[Bug]: AWS Lambda SnapStart needs Lambda Versions

[faxx1080]

Terraform Core Version

1.25

AWS Provider Version

4.48.0

Affected Resource(s)

I understand from AWS that to use SnapStart, just setting "snap_start" to PublishedVersions is not enough, one also needs to publish a lambda version, then SnapStart is enabled on the version, as the version is immutable.

Source: https://docs.aws.amazon.com/lambda/latest/dg/snapstart.html

You can use SnapStart only on published function versions and aliases that point to versions. You can't use SnapStart on a function's unpublished version ($LATEST).

Currently, I don't see much documentation on managing lambda versions using Terraform, are versions supported?

Expected Behavior

SnapStart should be enabled and used, and I should see RESTORE lines in AWS Lambda logs

Actual Behavior

I do not see RESTORE lines in Lambda logs

Relevant Error/Panic Output Snippet

No response

Terraform Configuration Files

main.tf

provider "aws" {
  region = "us-east-1"
}
provider "archive" {}

resource "aws_lambda_function" "lambda" {
  function_name = "test-1"
  snap_start {
    apply_on = "PublishedVersions"
  }
  filename         = "../../build/distributions/j2-1.0-SNAPSHOT.zip"
  source_code_hash = filebase64sha256("../../build/distributions/j2-1.0-SNAPSHOT.zip")
  role    = "arn:aws:iam::$ACCOUNTID:role/iam_for_lambda"
  handler = "com.frank.Handler"
  runtime = "java11"
}

Steps to Reproduce

terraform init
terraform plan
terraform apply

Then in AWS Console create a version of test-1 lambda. Then test it.

Debug Output

Logs

NOTE: I modified the role in the console to add CloudWatch permissions afterward.

terraform apply
data.aws_iam_policy_document.policy: Reading...
data.aws_iam_policy_document.policy: Read complete after 0s [id=3693445097]

Terraform used the selected providers to generate the following execution plan. Resource actions are
indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_iam_role.iam_for_lambda will be created
  + resource "aws_iam_role" "iam_for_lambda" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "lambda.amazonaws.com"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "iam_for_lambda"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = (known after apply)
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

  # aws_lambda_function.lambda will be created
  + resource "aws_lambda_function" "lambda" {
      + architectures                  = (known after apply)
      + arn                            = (known after apply)
      + filename                       = "../../build/distributions/j2-1.0-SNAPSHOT.zip"
      + function_name                  = "test-1"
      + handler                        = "com.frank.Handler"
      + id                             = (known after apply)
      + invoke_arn                     = (known after apply)
      + last_modified                  = (known after apply)
      + memory_size                    = 128
      + package_type                   = "Zip"
      + publish                        = false
      + qualified_arn                  = (known after apply)
      + qualified_invoke_arn           = (known after apply)
      + reserved_concurrent_executions = -1
      + role                           = (known after apply)
      + runtime                        = "java11"
      + signing_job_arn                = (known after apply)
      + signing_profile_version_arn    = (known after apply)
      + source_code_hash               = "oZqlhpafYY1MEckgOCWnEBuCrCNptk4h35ht5Lw2Pwg="
      + source_code_size               = (known after apply)
      + tags_all                       = (known after apply)
      + timeout                        = 3
      + version                        = (known after apply)

      + ephemeral_storage {
          + size = (known after apply)
        }

      + snap_start {
          + apply_on            = "PublishedVersions"
          + optimization_status = (known after apply)
        }

      + tracing_config {
          + mode = (known after apply)
        }
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_iam_role.iam_for_lambda: Creating...
aws_iam_role.iam_for_lambda: Creation complete after 1s [id=iam_for_lambda]
aws_lambda_function.lambda: Creating...
aws_lambda_function.lambda: Still creating... [10s elapsed]
aws_lambda_function.lambda: Creation complete after 19s [id=test-1]

Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
➜  dev terraform --version
Terraform v1.3.6
on darwin_arm64
+ provider registry.terraform.io/hashicorp/archive v2.2.0
+ provider registry.terraform.io/hashicorp/aws v4.48.0

CloudWatch Logs:

2022-12-23T10:09:19.610-05:00	START RequestId: eac5ff9d-4c12-45e0-b1b2-c7fad1142784 Version: $LATEST
2022-12-23T10:09:19.641-05:00	>> Start
...
2022-12-23T10:09:22.659-05:00	2022-12-23T15:09:22.658Z eac5ff9d-4c12-45e0-b1b2-c7fad1142784 Task timed out after 3.05 seconds
2022-12-23T10:09:22.659-05:00	END RequestId: eac5ff9d-4c12-45e0-b1b2-c7fad1142784
2022-12-23T10:09:22.660-05:00	REPORT RequestId: eac5ff9d-4c12-45e0-b1b2-c7fad1142784 Duration: 3048.59 ms Billed Duration: 3000 ms Memory Size: 

What I expect to see:

RESTORE_START Runtime Version: java:11.v15 Runtime Version ARN: arn:aws:lambda:us-east-1::runtime:0a25e3e7a1cc9ce404bc435eeb2ad358d8fa64338e618d0c224fe509403583ca
2022-12-23T10:12:21.440-05:00	RESTORE_REPORT Restore Duration: 297.09 ms
2022-12-23T10:12:21.443-05:00	START RequestId: b947d469-103b-4549-abe4-c9b18a153a13 Version: 1
2022-12-23T10:12:21.575-05:00	>> Start
2022-12-23T10:12:22.094-05:00	ENVIRONMENT VARIABLES: { "PATH": "/var...
2022-12-23T10:12:22.295-05:00	CONTEXT: { "memoryLimit": 128, "awsReq...
2022-12-23T10:12:22.296-05:00	EVENT: { "key1": "value1", "key2": "value2", "key3": "value3" }
2022-12-23T10:12:22.354-05:00	EVENT TYPE: class java.util.LinkedHashMap
2022-12-23T10:12:22.354-05:00	>> Init SM
2022-12-23T10:12:24.528-05:00	2022-12-23T15:12:24.520Z b947d469-103b-4549-abe4-c9b18a153a13 Task timed out after 3.08 seconds
2022-12-23T10:12:24.529-05:00	END RequestId: b947d469-103b-4549-abe4-c9b18a153a13
2022-12-23T10:12:24.529-05:00	REPORT RequestId: b947d469-103b-4549-abe4-c9b18a153a13 Duration: 3077.02 ms Billed Duration: 3231 ms Memory Size: 128 MB Max Memory Used: 86 MB Restore Duration: 297.09 ms Billed Restore Duration: 153 ms
2022-12-23T10:12:24.690-05:00	INIT_START Runtime Version: java:11.v15 Runtime Version ARN: arn:aws:lambda:us-east-1::runtime:0a25e3e7a1cc9ce404bc435eeb2ad358d8fa64338e618d0c224fe509403583ca
2022-12-23T10:12:25.210-05:00	INIT_REPORT Init Duration: 520.44 ms

Panic Output

No response

Important Factoids

It's a basic-do-nothing Java lambda to test SnapStart. Whether it completes successfully or not is not what I was testing.

References

#28097

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @faxx1080 👋 Thank you for taking the time to raise this! I think the publish argument is what you're looking for to enable version publishing and get SnapStart working.

[faxx1080]

Thanks! That did work for me. A question though: is there an ability to delete old versions of functions?

[justinretzolk]

Hey @faxx1080 👋 Glad that helped! As far as deleting old versions of functions, I don't believe there's a way to do so via Terraform (aside from deleting the function itself), but it appears to be possible via the CLI or via the API.

Since we've resolved the root of the issue, I'll go ahead and close it out. If you do have any other general use questions, they'll be more suited for the AWS Provider forum.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.