Skip to content

Commit 580d24b

Browse files
npalmphilips-labs-pr|bot
npalm
and
philips-labs-pr|bot
authored
fix: trigger cold start dispatcher after update SSM parameters (#4243)
## Description Currently we use the lifecyle trigger in Terraform to enforce lambda reload. Unwanted side-effect is resources getting destroyed. Even leading to the lambda trigger for the dispatch functiong not getting re-created. Instead of adding the lifecyle event to multiple resources, the version of the SSM paramater is added to environment variables of the Lambda to enforce [cold start](https://docs.aws.amazon.com/lambda/latest/operatorguide/execution-environments.html) after updates. ## Tested - default example - multi runner, changing labels --------- Co-authored-by: philips-labs-pr|bot <philips-labs-pr[bot]@users.noreply.github.com>
1 parent 98e6a8c commit 580d24b

File tree

7 files changed

+15
-32
lines changed

7 files changed

+15
-32
lines changed

‎modules/webhook/direct/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ No modules.
3434
| [aws_lambda_function.webhook](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource |
3535
| [aws_lambda_permission.webhook](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
3636
| [null_resource.github_app_parameters](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
37-
| [null_resource.ssm_parameter_runner_matcher_config](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
3837
| [aws_iam_policy_document.lambda_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
3938
| [aws_iam_policy_document.lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
4039

‎modules/webhook/direct/main.tf‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎modules/webhook/direct/webhook.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ resource "aws_lambda_function" "webhook" {
2828
REPOSITORY_ALLOW_LIST = jsonencode(var.config.repository_white_list)
2929
SQS_WORKFLOW_JOB_QUEUE = try(var.config.sqs_workflow_job_queue.id, null)
3030
PARAMETER_RUNNER_MATCHER_CONFIG_PATH = var.config.ssm_parameter_runner_matcher_config.name
31+
PARAMETER_RUNNER_MATCHER_VERSION = var.config.ssm_parameter_runner_matcher_config.version # enforce cold start after Changes in SSM parameter
3132
} : k => v if v != null
3233
}
3334
}
@@ -50,7 +51,7 @@ resource "aws_lambda_function" "webhook" {
5051
}
5152

5253
lifecycle {
53-
replace_triggered_by = [null_resource.ssm_parameter_runner_matcher_config, null_resource.github_app_parameters]
54+
replace_triggered_by = [null_resource.github_app_parameters]
5455
}
5556
}
5657

@@ -68,7 +69,7 @@ resource "aws_lambda_permission" "webhook" {
6869
principal = "apigateway.amazonaws.com"
6970
source_arn = var.config.api_gw_source_arn
7071
lifecycle {
71-
replace_triggered_by = [null_resource.ssm_parameter_runner_matcher_config, null_resource.github_app_parameters]
72+
replace_triggered_by = [null_resource.github_app_parameters]
7273
}
7374
}
7475

‎modules/webhook/eventbridge/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ No modules.
2525
| [aws_cloudwatch_event_archive.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_archive) | resource |
2626
| [aws_cloudwatch_event_bus.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_bus) | resource |
2727
| [aws_cloudwatch_event_rule.workflow_job](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
28-
| [aws_cloudwatch_event_target.github_welcome](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
28+
| [aws_cloudwatch_event_target.dispatcher](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
2929
| [aws_cloudwatch_log_group.dispatcher](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
3030
| [aws_cloudwatch_log_group.webhook](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
3131
| [aws_iam_role.dispatcher_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
@@ -48,7 +48,6 @@ No modules.
4848
| [aws_lambda_permission.allow_cloudwatch_to_call_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
4949
| [aws_lambda_permission.webhook](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
5050
| [null_resource.github_app_parameters](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
51-
| [null_resource.ssm_parameter_runner_matcher_config](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
5251
| [aws_iam_policy_document.lambda_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
5352
| [aws_iam_policy_document.lambda_xray](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
5453

‎modules/webhook/eventbridge/dispatcher.tf‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,12 @@ resource "aws_cloudwatch_event_rule" "workflow_job" {
1212
EOF
1313
}
1414

15-
16-
resource "aws_cloudwatch_event_target" "github_welcome" {
15+
resource "aws_cloudwatch_event_target" "dispatcher" {
1716
arn = aws_lambda_function.dispatcher.arn
1817
rule = aws_cloudwatch_event_rule.workflow_job.name
1918
event_bus_name = aws_cloudwatch_event_bus.main.name
2019
}
2120

22-
2321
resource "aws_lambda_function" "dispatcher" {
2422
s3_bucket = var.config.lambda_s3_bucket != null ? var.config.lambda_s3_bucket : null
2523
s3_key = var.config.lambda_s3_key != null ? var.config.lambda_s3_key : null
@@ -45,6 +43,7 @@ resource "aws_lambda_function" "dispatcher" {
4543
POWERTOOLS_TRACER_CAPTURE_ERROR = var.config.tracing_config.capture_error
4644
# Parameters required for lambda configuration
4745
PARAMETER_RUNNER_MATCHER_CONFIG_PATH = var.config.ssm_parameter_runner_matcher_config.name
46+
PARAMETER_RUNNER_MATCHER_VERSION = var.config.ssm_parameter_runner_matcher_config.version # enforce cold start after Changes in SSM parameter
4847
REPOSITORY_ALLOW_LIST = jsonencode(var.config.repository_white_list)
4948
SQS_WORKFLOW_JOB_QUEUE = try(var.config.sqs_workflow_job_queue.id, null)
5049
} : k => v if v != null
@@ -67,10 +66,6 @@ resource "aws_lambda_function" "dispatcher" {
6766
mode = var.config.tracing_config.mode
6867
}
6968
}
70-
71-
lifecycle {
72-
replace_triggered_by = [null_resource.ssm_parameter_runner_matcher_config, null_resource.github_app_parameters]
73-
}
7469
}
7570

7671
resource "aws_cloudwatch_log_group" "dispatcher" {

‎modules/webhook/eventbridge/main.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,3 @@ resource "aws_cloudwatch_event_archive" "main" {
1313
event_source_arn = aws_cloudwatch_event_bus.main.arn
1414
retention_days = var.config.archive.retention_days
1515
}
16-
17-
resource "null_resource" "ssm_parameter_runner_matcher_config" {
18-
triggers = {
19-
version = var.config.ssm_parameter_runner_matcher_config.version
20-
}
21-
}

‎modules/webhook/eventbridge/webhook.tf‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
resource "null_resource" "github_app_parameters" {
2+
triggers = {
3+
github_app_webhook_secret_name = var.config.github_app_parameters.webhook_secret.name
4+
}
5+
}
6+
17
resource "aws_lambda_function" "webhook" {
28
s3_bucket = var.config.lambda_s3_bucket != null ? var.config.lambda_s3_bucket : null
39
s3_key = var.config.lambda_s3_key != null ? var.config.lambda_s3_key : null
@@ -48,7 +54,7 @@ resource "aws_lambda_function" "webhook" {
4854
}
4955

5056
lifecycle {
51-
replace_triggered_by = [null_resource.ssm_parameter_runner_matcher_config, null_resource.github_app_parameters]
57+
replace_triggered_by = [null_resource.github_app_parameters]
5258
}
5359
}
5460

@@ -65,14 +71,9 @@ resource "aws_lambda_permission" "webhook" {
6571
function_name = aws_lambda_function.webhook.function_name
6672
principal = "apigateway.amazonaws.com"
6773
source_arn = var.config.api_gw_source_arn
68-
lifecycle {
69-
replace_triggered_by = [null_resource.ssm_parameter_runner_matcher_config, null_resource.github_app_parameters]
70-
}
71-
}
7274

73-
resource "null_resource" "github_app_parameters" {
74-
triggers = {
75-
github_app_webhook_secret = var.config.github_app_parameters.webhook_secret.name
75+
lifecycle {
76+
replace_triggered_by = [null_resource.github_app_parameters]
7677
}
7778
}
7879

0 commit comments

Comments
 (0)