Fix: Race between layer and Lambda update (#5927)

Makefile

@@ -99,6 +99,7 @@ $(1)terraform: lambdas
 
 .PHONY: $(1)deploy
 $(1)deploy: check_python $(1)terraform
+	python $(project_root)/scripts/delete_lambda_versions.py
 	python $(project_root)/scripts/post_deploy_tdr.py
 endef
 

scripts/delete_lambda_versions.py

@@ -0,0 +1,40 @@
+"""
+Delete all published AWS Lambda versions except for "$LATEST" in the current
+deployment.
+"""
+
+import logging
+
+from azul.deployment import (
+    aws,
+)
+from azul.lambdas import (
+    Lambdas,
+)
+from azul.logging import (
+    configure_script_logging,
+)
+
+log = logging.getLogger(__name__)
+
+
+def main():
+    lambdas = Lambdas().list_lambdas(deployment_only=True)
+    for lambda_ in lambdas:
+        log.info('Fetching the published versions of %s', lambda_.name)
+        response = aws.lambda_.list_versions_by_function(FunctionName=lambda_.name)
+        for version in response['Versions']:
+            version = version['Version']
+            if version == '$LATEST':
+                pass
+            else:
+                log.info('Deleting published version %s of %s', version, lambda_.name)
+                aws.lambda_.delete_function(
+                    FunctionName=lambda_.name,
+                    Qualifier=version
+                )
+
+
+if __name__ == '__main__':
+    configure_script_logging(log)
+    main()

src/azul/terraform.py

@@ -708,6 +708,10 @@ def tf_config(self, app_name):
         for resource in resources['aws_lambda_function'].values():
             assert 'layers' not in resource
             resource['layers'] = ['${aws_lambda_layer_version.dependencies.arn}']
+            # Publishing the Lambda function as a new version prevents possible
+            # race conditions when there's a cyclic dependency between an update
+            # to the function's configuration and an update to its code
+            resource['publish'] = True
             env = config.es_endpoint_env(
                 es_endpoint=(
                     aws.es_endpoint