMS-encrypted environment variables and logs, dead letter queues, and least-privilege IAM execution roles with conditional policies scoped to specific resource ARNs.

Overview

Resources Created

Function, URL, Alias, Concurrency, Event Sources, Destinations, Permissions, CW Logs, IAM

Input Variables

function_name, runtime, handler, packaging, VPC, tracing, events, etc.

Outputs

function_arn, invoke_arn, function_url, alias_arn, role_arn, log_group_arn, etc.

Architectures

arm64

20% cheaper than x86_64 (also supported)

Architecture Diagram

API Gateway
EventBridge / S3 / SNS

Function URL
HTTPS

SQS Queue

Kinesis Stream

DynamoDB Stream

↓

Lambda Function
Zip / Container Image

↓

SnapStart
Java Cold Start

Lambda Layers
Up to 5

VPC Config
Private Subnets

Env Variables
KMS Encrypted

↓

Alias (live)
Versioned

Provisioned
Concurrency

↓

On Success
SNS / SQS / Lambda

On Failure
SNS / SQS / DLQ

CloudWatch Logs
JSON / Text

X-Ray Tracing
Active

Component Breakdown

Lambda Function

Zip packaging: local source_path or S3 bucket/key
Container packaging: ECR image_uri
Runtimes: Python 3.8-3.13, Node.js 16-22, Java 8-21, .NET 6-8, Ruby, Go, custom
arm64 default architecture (20% cost savings)
Memory: 128 MB - 10,240 MB; Timeout: 1-900 seconds

Event Sources & Triggers

Event source mappings: SQS, DynamoDB Streams, Kinesis
Filter criteria for event pattern matching
Batch size, windowing, bisect on error
Lambda permissions for API Gateway, EventBridge, S3, SNS
Function URL with CORS and AWS_IAM or NONE auth

Deployment & Scaling

Alias-based deployments (e.g., "live")
Provisioned concurrency for consistent latency
SnapStart for Java cold start optimization
Reserved concurrent executions for throttle control
Auto-publish versions when alias or provisioned concurrency configured

Observability & Security

X-Ray tracing (Active or PassThrough mode)
CloudWatch Logs with configurable retention (1-3653 days)
JSON or Text log format
KMS encryption for env vars and logs
Dead letter queue (SNS or SQS)
Least-privilege IAM with conditional policy attachments

Data Flow

Event sources (API Gateway, SQS, Kinesis, etc.) invoke the Lambda function
Lambda permission resources authorize each trigger service
Function URL provides direct HTTPS access with optional CORS
Event source mappings poll SQS/Kinesis/DDB Streams and invoke in batches
Function executes with environment variables decrypted from KMS at runtime
Async invocations route success/failure to configured destinations
Failed events can be sent to dead letter queue (SNS/SQS)
X-Ray traces and CloudWatch Logs capture execution telemetry

Security Controls

Control	Implementation	Default
IAM Execution Role	Least-privilege with conditional policies	Auto-created
Env Var Encryption	KMS customer-managed key	`kms_key_arn=null` (optional)
Log Encryption	KMS-encrypted CloudWatch Log Group	Same KMS key
VPC Isolation	Private subnet + security group deployment	`vpc_config=null`
Function URL Auth	AWS_IAM or NONE	`AWS_IAM`
Dead Letter Queue	SNS or SQS for failed invocations	`null`
Concurrency Limit	Reserved concurrent executions	`-1` (unreserved)
No Wildcard IAM	Event source permissions scoped to resource ARNs	Always enforced

Industry Adaptation

API Backend / Microservices

Function URL or API Gateway trigger
Provisioned concurrency for low latency
Alias-based canary deployments
X-Ray tracing for distributed tracing

Event Processing Pipeline

SQS/Kinesis event source mappings
Filter criteria to reduce invocations
Batch processing with bisect on error
DLQ for poison message handling

Enterprise Java (SnapStart)

SnapStart for sub-second cold starts
Java 11/17/21 runtimes
S3-based deployment packages
Alias-based version management

Production Readiness Checklist

Set appropriate timeout and memory_size for workload
Use arm64 architecture for cost savings
Configure kms_key_arn for env var and log encryption
Set dead_letter_target_arn for async invocations
Use reserved_concurrent_executions to limit blast radius
Enable enable_xray_tracing = true
Set log_retention_days ≥ 90 for compliance
Use AWS_IAM auth for function URLs in production
Configure event source filter_criteria to reduce cost
Deploy with alias + provisioned concurrency for production traffic

Configuration Reference

Key Inputs

Variable	Type	Default	Description
`function_name`	string	--	Unique function name (required)
`runtime`	string	`null`	Runtime (python3.12, nodejs20.x, java21, etc.)
`handler`	string	`null`	Entry point (e.g., index.handler)
`architectures`	list(string)	`["arm64"]`	CPU architecture
`memory_size`	number	`128`	MB (128-10240)
`timeout`	number	`30`	Seconds (1-900)
`package_type`	string	`Zip`	Zip or Image
`enable_function_url`	bool	`false`	Create HTTPS endpoint
`enable_snapstart`	bool	`false`	Java cold start optimization
`enable_xray_tracing`	bool	`true`	X-Ray tracing
`event_source_mappings`	list(object)	`[]`	SQS/Kinesis/DDB mappings
`provisioned_concurrency`	number	`0`	Pre-warmed executions

Key Outputs

Output	Description
`function_arn`	Lambda function ARN
`invoke_arn`	ARN for API Gateway invocation
`function_url`	HTTPS endpoint URL
`alias_arn`	Alias ARN
`role_arn`	Execution IAM role ARN
`log_group_name`	CloudWatch Log Group name

Deployment

# Initialize
terraform init

# Plan
terraform plan -var-file="lambda.tfvars"

# Apply
terraform apply -var-file="lambda.tfvars"

# Test invocation
aws lambda invoke \
  --function-name <function_name> \
  --payload '{"key":"value"}' \
  response.json

# Check logs
aws logs tail /aws/lambda/<function_name> --follow