#!/usr/bin/python # -*- coding: utf-8 -*- # Copyright: Contributors to the Ansible project # GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) DOCUMENTATION = r""" --- module: lambda version_added: 5.0.0 short_description: Manage AWS Lambda functions description: - Allows for the management of Lambda functions. - This module was originally added to C(community.aws) in release 1.0.0. options: name: description: - The name you want to assign to the function you are uploading. Cannot be changed. required: true type: str state: description: - Create or delete Lambda function. default: present choices: [ 'present', 'absent' ] type: str runtime: description: - The runtime environment for the Lambda function you are uploading. - Required when creating a function. Uses parameters as described in boto3 docs. - Required when O(state=present). - For supported list of runtimes, see U(https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html). type: str role: description: - The Amazon Resource Name (ARN) of the IAM role that Lambda assumes when it executes your function to access any other Amazon Web Services (AWS) resources. You may use the bare ARN if the role belongs to the same AWS account. - Required when O(state=present). type: str handler: description: - The function within your code that Lambda calls to begin execution. type: str zip_file: description: - A .zip file containing your deployment package - If O(state=present) then either O(zip_file) or O(s3_bucket) must be present. aliases: [ 'src' ] type: str s3_bucket: description: - Amazon S3 bucket name where the .zip file containing your deployment package is stored. - If O(state=present) then either O(zip_file) or O(s3_bucket) must be present. - O(s3_bucket) and O(s3_key) are required together. type: str s3_key: description: - The Amazon S3 object (the deployment package) key name you want to upload. - O(s3_bucket) and O(s3_key) are required together. type: str s3_object_version: description: - The Amazon S3 object (the deployment package) version you want to upload. type: str description: description: - A short, user-defined function description. Lambda does not use this value. Assign a meaningful description as you see fit. type: str default: '' timeout: description: - The function maximum execution time in seconds after which Lambda should terminate the function. default: 3 type: int memory_size: description: - The amount of memory, in MB, your Lambda function is given. default: 128 type: int vpc_subnet_ids: description: - List of subnet IDs to run Lambda function in. - Use this option if you need to access resources in your VPC. Leave empty if you don't want to run the function in a VPC. - If set, O(vpc_security_group_ids) must also be set. type: list elements: str vpc_security_group_ids: description: - List of VPC security group IDs to associate with the Lambda function. - Required when O(vpc_subnet_ids) is used. type: list elements: str environment_variables: description: - A dictionary of environment variables the Lambda function is given. type: dict dead_letter_arn: description: - The parent object that contains the target Amazon Resource Name (ARN) of an Amazon SQS queue or Amazon SNS topic. type: str tracing_mode: description: - Set mode to 'Active' to sample and trace incoming requests with AWS X-Ray. Turned off (set to 'PassThrough') by default. choices: ['Active', 'PassThrough'] type: str kms_key_arn: description: - The KMS key ARN used to encrypt the function's environment variables. type: str version_added: 3.3.0 version_added_collection: community.aws architecture: description: - The instruction set architecture that the function supports. - Requires one of O(s3_bucket) or O(zip_file). type: str choices: ['x86_64', 'arm64'] aliases: ['architectures'] version_added: 5.0.0 layers: description: - A list of function layers to add to the function's execution environment. - Specify each layer by its ARN, including the version. suboptions: layer_version_arn: description: - The ARN of the layer version. - Mutually exclusive with O(layers.layer_name). type: str layer_name: description: - The name or Amazon Resource Name (ARN) of the layer. - Mutually exclusive with O(layers.layer_version_arn). type: str aliases: ['layer_arn'] version: description: - The version number. - Required when O(layers.layer_name) is provided, ignored if not. type: int aliases: ['layer_version'] type: list elements: dict version_added: 5.5.0 image_uri: description: - The Amazon ECR URI of the image to use. - Required (alternative to runtime zip_file and s3_bucket) when creating a function. - Required when O(state=present). type: str version_added: 7.3.0 author: - 'Steyn Huizinga (@steynovich)' extends_documentation_fragment: - amazon.aws.common.modules - amazon.aws.region.modules - amazon.aws.tags - amazon.aws.boto3 """ EXAMPLES = r""" # Create Lambda functions - name: looped creation amazon.aws.lambda: name: '{{ item.name }}' state: present zip_file: '{{ item.zip_file }}' runtime: 'python2.7' role: 'arn:aws:iam::123456789012:role/lambda_basic_execution' handler: 'hello_python.my_handler' vpc_subnet_ids: - subnet-123abcde - subnet-edcba321 vpc_security_group_ids: - sg-123abcde - sg-edcba321 environment_variables: '{{ item.env_vars }}' tags: key1: 'value1' loop: - name: HelloWorld zip_file: hello-code.zip env_vars: key1: "first" key2: "second" - name: ByeBye zip_file: bye-code.zip env_vars: key1: "1" key2: "2" # To remove previously added tags pass an empty dict - name: remove tags amazon.aws.lambda: name: 'Lambda function' state: present zip_file: 'code.zip' runtime: 'python2.7' role: 'arn:aws:iam::123456789012:role/lambda_basic_execution' handler: 'hello_python.my_handler' tags: {} # Basic Lambda function deletion - name: Delete Lambda functions HelloWorld and ByeBye amazon.aws.lambda: name: '{{ item }}' state: absent loop: - HelloWorld - ByeBye # Create Lambda functions with function layers - name: looped creation amazon.aws.lambda: name: 'HelloWorld' state: present zip_file: 'hello-code.zip' runtime: 'python2.7' role: 'arn:aws:iam::123456789012:role/lambda_basic_execution' handler: 'hello_python.my_handler' layers: - layer_version_arn: 'arn:aws:lambda:us-east-1:123456789012:layer:python27-env:7' """ RETURN = r""" code: description: The lambda function's code returned by get_function in boto3. returned: success type: dict contains: location: description: - The presigned URL you can use to download the function's .zip file that you previously uploaded. - The URL is valid for up to 10 minutes. returned: success type: str sample: 'https://prod-04-2014-tasks.s3.us-east-1.amazonaws.com/snapshots/sample' repository_type: description: The repository from which you can download the function. returned: success type: str sample: 'S3' configuration: description: The Lambda function's configuration metadata returned by get_function in boto3. returned: success type: dict contains: architectures: description: The architectures supported by the function. type: list elements: str sample: ['arm64'] code_sha256: description: The SHA256 hash of the function's deployment package. returned: success type: str sample: 'zOAGfF5JLFuzZoSNirUtOrQp+S341IOA3BcoXXoaIaU=' code_size: description: The size of the function's deployment package in bytes. returned: success type: int sample: 123 dead_letter_config: description: The function's dead letter queue. returned: when the function has a dead letter queue configured type: dict sample: { 'target_arn': arn:aws:lambda:us-east-1:123456789012:function:myFunction:1 } contains: target_arn: description: The ARN of an SQS queue or SNS topic. returned: when the function has a dead letter queue configured type: str sample: arn:aws:lambda:us-east-1:123456789012:function:myFunction:1 description: description: The function's description. returned: success type: str sample: 'My function' environment: description: The function's environment variables. returned: when environment variables exist type: dict contains: variables: description: Environment variable key-value pairs. returned: when environment variables exist type: dict sample: {'key': 'value'} error: description: Error message for environment variables that could not be applied. returned: when there is an error applying environment variables type: dict contains: error_code: description: The error code. returned: when there is an error applying environment variables type: str message: description: The error message. returned: when there is an error applying environment variables type: str function_arn: description: The function's Amazon Resource Name (ARN). returned: on success type: str sample: 'arn:aws:lambda:us-east-1:123456789012:function:myFunction:1' function_name: description: The function's name. returned: on success type: str sample: 'myFunction' handler: description: The function Lambda calls to begin executing your function. returned: on success type: str sample: 'index.handler' last_modified: description: The date and time that the function was last updated, in ISO-8601 format (YYYY-MM-DDThh:mm:ssTZD). returned: on success type: str sample: '2017-08-01T00:00:00.000+0000' memory_size: description: The memory allocated to the function. returned: on success type: int sample: 128 revision_id: description: The latest updated revision of the function or alias. returned: on success type: str sample: 'a2x9886d-d48a-4a0c-ab64-82abc005x80c' role: description: The function's execution role. returned: on success type: str sample: 'arn:aws:iam::123456789012:role/lambda_basic_execution' runtime: description: The funtime environment for the Lambda function. returned: on success type: str sample: 'nodejs6.10' tracing_config: description: The function's AWS X-Ray tracing configuration. returned: on success type: dict sample: { 'mode': 'Active' } contains: mode: description: The tracing mode. returned: on success type: str sample: 'Active' timeout: description: The amount of time that Lambda allows a function to run before terminating it. returned: on success type: int sample: 3 version: description: The version of the Lambda function. returned: on success type: str sample: '1' vpc_config: description: The function's networking configuration. returned: on success type: dict sample: { 'security_group_ids': [], 'subnet_ids': [], 'vpc_id': '123' } layers: description: The function's layers. returned: on success version_added: 5.5.0 type: complex contains: arn: description: The Amazon Resource Name (ARN) of the function layer. returned: always type: str sample: active code_size: description: The size of the layer archive in bytes. returned: always type: str signing_profile_version_arn: description: The Amazon Resource Name (ARN) for a signing profile version. returned: always type: str signing_job_arn: description: The Amazon Resource Name (ARN) of a signing job. returned: always type: str """ import base64 import hashlib import re import traceback from collections import Counter try: from botocore.exceptions import BotoCoreError from botocore.exceptions import ClientError from botocore.exceptions import WaiterError except ImportError: pass # protected by AnsibleAWSModule from ansible.module_utils.common.dict_transformations import camel_dict_to_snake_dict from ansible_collections.amazon.aws.plugins.module_utils.botocore import is_boto3_error_code from ansible_collections.amazon.aws.plugins.module_utils.iam import get_aws_account_info from ansible_collections.amazon.aws.plugins.module_utils.modules import AnsibleAWSModule from ansible_collections.amazon.aws.plugins.module_utils.retries import AWSRetry from ansible_collections.amazon.aws.plugins.module_utils.tagging import compare_aws_tags def get_current_function(connection, function_name, qualifier=None): try: if qualifier is not None: return connection.get_function(FunctionName=function_name, Qualifier=qualifier, aws_retry=True) return connection.get_function(FunctionName=function_name, aws_retry=True) except is_boto3_error_code("ResourceNotFoundException"): return None def get_layer_version_arn(module, connection, layer_name, version_number): try: layer_versions = connection.list_layer_versions(LayerName=layer_name, aws_retry=True)["LayerVersions"] for v in layer_versions: if v["Version"] == version_number: return v["LayerVersionArn"] module.fail_json(msg=f"Unable to find version {version_number} from Lambda layer {layer_name}") except is_boto3_error_code("ResourceNotFoundException"): module.fail_json(msg=f"Lambda layer {layer_name} not found") def sha256sum(filename): hasher = hashlib.sha256() with open(filename, "rb") as f: hasher.update(f.read()) code_hash = hasher.digest() code_b64 = base64.b64encode(code_hash) hex_digest = code_b64.decode("utf-8") return hex_digest def set_tag(client, module, tags, function, purge_tags): if tags is None: return False changed = False arn = function["Configuration"]["FunctionArn"] try: current_tags = client.list_tags(Resource=arn, aws_retry=True).get("Tags", {}) except (BotoCoreError, ClientError) as e: module.fail_json_aws(e, msg="Unable to list tags") tags_to_add, tags_to_remove = compare_aws_tags(current_tags, tags, purge_tags=purge_tags) if not tags_to_remove and not tags_to_add: return False if module.check_mode: return True try: if tags_to_remove: client.untag_resource( Resource=arn, TagKeys=tags_to_remove, aws_retry=True, ) changed = True if tags_to_add: client.tag_resource( Resource=arn, Tags=tags_to_add, aws_retry=True, ) changed = True except (BotoCoreError, ClientError) as e: module.fail_json_aws(e, msg=f"Unable to tag resource {arn}") return changed def wait_for_lambda(client, module, name): try: client_active_waiter = client.get_waiter("function_active") client_updated_waiter = client.get_waiter("function_updated") client_active_waiter.wait(FunctionName=name) client_updated_waiter.wait(FunctionName=name) except WaiterError as e: module.fail_json_aws(e, msg="Timeout while waiting on lambda to finish updating") except (ClientError, BotoCoreError) as e: module.fail_json_aws(e, msg="Failed while waiting on lambda to finish updating") def format_response(response): tags = response.get("Tags", {}) result = camel_dict_to_snake_dict(response) # Lambda returns a dict rather than the usual boto3 list of dicts result["tags"] = tags return result def _zip_args(zip_file, current_config, ignore_checksum): if not zip_file: return {} # If there's another change that needs to happen, we always re-upload the code if not ignore_checksum: local_checksum = sha256sum(zip_file) remote_checksum = current_config.get("CodeSha256", "") if local_checksum == remote_checksum: return {} with open(zip_file, "rb") as f: zip_content = f.read() return {"ZipFile": zip_content} def _s3_args(s3_bucket, s3_key, s3_object_version): if not s3_bucket: return {} if not s3_key: return {} code = {"S3Bucket": s3_bucket, "S3Key": s3_key} if s3_object_version: code.update({"S3ObjectVersion": s3_object_version}) return code def _image_args(image_uri): if not image_uri: return {} code = {"ImageUri": image_uri} return code def _code_args(module, current_config): s3_bucket = module.params.get("s3_bucket") s3_key = module.params.get("s3_key") s3_object_version = module.params.get("s3_object_version") zip_file = module.params.get("zip_file") architectures = module.params.get("architecture") image_uri = module.params.get("image_uri") code_kwargs = {} if architectures and current_config.get("Architectures", None) != [architectures]: module.warn("Arch Change") code_kwargs.update({"Architectures": [architectures]}) try: code_kwargs.update(_zip_args(zip_file, current_config, bool(code_kwargs))) except IOError as e: module.fail_json(msg=str(e), exception=traceback.format_exc()) code_kwargs.update(_s3_args(s3_bucket, s3_key, s3_object_version)) code_kwargs.update(_image_args(image_uri)) if not code_kwargs: return {} if not architectures and current_config.get("Architectures", None): code_kwargs.update({"Architectures": current_config.get("Architectures", None)}) return code_kwargs def main(): argument_spec = dict( name=dict(required=True), state=dict(default="present", choices=["present", "absent"]), image_uri=dict(), runtime=dict(), role=dict(), handler=dict(), zip_file=dict(aliases=["src"]), s3_bucket=dict(), s3_key=dict(no_log=False), s3_object_version=dict(), description=dict(default=""), timeout=dict(type="int", default=3), memory_size=dict(type="int", default=128), vpc_subnet_ids=dict(type="list", elements="str"), vpc_security_group_ids=dict(type="list", elements="str"), environment_variables=dict(type="dict"), dead_letter_arn=dict(), kms_key_arn=dict(type="str", no_log=False), tracing_mode=dict(choices=["Active", "PassThrough"]), architecture=dict(choices=["x86_64", "arm64"], type="str", aliases=["architectures"]), tags=dict(type="dict", aliases=["resource_tags"]), purge_tags=dict(type="bool", default=True), layers=dict( type="list", elements="dict", options=dict( layer_version_arn=dict(type="str"), layer_name=dict(type="str", aliases=["layer_arn"]), version=dict(type="int", aliases=["layer_version"]), ), required_together=[["layer_name", "version"]], required_one_of=[["layer_version_arn", "layer_name"]], mutually_exclusive=[["layer_name", "layer_version_arn"], ["version", "layer_version_arn"]], ), ) mutually_exclusive = [ ["zip_file", "s3_key"], ["zip_file", "s3_bucket"], ["zip_file", "s3_object_version"], ["image_uri", "zip_file"], ["image_uri", "runtime"], ["image_uri", "handler"], ["image_uri", "s3_key"], ["image_uri", "s3_bucket"], ["image_uri", "s3_object_version"], ] required_together = [ ["s3_key", "s3_bucket"], ["vpc_subnet_ids", "vpc_security_group_ids"], ["runtime", "handler"], ] required_if = [ ["state", "present", ["role"]], ["state", "present", ["runtime", "image_uri"], True], ["architecture", "x86_64", ["zip_file", "s3_bucket", "image_uri"], True], ["architecture", "arm64", ["zip_file", "s3_bucket", "image_uri"], True], ] module = AnsibleAWSModule( argument_spec=argument_spec, supports_check_mode=True, mutually_exclusive=mutually_exclusive, required_together=required_together, required_if=required_if, ) name = module.params.get("name") state = module.params.get("state").lower() runtime = module.params.get("runtime") role = module.params.get("role") handler = module.params.get("handler") description = module.params.get("description") timeout = module.params.get("timeout") memory_size = module.params.get("memory_size") vpc_subnet_ids = module.params.get("vpc_subnet_ids") vpc_security_group_ids = module.params.get("vpc_security_group_ids") environment_variables = module.params.get("environment_variables") dead_letter_arn = module.params.get("dead_letter_arn") tracing_mode = module.params.get("tracing_mode") tags = module.params.get("tags") purge_tags = module.params.get("purge_tags") kms_key_arn = module.params.get("kms_key_arn") image_uri = module.params.get("image_uri") layers = [] check_mode = module.check_mode changed = False try: client = module.client("lambda", retry_decorator=AWSRetry.jittered_backoff()) except (ClientError, BotoCoreError) as e: module.fail_json_aws(e, msg="Trying to connect to AWS") if state == "present": if re.match(r"^arn:aws(-([a-z\-]+))?:iam", role): role_arn = role else: # get account ID and assemble ARN account_id, partition = get_aws_account_info(module) role_arn = f"arn:{partition}:iam::{account_id}:role/{role}" # create list of layer version arn if module.params.get("layers"): for layer in module.params.get("layers"): layer_version_arn = layer.get("layer_version_arn") if layer_version_arn is None: layer_version_arn = get_layer_version_arn( module, client, layer.get("layer_name"), layer.get("version") ) layers.append(layer_version_arn) # Get function configuration if present, False otherwise current_function = get_current_function(client, name) # Update existing Lambda function if state == "present" and current_function: # Get current state current_config = current_function["Configuration"] current_version = None # Update function configuration func_kwargs = {"FunctionName": name} # Update configuration if needed if role_arn and current_config["Role"] != role_arn: func_kwargs.update({"Role": role_arn}) if handler and current_config["Handler"] != handler: func_kwargs.update({"Handler": handler}) if description and current_config["Description"] != description: func_kwargs.update({"Description": description}) if timeout and current_config["Timeout"] != timeout: func_kwargs.update({"Timeout": timeout}) if memory_size and current_config["MemorySize"] != memory_size: func_kwargs.update({"MemorySize": memory_size}) if image_uri is not None and current_config["PackageType"] != "Image": func_kwargs.update({"PackageType": "Image"}) if runtime and current_config["Runtime"] != runtime: func_kwargs.update({"Runtime": runtime}) if (environment_variables is not None) and ( current_config.get("Environment", {}).get("Variables", {}) != environment_variables ): func_kwargs.update({"Environment": {"Variables": environment_variables}}) if dead_letter_arn is not None: if current_config.get("DeadLetterConfig"): if current_config["DeadLetterConfig"]["TargetArn"] != dead_letter_arn: func_kwargs.update({"DeadLetterConfig": {"TargetArn": dead_letter_arn}}) else: if dead_letter_arn != "": func_kwargs.update({"DeadLetterConfig": {"TargetArn": dead_letter_arn}}) if tracing_mode and (current_config.get("TracingConfig", {}).get("Mode", "PassThrough") != tracing_mode): func_kwargs.update({"TracingConfig": {"Mode": tracing_mode}}) if kms_key_arn: func_kwargs.update({"KMSKeyArn": kms_key_arn}) # If VPC configuration is desired if vpc_subnet_ids: if "VpcConfig" in current_config: # Compare VPC config with current config current_vpc_subnet_ids = current_config["VpcConfig"]["SubnetIds"] current_vpc_security_group_ids = current_config["VpcConfig"]["SecurityGroupIds"] subnet_net_id_changed = sorted(vpc_subnet_ids) != sorted(current_vpc_subnet_ids) vpc_security_group_ids_changed = sorted(vpc_security_group_ids) != sorted( current_vpc_security_group_ids ) if "VpcConfig" not in current_config or subnet_net_id_changed or vpc_security_group_ids_changed: new_vpc_config = {"SubnetIds": vpc_subnet_ids, "SecurityGroupIds": vpc_security_group_ids} func_kwargs.update({"VpcConfig": new_vpc_config}) else: # No VPC configuration is desired, assure VPC config is empty when present in current config if "VpcConfig" in current_config and current_config["VpcConfig"].get("VpcId"): func_kwargs.update({"VpcConfig": {"SubnetIds": [], "SecurityGroupIds": []}}) # Check layers if layers: # compare two lists to see if the target layers are equal to the current current_layers = current_config.get("Layers", []) if Counter(layers) != Counter((f["Arn"] for f in current_layers)): func_kwargs.update({"Layers": layers}) # Upload new configuration if configuration has changed if len(func_kwargs) > 1: if not check_mode: wait_for_lambda(client, module, name) try: if not check_mode: response = client.update_function_configuration(aws_retry=True, **func_kwargs) current_version = response["Version"] changed = True except (BotoCoreError, ClientError) as e: module.fail_json_aws(e, msg="Trying to update lambda configuration") # Tag Function if tags is not None: if set_tag(client, module, tags, current_function, purge_tags): changed = True code_kwargs = _code_args(module, current_config) if code_kwargs: # Update code configuration code_kwargs.update({"FunctionName": name, "Publish": True}) if not check_mode: wait_for_lambda(client, module, name) try: if not check_mode: response = client.update_function_code(aws_retry=True, **code_kwargs) current_version = response["Version"] changed = True except (BotoCoreError, ClientError) as e: module.fail_json_aws(e, msg="Trying to upload new code") # Describe function code and configuration response = get_current_function(client, name, qualifier=current_version) if not response: module.fail_json(msg="Unable to get function information after updating") response = format_response(response) # We're done # "ZipFile" attribute contains non UTF-8 data. Ansible considers it an error # starting with version 2.18. Removing it from the output avoids the error. code_kwargs.pop("ZipFile", None) module.exit_json(changed=changed, code_kwargs=code_kwargs, func_kwargs=func_kwargs, **response) # Function doesn't exist, create new Lambda function elif state == "present": func_kwargs = { "FunctionName": name, "Publish": True, "Role": role_arn, "Timeout": timeout, "MemorySize": memory_size, } code = _code_args(module, {}) if not code: module.fail_json(msg="Either S3 object or path to zipfile required") if "Architectures" in code: func_kwargs.update({"Architectures": code.pop("Architectures")}) func_kwargs.update({"Code": code}) if description is not None: func_kwargs.update({"Description": description}) if image_uri is not None: func_kwargs.update({"PackageType": "Image"}) if runtime is not None: func_kwargs.update({"Runtime": runtime}) if handler is not None: func_kwargs.update({"Handler": handler}) if environment_variables: func_kwargs.update({"Environment": {"Variables": environment_variables}}) if dead_letter_arn: func_kwargs.update({"DeadLetterConfig": {"TargetArn": dead_letter_arn}}) if tracing_mode: func_kwargs.update({"TracingConfig": {"Mode": tracing_mode}}) if kms_key_arn: func_kwargs.update({"KMSKeyArn": kms_key_arn}) # If VPC configuration is given if vpc_subnet_ids: func_kwargs.update({"VpcConfig": {"SubnetIds": vpc_subnet_ids, "SecurityGroupIds": vpc_security_group_ids}}) # Layers if layers: func_kwargs.update({"Layers": layers}) # Tag Function if tags: func_kwargs.update({"Tags": tags}) # Function would have been created if not check mode if check_mode: module.exit_json(changed=True) # Finally try to create function current_version = None try: response = client.create_function(aws_retry=True, **func_kwargs) current_version = response["Version"] changed = True except (BotoCoreError, ClientError) as e: module.fail_json_aws(e, msg="Trying to create function") response = get_current_function(client, name, qualifier=current_version) if not response: module.fail_json(msg="Unable to get function information after creating") response = format_response(response) module.exit_json(changed=changed, **response) # Delete existing Lambda function if state == "absent" and current_function: try: if not check_mode: client.delete_function(FunctionName=name, aws_retry=True) changed = True except (BotoCoreError, ClientError) as e: module.fail_json_aws(e, msg="Trying to delete Lambda function") module.exit_json(changed=changed) # Function already absent, do nothing elif state == "absent": module.exit_json(changed=changed) if __name__ == "__main__": main()