Terraform AWS Lambda Unexpected Value Fix

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15 mins

TL;DR

• What broke: Terraform planned a Lambda resource state, but the AWS provider returned a different computed value post-apply — triggering an unresolvable diff loop that halts your pipeline.
• How to fix it: Identify the drifting attribute (filename/source_code_hash conflict, unmanaged last_modified, computed qualified_arn, or environment variable map ordering) and either remove the conflicting argument, add a lifecycle { ignore_changes } block, or pin the deployment mechanism to S3-only or filename-only.
• Auto-refactor: Use our Client-Side Sandbox above to paste your aws_lambda_function block and get the corrected HCL instantly.

Error: Provider produced an unexpected new value for aws_lambda_function.my_function

  on main.tf line 12, in resource "aws_lambda_function" "my_function":
  12: resource "aws_lambda_function" "my_function" {

The root object is not consistent after apply:
  - .last_modified: was cty.StringVal("2024-01-15T10:30:00.000+0000"),
    but now cty.StringVal("2024-01-15T10:30:01.000+0000")

(or alternatively)

  - .source_code_hash: planned value cty.StringVal("abc123...")
    does not match config value cty.StringVal("")

How to Fix It (The Solution)

Root Cause 1: `filename` and `s3_bucket` Conflict (Most Common)

 resource "aws_lambda_function" "my_function" {
   function_name = "my-api-handler"
   role          = aws_iam_role.lambda_exec.arn
   handler       = "index.handler"
   runtime       = "nodejs20.x"

-  filename         = "${path.module}/builds/function.zip"
-  source_code_hash = filebase64sha256("${path.module}/builds/function.zip")
-  s3_bucket        = "my-deployment-bucket"
-  s3_key           = "builds/function.zip"
+  # PICK ONE deployment method. S3 is preferred for CI/CD pipelines.
+  s3_bucket        = "my-deployment-bucket"
+  s3_key           = "builds/function.zip"
+  source_code_hash = data.aws_s3_object.function_hash.etag
 }
+
+data "aws_s3_object" "function_hash" {
+  bucket = "my-deployment-bucket"
+  key    = "builds/function.zip"
+}

Root Cause 2: `last_modified` and Computed Attribute Drift

 resource "aws_lambda_function" "my_function" {
   function_name    = "my-api-handler"
   role             = aws_iam_role.lambda_exec.arn
   handler          = "index.handler"
   runtime          = "nodejs20.x"
   s3_bucket        = "my-deployment-bucket"
   s3_key           = "builds/function.zip"

+  lifecycle {
+    ignore_changes = [
+      # last_modified is AWS-controlled; never manage it in Terraform
+      last_modified,
+      # If layers are updated out-of-band by a separate pipeline:
+      # layers,
+    ]
+  }
 }

Enterprise Best Practice: Immutable S3-Based Deployments with Version Pinning

The correct enterprise pattern decouples the artifact pipeline from the infrastructure pipeline. Terraform should only manage configuration, not upload code.

-resource "aws_lambda_function" "my_function" {
-  function_name    = "my-api-handler"
-  filename         = "${path.module}/dist/handler.zip"
-  source_code_hash = filebase64sha256("${path.module}/dist/handler.zip")
-  role             = aws_iam_role.lambda_exec.arn
-  handler          = "index.handler"
-  runtime          = "nodejs20.x"
-
-  environment {
-    variables = {
-      LOG_LEVEL = "info"
-      DB_HOST   = var.db_host
-      API_KEY   = var.api_key
-    }
-  }
-}
+# Artifact version is injected as a variable from the CI/CD artifact pipeline
+variable "lambda_s3_version_id" {
+  type        = string
+  description = "S3 VersionId of the Lambda deployment package. Set by the artifact pipeline."
+}
+
+resource "aws_lambda_function" "my_function" {
+  function_name = "my-api-handler"
+  role          = aws_iam_role.lambda_exec.arn
+  handler       = "index.handler"
+  runtime       = "nodejs20.x"
+
+  s3_bucket         = "my-deployment-bucket"
+  s3_key            = "builds/handler.zip"
+  s3_object_version = var.lambda_s3_version_id
+
+  # source_code_hash derived from S3 ETag — not local filesystem
+  source_code_hash = data.aws_s3_object.function_pkg.etag
+
+  environment {
+    variables = {
+      # Alphabetical order prevents map-ordering drift in older provider versions
+      API_KEY   = var.api_key
+      DB_HOST   = var.db_host
+      LOG_LEVEL = "info"
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [last_modified]
+  }
+}
+
+data "aws_s3_object" "function_pkg" {
+  bucket     = "my-deployment-bucket"
+  key        = "builds/handler.zip"
+  version_id = var.lambda_s3_version_id
+}

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# .checkov.yaml
checks:
  - id: CKV_AWS_50  # Lambda X-Ray tracing — already built-in
custom_checks:
  - name: NO_LAMBDA_DUAL_SOURCE
    resource_type: aws_lambda_function
    check_type: attribute
    # Use a custom Python check for mutual exclusivity validation

# opa/lambda_source_policy.rego
package terraform.aws.lambda

deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_lambda_function"
  config := resource.change.after

  # Deny if both filename and s3_bucket are non-null
  config.filename != null
  config.s3_bucket != null

  msg := sprintf(
    "Lambda function '%s' specifies both 'filename' and 's3_bucket'. Use one deployment method only.",
    [resource.name]
  )
}

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.88.0
    hooks:
      - id: terraform_validate
      - id: terraform_tflint
        args:
          - --args=--enable-rule=aws_lambda_function_invalid_runtime
      - id: terraform_checkov
        args:
          - --args=--framework terraform

# versions.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      # Minimum version with Lambda state drift fixes
      version = ">= 5.31.0, < 6.0.0"
    }
  }
}