Model/deployment/terraform/lambda/_template
Daniel Roth 8e9c1c257d Pin the AWS provider to 6.56.0 across every Terraform stack
v6.57.0 (released 29 July 2026) breaks ordinary reads across unrelated AWS
services — SSM GetParameter returns SerializationException, IAM GetPolicy
returns a 302, ECR returns InvalidSignatureException — with no config
change. Reported upstream as hashicorp/terraform-provider-aws#49170, open
with no root cause identified; 6.56.0 is confirmed good.

Every stack declared `>= 5.0` with no upper bound and no lock files are
committed, so each CI run silently resolved whatever HashiCorp had shipped
most recently. That is how a provider released today broke a pipeline
nobody had touched. Pinning exactly makes the deployed version a reviewed
decision rather than a discovery.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-29 10:46:45 +00:00
..
main.tf added postcode splitter rewrite to ddd 2026-05-19 16:35:09 +00:00
provider.tf Pin the AWS provider to 6.56.0 across every Terraform stack 2026-07-29 10:46:45 +00:00
README.md added postcode splitter rewrite to ddd 2026-05-19 16:35:09 +00:00
variables.tf added postcode splitter rewrite to ddd 2026-05-19 16:35:09 +00:00

Checklist for adding a new Lambda

1. Create the Lambda scaffold

  • Copy the template:

    cp -r lambda/_template lambda/<lambda_name>


2. Add infrastructure prerequisites (shared stack)

  • Add a new ECR repository in:

    deployment/terraform/shared/main.tf

  • Create a PR to deploy this to main then dev in order to deploy the shared stack

  • Verify the ECR repository exists in AWS


3. Add Docker build configuration

  • Create a Dockerfile for the Lambda
  • Verify the Dockerfile path and build context
  • Add a new image build job in deploy_terraform.yml using _build_image.yml

4. Wire the Lambda deploy job (CI)

  • Add a deploy job using _deploy_lambda.yml
  • Ensure the deploy job depends on the image build job

5. Deploy

  • Push changes to GitHub
  • CI will:
    1. Build and push the Docker image
    2. Deploy the Lambda
    3. Verify everything deployed. Good things to check:
    • ECR with image
    • SQS
    • Trigger SQS
      • Cloud watch logs

5. Delete

  1. Delete README if you used cp -r

Please feel free to update this document to make it easier for the next person