AWS Lambda Example based on Teraform

AWS Lambda is a serverless compute service that lets you run code without provisioning or managing servers. You can upload your code and Lambda will automatically run it in response to events, such as HTTP requests, file uploads, or database changes. This allows you to focus on your code and let AWS handle the infrastructure, scaling, and security. 
 

Here’s a simple example of deploying an AWS Lambda function using Terraform. This example will cover creating a Lambda function, an IAM role for execution, and configuring the function to trigger from an API Gateway endpoint.

Example: AWS Lambda with API Gateway

This example will:

1. Create an AWS Lambda function.
2. Create an IAM role with necessary permissions for the Lambda function.
3. Set up an API Gateway to trigger the Lambda function via an HTTP endpoint.

Prerequisites

Make sure you have:

• A zip file with your Lambda function code, which we’ll reference in the example.
• Basic knowledge of AWS services and Terraform setup.

Step 1: Define Variables (variables.tf)

Define any required variables to keep the configuration flexible.

variable "lambda_function_name" {
  default     = "example-lambda-function"
  description = "Name of the Lambda function"
}

variable "lambda_handler" {
  default     = "lambda_function.lambda_handler"
  description = "Handler for the Lambda function"
}

variable "lambda_runtime" {
  default     = "python3.8"
  description = "Runtime environment for Lambda"
}

variable "lambda_role_name" {
  default     = "lambda_execution_role"
  description = "IAM role for Lambda execution"
}

variable "lambda_zip_file" {
  default     = "./lambda_function.zip"
  description = "Path to the zip file containing the Lambda code"
}

Step 2: Create the IAM Role for Lambda Execution (main.tf)

The Lambda function needs an execution role that allows it to log to CloudWatch.

resource "aws_iam_role" "lambda_execution_role" {
  name = var.lambda_role_name

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Action = "sts:AssumeRole",
        Effect = "Allow",
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "lambda_execution_role_policy" {
  role       = aws_iam_role.lambda_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

Step 3: Create the Lambda Function

Use the aws_lambda_function resource to deploy the Lambda function.

resource "aws_lambda_function" "example_lambda" {
  function_name = var.lambda_function_name
  role          = aws_iam_role.lambda_execution_role.arn
  handler       = var.lambda_handler
  runtime       = var.lambda_runtime

  # Specify the path to the zip file containing the Lambda function code
  filename = var.lambda_zip_file

  # Environment variables (optional)
  environment {
    variables = {
      LOG_LEVEL = "info"
    }
  }
}

Step 4: Set Up API Gateway to Trigger the Lambda Function

This will create an API Gateway endpoint that triggers the Lambda function when accessed via HTTP.

# Create the API Gateway REST API
resource "aws_apigatewayv2_api" "lambda_api" {
  name          = "example-api"
  protocol_type = "HTTP"
}

# Integrate the API Gateway with the Lambda function
resource "aws_apigatewayv2_integration" "lambda_integration" {
  api_id           = aws_apigatewayv2_api.lambda_api.id
  integration_type = "AWS_PROXY"
  integration_uri  = aws_lambda_function.example_lambda.invoke_arn
  integration_method = "POST"
  payload_format_version = "2.0"
}

# Create a route to connect API Gateway with Lambda
resource "aws_apigatewayv2_route" "default_route" {
  api_id    = aws_apigatewayv2_api.lambda_api.id
  route_key = "$default"
  target    = "integrations/${aws_apigatewayv2_integration.lambda_integration.id}"
}

# Deploy the API Gateway
resource "aws_apigatewayv2_stage" "api_stage" {
  api_id      = aws_apigatewayv2_api.lambda_api.id
  name        = "$default"
  auto_deploy = true
}

# Grant API Gateway permission to invoke the Lambda function
resource "aws_lambda_permission" "apigw_lambda" {
  statement_id  = "AllowAPIGatewayInvoke"
  action        = "lambda:InvokeFunction"
  function_name = aws_lambda_function.example_lambda.function_name
  principal     = "apigateway.amazonaws.com"
  source_arn    = "${aws_apigatewayv2_api.lambda_api.execution_arn}/*/*"
}

Step 5: Apply the Terraform Configuration

1. Run terraform init to initialize the directory.
2. Run terraform plan to see the resources that will be created.
3. Run terraform apply and type yes to confirm.

After applying, the API Gateway endpoint URL will look something like this:

https://<api-id>.execute-api.<region>.amazonaws.com/

You can invoke the Lambda function by making an HTTP request to this URL (e.g., using curl or a web browser).

Summary

• IAM Role: Allows the Lambda function to log to CloudWatch.
• Lambda Function: Deploys the code and sets runtime settings.
• API Gateway: Sets up an HTTP trigger for the Lambda function.

This basic setup deploys a Lambda function with an API Gateway endpoint. For production, consider adding additional security, such as API keys or AWS IAM authorizations.