Terraform lambda function validation exception

Question

I am trying to set up my current infrastructure in Terraform (v 0.13.0). I am simply starting with migrating existing lambda functions. I have used the following code to try upload an existing lambda function in .net core 3.1 to AWS (provider v. 3.0). I have no issue to deploy this manually but this is obviously not the goal.

Here is the IAM role:

resource "aws_iam_role" "role_lambda" {
  name = "roleLambda"

  assume_role_policy = <<POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal": {
          "Service": "lambda.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  POLICY
  }

Below the function (note I have obfuscated some values):

resource "aws_lambda_function" "lambda_tf" {
  function_name     = "LambdaTFTest"
  role              = aws_iam_role.role_lambda.arn
  handler           = "Lambda::Lambda.Function::FunctionHandler"
  runtime           = "dotnetcore3.1"
  s3_bucket         = "arn:aws:s3:::xxxx-xxxxxx"
  s3_key            = "Lambda.zip"
  s3_object_version = "XxXxXxXxXxXxXxXxXxXxXxXxXxXx"
}

However I keep getting this error as an output with no more details:

Error: Error creating Lambda function: ValidationException: 
        status code: 400, request id: a5e89c38-d1f1-456d-93c1-41650fb45386

I already made sure that my lambda is deployed within the same region as the s3 bucket itself so this is not the issue. I thought this could be related to some invalid parameters but I have played with all of them and can't manage to find the problem. I have also double checked the correct spelling of the key, version and so on. How can I make progress on this ?

Thanks in advance for your help.

Open AWS console, navigate to CloudFormation->Stacks and check why your lambda stack is not executed properly. — Traycho Ivanov
– Traycho Ivanov, Commented Aug 15, 2020 at 21:16
Since this is Terraform, it won't appear in the CloudFormation console. — Becca Petrin
– Becca Petrin, Commented Aug 18, 2021 at 18:45

MUNGAI NJOROGE · Accepted Answer · 2022-03-03 06:48:35Z

10

This issue is caused by low values of timeout or using role name instead of role ARN. I changed from:

role = aws_iam_role.lambda_role.name

to

role = aws_iam_role.lambda_role.arn

And the function deployment was successful.

answered Mar 3, 2022 at 6:48

MUNGAI NJOROGE

1,2061 gold badge13 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Marcin · Accepted Answer · 2020-08-15 21:46:32Z

The aws_iam_role has a syntax error. There is missing - in front of POLICY if you want it to keep it tabbed:

resource "aws_iam_role" "role_lambda" {
  name = "roleLambda"

  assume_role_policy = <<-POLICY
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal": {
          "Service": "lambda.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  POLICY
}

In aws_lambda_function, the s3_bucket should be just bucket name, not its arn:

resource "aws_lambda_function" "lambda_tf" {
  function_name     = "LambdaTFTest"
  role              = aws_iam_role.role_lambda.arn
  handler           = "Lambda::Lambda.Function::FunctionHandler"
  runtime           = "dotnetcore3.1"
  s3_bucket         = "xxxx-xxxxxx" 
  s3_key            = "Lambda.zip"
  s3_object_version = "XxXxXxXxXxXxXxXxXxXxXxXxXxXx"
}

Chris Williams · Accepted Answer · 2020-08-15 21:21:08Z

2

This comes down to one of the parameters being passed in being invalid.

Ensure that the Lambda name is unique, the S3 bucket and key exist and that the IAM role has the assume role policy when it’s attached.

The runtime is correct, everything else is user defined so would need you to validate.

Try using filename property instead of S3 (this will use local disk instead of S3). Does that work? If so it might be S3 permissions.

If you verify everything and it’s still not working the best suggestion would be to raise with AWS support providing the request ID.

answered Aug 15, 2020 at 21:21

Chris Williams

35.7k4 gold badges46 silver badges79 bronze badges

Comments

VINAY NAIR · Accepted Answer · 2021-06-22 13:55:11Z

1

It could really be any of the parameters you pass to lambda resource. In my case I said the timeout was "900000" instead of 900. I assumed it to be in ms for some reason.

answered Jun 22, 2021 at 13:55

VINAY NAIR

414 bronze badges

1 Comment

nick fox Over a year ago

Badly formatted subnets in my case.

targhs · Accepted Answer · 2022-03-02 16:33:36Z

1

In my case it was the name of lambda function. I was using spacing and its not allowed.

answered Mar 2, 2022 at 16:33

targhs

1,8234 gold badges21 silver badges36 bronze badges

1 Comment

DaveJenni Over a year ago

Ah! This was it, Lambda naming conventions. In my case using dots in the version (v0.1). Removed, sorted. Good spot!

Zac · Accepted Answer · 2022-11-30 03:26:14Z

1

The s3_bucket should only include the name, like xxxx-xxxxxx

The following formats are wrong:

arn:aws:s3:::xxxx-xxxxxx or s3://xxxx-xxxxxx

answered Nov 30, 2022 at 3:26

Zac

7809 silver badges13 bronze badges

1 Comment

rjminchuk Over a year ago

i had this exact problem. I was using "arn:aws:s3:::xxxxxxxxxxxx" but changed to just "xxxxxxxxxxxxx and i was able to deploy my lambda func

anil ravuri · Accepted Answer · 2021-07-19 07:08:12Z

0

I actually got the same error when using a docker image. The fix here is to set the package_type = "Image"

answered Jul 19, 2021 at 7:08

anil ravuri

564 bronze badges

Comments

mandypea · Accepted Answer · 2022-12-21 22:34:43Z

0

For me it was the lambda description being too long.

answered Dec 21, 2022 at 22:34

mandypea

6311 bronze badges

Comments

Rusty · Accepted Answer · 2022-12-23 22:30:12Z

0

There is a bug with allocating memory more than 4096 so if you copy the example from the terraform docs it will fail. This does not happen on all AWS account but on some

answered Dec 23, 2022 at 22:30

Rusty

1131 silver badge8 bronze badges

Comments

user2842685 · Accepted Answer · 2023-04-13 14:48:28Z

0

As this is the top hit on Google for "Terraform Lambda ValidationException", I'll just drop here that I had a list of subnets that was too long. For what it's worth, perhaps it will help someone!

answered Apr 13, 2023 at 14:48

user2842685

3941 gold badge6 silver badges9 bronze badges

Comments

ezennnn · Accepted Answer · 2021-04-04 10:40:44Z

-1

For those who might have run into the same issue, it might help to try formatting your main.tf file by converting all spaces to tabs.

If you're using vscode, there is a tab below to convert this, depends if spaces or tabs

Below:

Convert Indentation to Tabs:

This fixed the issue for me.

answered Apr 4, 2021 at 10:40

ezennnn

1,4571 gold badge12 silver badges13 bronze badges

Collectives™ on Stack Overflow

Terraform lambda function validation exception

11 Answers 11

Comments

Comments

Comments

1 Comment

1 Comment

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

11 Answers 11

Comments

Comments

Comments

1 Comment

1 Comment

1 Comment

Comments

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related