Importing AWS Lambda function can fail to validate

[Fuuzetsu]

What happened?

I ran the below. It is some existing Lambda function we had since our terraform days that has been imported into pulumi. I've updated pulumi and now it fails to work.

[shana@aya:~/programming/tsuru-cloud/aws-cluster/infra]$ pulumi import aws:lambda/function:Function slack-notify-ops-notify-second slack-notify-ops-notify
Previewing import (production):
     Type                    Name                            Plan       Info
     pulumi:pulumi:Stack     infra-production                           
 =   └─ aws:lambda:Function  slack-notify-ops-notify-second  import     4 warnings


Diagnostics:
  aws:lambda:Function (slack-notify-ops-notify-second):
    warning: One or more imported inputs failed to validate. This is almost certainly a bug in the `aws` provider. The import will still proceed, but you will need to edit the generated code after copying it into your program.
    warning: aws:lambda/function:Function resource 'slack-notify-ops-notify-second' has a problem: Invalid combination of arguments: "filename": one of `filename,image_uri,s3_bucket` must be specified. Examine values at 'Function.Filename'.
    warning: aws:lambda/function:Function resource 'slack-notify-ops-notify-second' has a problem: Invalid combination of arguments: "image_uri": one of `filename,image_uri,s3_bucket` must be specified. Examine values at 'Function.ImageUri'.
    warning: aws:lambda/function:Function resource 'slack-notify-ops-notify-second' has a problem: Invalid combination of arguments: "s3_bucket": one of `filename,image_uri,s3_bucket` must be specified. Examine values at 'Function.S3Bucket'

Expected Behavior

It should not complain as long as there is sourceCodeHash I guess.

Steps to reproduce

I think one has to create a Lambda function in some non-pulumi way (such as in AWS console or terraform) with inline code (i.e. not pointing to S3 or OCI) then try to import it into pulumi.

Output of pulumi about

CLI          
Version      3.54.0
Go Version   go1.20
Go Compiler  gc

Plugins
NAME       VERSION
aws        5.10.0
cloudinit  1.3.0
docker     3.4.0
github     4.16.0
gitlab     4.8.0
nodejs     unknown
tls        4.6.0

Host     
OS       nixos
Version  22.11 (Raccoon)
Arch     x86_64

This project is written in nodejs: executable='/nix/store/dnhhyhfql3cs9jmrhd3a05620higxy0i-nodejs-18.14.2/bin/node' version='v18.14.2'

Current Stack: production

<snip resources>

Found no pending operations associated with production

Backend        
Name           aya
URL            s3://tf-state-20200512052736435300000001?profile=admin
User           shana
Organizations  

Dependencies:
NAME                              VERSION
@pulumi/tls                       4.6.0
@typescript-eslint/eslint-plugin  5.34.0
eslint                            8.22.0
@pulumi/awsx                      0.40.0
@pulumi/gitlab                    4.8.0
@pulumi/pulumi                    3.37.2
@pulumi/github                    4.16.0
@types/node                       14.18.23
@typescript-eslint/parser         5.34.0
yaml                              2.1.1
@iarna/toml                       2.2.5
@pulumi/aws                       5.10.0
@pulumi/cloudinit                 1.3.0

Additional context

Used to work fine in pulumi 3.3 or so, just trying to upgrade...

Contributing

Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).

[Fuuzetsu]

I notice same problem with custom deployment packages. I guess it just needs to validate if sourceCodeHash is present.

[rquitales]

Hi @Fuuzetsu and thanks for reporting this. I was able to reproduce this issue and it looks like we could improve the client side validation on these fields.

[arwilczek90]

I have this occurring on lambda functions that were already imported and have its code deployed separately with ignore_changes:['code','s3Bucket','s3Key'] as an option.

[yatsky]

hi @rquitales any update on this? running into the same issue.

[arwilczek90]

I found a workaround to this issue, for my usecase on already imported lambdas. You have to manually edit state and as long as you add something for one of the the ignore_changes keys I mentioned above, you'll be able to actually run the pulumi program again.

[VenelinMartinov]

Hi all, sorry you are having this issue. Currently investigating, here are exact repro steps:

# __main__.py
"""An AWS Python Pulumi program"""

import pulumi
import pulumi_aws as aws
import pulumi_archive as archive

assume_role = aws.iam.get_policy_document(
    statements=[
        aws.iam.GetPolicyDocumentStatementArgs(
            effect="Allow",
            principals=[
                aws.iam.GetPolicyDocumentStatementPrincipalArgs(
                    type="Service",
                    identifiers=["lambda.amazonaws.com"],
                )
            ],
            actions=["sts:AssumeRole"],
        )
    ]
)
iam_for_lambda = aws.iam.Role("iamForLambda", assume_role_policy=assume_role.json)
lambda_ = archive.get_file(
    type="zip", source_file="lambda.js", output_path="lambda_function_payload.zip"
)
test_lambda = aws.lambda_.Function(
    "testLambda",
    code=pulumi.FileArchive("lambda_function_payload.zip"),
    role=iam_for_lambda.arn,
    handler="index.test",
    runtime="nodejs18.x",
    environment=aws.lambda_.FunctionEnvironmentArgs(
        variables={
            "foo": "bar",
        },
    ),
)

pulumi.export("lambdaArn", test_lambda.name)

// lambda.js
console.log("lambda")

#! /bin/sh
set -x

pulumi stack init original
pulumi up --stack original --yes
mv __main__.py __main__.original.py
eval "$(pulumi stack output --stack original --shell)"

pulumi stack init imported
pulumi import aws:lambda/function:Function mylambda "$lambdaArn" --stack imported --out __main__.py --yes
pulumi up --stack imported --yes

I'm still digging into this but it looks to me like the upstream provider doesn't support specifying a lambda via a source_code_hash: https://github.com/hashicorp/terraform-provider-aws/blob/97c16f28e84ab7afda6b935e19b9243510931c81/internal/service/lambda/function.go#L169-173

The filename, s3_bucket and image_url are specified as ExactlyOneOf - so inputting just source_code_hash does not pass the validation for the resource.

[t0yv0]

Could you paste the code generated by pulumi import? Much appreciated.

[VenelinMartinov]

Generated code:

import pulumi
import pulumi_aws as aws

mylambda = aws.lambda_.Function("mylambda",
    architectures=["x86_64"],
    environment=aws.lambda_.FunctionEnvironmentArgs(
        variables={
            "foo": "bar",
        },
    ),
    ephemeral_storage=aws.lambda_.FunctionEphemeralStorageArgs(
        size=512,
    ),
    handler="index.test",
    logging_config=aws.lambda_.FunctionLoggingConfigArgs(
        log_format="Text",
        log_group="/aws/lambda/testLambda-4b3ee0e",
    ),
    name="testLambda-4b3ee0e",
    package_type="Zip",
    role="arn:aws:iam::616138583583:role/iamForLambda-47093df",
    runtime="nodejs18.x",
    source_code_hash="WUsPYQdwiMj+sDZzl3tNaSzS42vqVfng2CZtgcy+TRs=",
    tracing_config=aws.lambda_.FunctionTracingConfigArgs(
        mode="PassThrough",
    ),
    opts=pulumi.ResourceOptions(protect=True))

Discussion in the PR.

Another thing to note is that the error message is slightly misleading - we don't have a filename parameter on the pulumi side - we have code instead.

[t0yv0]

I'm bit concerned that the import doesn't actually import the source code back at all it seems, that'd be very unfortunate. Double-checking...

[VenelinMartinov]

After discussing with the user, it sounds like they were actually using the import resource option, not pulumi import.

The use case is that they configure properties of lambdas in pulumi and manage the source code outside of pulumi. They have a component resource which handles creating or importing a lambda.

I am trying to repro the issue with that now. Not sure that #3371 is still relevant.

[VenelinMartinov]

#3420 contains a test which reproduces the problem. It works in 5.28, before we picked up upstream https://github.com/hashicorp/terraform-provider-aws/releases/tag/v4.51.0 with https://github.com/hashicorp/terraform-provider-aws/pull/28963/files, which introduces the ExactlyOneOf constraints in the lambda resource.

Unfortunately it does not work now and #3371 does not fix it either.

[VenelinMartinov]

I dumped the GRPC logs and it looks like on the old version the provider was fine to create the lambda without any of the code-related properties:

{
    "method": "/pulumirpc.ResourceProvider/Create",
    "request": {
        "urn": "urn:pulumi:new_stack::lambda-import-ts::aws:iam/role:Role::iamForLambda",
        "properties": {
            "__defaults": [
                "forceDetachPolicies",
                "maxSessionDuration",
                "name",
                "path"
            ],
            "assumeRolePolicy": "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"\",\n      \"Effect\": \"Allow\",\n      \"Action\": \"sts:AssumeRole\",\n      \"Principal\": {\n        \"Service\": \"lambda.amazonaws.com\"\n      }\n    }\n  ]\n}",
            "forceDetachPolicies": false,
            "maxSessionDuration": 3600,
            "name": "iamForLambda-b2ce990",
            "path": "/"
        }
    },
    "response": {
        "id": "iamForLambda-b2ce990",
        "properties": {
            "arn": "arn:aws:iam::616138583583:role/iamForLambda-b2ce990",
            "assumeRolePolicy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"},\"Sid\":\"\"}],\"Version\":\"2012-10-17\"}",
            "createDate": "2024-02-12T19:44:22Z",
            "description": "",
            "forceDetachPolicies": false,
            "id": "iamForLambda-b2ce990",
            "inlinePolicies": [],
            "managedPolicyArns": [],
            "maxSessionDuration": 3600,
            "name": "iamForLambda-b2ce990",
            "namePrefix": "",
            "path": "/",
            "tags": {},
            "tagsAll": {},
            "uniqueId": "AROAY65FYVYPYARWH6ZZA"
        }
    },
    "metadata": {
        "kind": "resource",
        "mode": "client",
        "name": "aws"
    }
}

This now fails validation since, the code-related properties have ExactlyOneOf:

{
    "method": "/pulumirpc.ResourceProvider/Check",
    "request": {
        "urn": "urn:pulumi:new_stack::lambda-import-ts::aws:lambda/function:Function::testLambda",
        "olds": {
            "__defaults": [],
            "architectures": [
                "x86_64"
            ],
            "environment": {
                "__defaults": [],
                "variables": {
                    "__defaults": [],
                    "foo": "bar"
                }
            },
            "ephemeralStorage": {
                "__defaults": [],
                "size": 512
            },
            "handler": "index.test",
            "loggingConfig": {
                "__defaults": [],
                "logFormat": "Text",
                "logGroup": "/aws/lambda/testLambda-e18048d"
            },
            "name": "testLambda-e18048d",
            "packageType": "Zip",
            "role": "arn:aws:iam::616138583583:role/iamForLambda-59ba85f",
            "runtime": "nodejs18.x",
            "sourceCodeHash": "w3TynYbo9Bzf7EGybQM2nqaWmj90KvEjco9uUO9V958=",
            "tracingConfig": {
                "__defaults": [],
                "mode": "PassThrough"
            }
        },
        "news": {
            "environment": {
                "variables": {
                    "foo": "bar"
                }
            },
            "handler": "index.test",
            "name": "testLambda-e18048d",
            "role": "arn:aws:iam::616138583583:role/iamForLambda-59ba85f",
            "runtime": "nodejs18.x"
        },
        "randomSeed": "Tq/0qSKp//dn8sQ7CmsgKDW6T/Zfzqs98PG/BH6oywo="
    },
    "response": {
        "inputs": {
            "__defaults": [
                "memorySize",
                "packageType",
                "publish",
                "reservedConcurrentExecutions",
                "skipDestroy",
                "timeout"
            ],
            "environment": {
                "__defaults": [],
                "variables": {
                    "foo": "bar"
                }
            },
            "handler": "index.test",
            "memorySize": 128,
            "name": "testLambda-e18048d",
            "packageType": "Zip",
            "publish": false,
            "reservedConcurrentExecutions": -1,
            "role": "arn:aws:iam::616138583583:role/iamForLambda-59ba85f",
            "runtime": "nodejs18.x",
            "skipDestroy": false,
            "timeout": 3
        },
        "failures": [
            {
                "reason": "Invalid combination of arguments. \"s3_bucket\": one of `filename,image_uri,s3_bucket,source_code_hash` must be specified. Examine values at 'testLambda.s3Bucket'."
            },
            {
                "reason": "Invalid combination of arguments. \"filename\": one of `filename,image_uri,s3_bucket,source_code_hash` must be specified. Examine values at 'testLambda.code'."
            },
            {
                "reason": "Invalid combination of arguments. \"source_code_hash\": one of `filename,image_uri,s3_bucket,source_code_hash` must be specified. Examine values at 'testLambda.sourceCodeHash'."
            },
            {
                "reason": "Invalid combination of arguments. \"image_uri\": one of `filename,image_uri,s3_bucket,source_code_hash` must be specified. Examine values at 'testLambda.imageUri'."
            }
        ]
    },
    "metadata": {
        "kind": "resource",
        "mode": "client",
        "name": "aws"
    }
}

The ignorChanges does not help since that only removes the ignored properties from the new input, which still fails the validation.

Found some relevant documentation on imports as @t0yv0 suggested: https://pulumi-developer-docs.readthedocs.io/en/latest/architecture/import.html#import-resource-option, these confirm that ignoreChanges can't really help here.

[VenelinMartinov]

This was fixed in #3420 and released in https://github.com/pulumi/pulumi-aws/releases/tag/v6.22.2

Please let us know if you are still having trouble with this.