├── .gitignore
├── LICENSE
├── README.md
├── examples
    ├── lambda_python_archive.tf
    └── python
    │   ├── my_lambda.py
    │   └── requirements.txt
├── main.tf
├── outputs.tf
├── scripts
    └── build_lambda.py
└── variables.tf


/.gitignore:
--------------------------------------------------------------------------------
 1 | #  Local .terraform directories
 2 | **/.terraform/*
 3 | 
 4 | # .tfstate files
 5 | *.tfstate
 6 | *.tfstate.*
 7 | 
 8 | # .tfvars files
 9 | *.tfvars
10 | 
11 | # VSCode junk
12 | .vscode/*
13 | 
14 | # OSX Garbage
15 | .DS_Store


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2018 Robert Jordan
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # terraform-aws-lamba-python-archive
 2 | Package python source and dependencies into Lambda package with stable hash.
 3 | 
 4 | See: https://docs.aws.amazon.com/lambda/latest/dg/lambda-python-how-to-create-deployment-package.html
 5 | 
 6 | I created this module because using the standard technique of using an
 7 |  `archive_file` data source has a few shortcomings:
 8 | 1. This doesn't allow processing a requirements file.
 9 | 2. Each apply results in a diff in `source_code_hash` becuase the archive includes
10 | metadata and generated files (*.pyc).  This module doesn't include file metadata
11 | or .pyc files in the archive so the hash is stable unless the source or dependencies
12 | change. 
13 | 
14 | ## Example
15 | 
16 | ```
17 | module "python_lambda_archive" {
18 |     source = "rojopolis/lambda-python-archive/aws"
19 | 
20 |     src_dir              = "${path.module}/python"
21 |     output_path          = "${path.module}/lambda.zip"
22 |     install_dependencies = false
23 | }
24 | 
25 | resource "aws_iam_role" "iam_for_lambda" {
26 |   name = "iam_for_lambda"
27 | 
28 |   assume_role_policy = <<EOF
29 | {
30 |   "Version": "2012-10-17",
31 |   "Statement": [
32 |     {
33 |       "Action": "sts:AssumeRole",
34 |       "Principal": {
35 |         "Service": "lambda.amazonaws.com"
36 |       },
37 |       "Effect": "Allow",
38 |       "Sid": ""
39 |     }
40 |   ]
41 | }
42 | EOF
43 | }
44 | 
45 | resource "aws_lambda_function" "test_lambda" {
46 |   filename         = "${module.python_lambda_archive.archive_path}"
47 |   function_name    = "lambda_function_name"
48 |   role             = "${aws_iam_role.iam_for_lambda.arn}"
49 |   handler          = "exports.test"
50 |   source_code_hash = "${module.python_lambda_archive.source_code_hash}"
51 |   runtime          = "python3.6"
52 | 
53 |   environment {
54 |     variables = {
55 |       foo = "bar"
56 |     }
57 |   }
58 | }
59 | ```
60 | 
61 | ## External Dependencies
62 | 1. Python3.4+


--------------------------------------------------------------------------------
/examples/lambda_python_archive.tf:
--------------------------------------------------------------------------------
 1 | module "python_lambda_archive" {
 2 |     source      = "../"
 3 |     src_dir     = "${path.module}/python"
 4 |     output_path = "${path.module}/artifacts/lambda.zip"
 5 | }
 6 | 
 7 | resource "aws_iam_role" "iam_for_lambda" {
 8 |   name = "iam_for_lambda"
 9 | 
10 |   assume_role_policy = <<EOF
11 | {
12 |   "Version": "2012-10-17",
13 |   "Statement": [
14 |     {
15 |       "Action": "sts:AssumeRole",
16 |       "Principal": {
17 |         "Service": "lambda.amazonaws.com"
18 |       },
19 |       "Effect": "Allow",
20 |       "Sid": ""
21 |     }
22 |   ]
23 | }
24 | EOF
25 | }
26 | 
27 | resource "aws_lambda_function" "test_lambda" {
28 |   filename         = "${module.python_lambda_archive.archive_path}"
29 |   function_name    = "lambda_function_name"
30 |   role             = "${aws_iam_role.iam_for_lambda.arn}"
31 |   handler          = "exports.test"
32 |   source_code_hash = "${module.python_lambda_archive.source_code_hash}"
33 |   runtime          = "python3.6"
34 | 
35 |   environment {
36 |     variables = {
37 |       foo = "bar"
38 |     }
39 |   }
40 | }
41 | 


--------------------------------------------------------------------------------
/examples/python/my_lambda.py:
--------------------------------------------------------------------------------
1 | def entrypoint():
2 |     print("Hello world.")
3 |     return 0


--------------------------------------------------------------------------------
/examples/python/requirements.txt:
--------------------------------------------------------------------------------
1 | pandas
2 | scikit-learn


--------------------------------------------------------------------------------
/main.tf:
--------------------------------------------------------------------------------
1 | data "external" "lambda_archive" {
2 |     program = ["python3", "${path.module}/scripts/build_lambda.py"]
3 |     query = {
4 |         src_dir              = var.src_dir
5 |         output_path          = var.output_path
6 |         install_dependencies = var.install_dependencies
7 |     }
8 | }


--------------------------------------------------------------------------------
/outputs.tf:
--------------------------------------------------------------------------------
1 | output "archive_path" {
2 |     description = "Path of the archive file."
3 |     value       = data.external.lambda_archive.result.archive
4 | }
5 | 
6 | output "source_code_hash" {
7 |     description = "Base64 encoded SHA256 hash of the archive file."
8 |     value       = data.external.lambda_archive.result.base64sha256
9 | }


--------------------------------------------------------------------------------
/scripts/build_lambda.py:
--------------------------------------------------------------------------------
 1 | 
 2 | from distutils.dir_util import copy_tree
 3 | 
 4 | import base64
 5 | import errno
 6 | import hashlib
 7 | import json
 8 | import logging
 9 | import os
10 | import shutil
11 | import subprocess
12 | import sys
13 | import tempfile
14 | import zipfile
15 | 
16 | def build(src_dir, output_path, install_dependencies):
17 |     with tempfile.TemporaryDirectory() as build_dir:
18 |         copy_tree(src_dir, build_dir)
19 |         if os.path.exists(os.path.join(src_dir, 'requirements.txt')):
20 |             subprocess.run(
21 |                 [sys.executable,
22 |                  '-m',
23 |                  'pip',
24 |                  'install',
25 |                  '--ignore-installed',
26 |                  '--target', build_dir,
27 |                  '-r', os.path.join(build_dir, 'requirements.txt'),
28 |                  *(['--no-deps'] if install_dependencies == 'false' else [])],
29 |                  check=True,
30 |                  stdout=subprocess.DEVNULL,
31 |             )
32 |         make_archive(build_dir, output_path)
33 |         return output_path
34 | 
35 | 
36 | def make_archive(src_dir, output_path):
37 |     try:
38 |         os.makedirs(os.path.dirname(output_path))
39 |     except OSError as e:
40 |         if e.errno == errno.EEXIST:
41 |             pass
42 |         else:
43 |             raise
44 | 
45 |     with zipfile.ZipFile(output_path, 'w') as archive:
46 |         paths = dict()
47 |         for root, dirs, files in os.walk(src_dir):
48 |             paths[root] = files
49 | 
50 |         for root in sorted(list(paths.keys())):
51 |             for file in sorted(paths[root]):
52 |                 if file.endswith('.pyc'):
53 |                     break
54 |                 metadata = zipfile.ZipInfo(
55 |                     os.path.join(root, file).replace(src_dir, '').lstrip(os.sep)
56 |                 )
57 |                 metadata.external_attr = 0o755 << 16
58 |                 with open(os.path.join(root, file), 'rb') as f:
59 |                     data = f.read()
60 |                 archive.writestr(
61 |                     metadata,
62 |                     data
63 |                 )
64 | 
65 | def get_hash(output_path):
66 |     '''
67 |     Return base64 encoded sha256 hash of archive file
68 |     '''
69 |     with open(output_path, 'rb') as f:
70 |         h = hashlib.sha256()
71 |         h.update(f.read())
72 |     return base64.standard_b64encode(h.digest()).decode('utf-8', 'strict')
73 | 
74 | 
75 | if __name__ == '__main__':
76 |     logging.basicConfig(level='DEBUG')
77 |     query = json.loads(sys.stdin.read())
78 |     logging.debug(query)
79 |     archive = build(query['src_dir'], query['output_path'], query['install_dependencies'])
80 |     print(json.dumps({'archive': archive, 'base64sha256':get_hash(archive)}))
81 | 


--------------------------------------------------------------------------------
/variables.tf:
--------------------------------------------------------------------------------
 1 | variable "src_dir" {
 2 |     description = "Path to root of Python source to package."
 3 |     type        = string
 4 | }
 5 | 
 6 | variable "output_path" {
 7 |     description = "The output of the archive file."
 8 |     type        = string
 9 | }
10 | 
11 | variable "install_dependencies" {
12 |     description = "Whether to install pip dependecies"
13 |     type        = bool
14 |     default     = true
15 | }


--------------------------------------------------------------------------------