rvn-lambda / Latest version: 2.1.0
See Lambda Function module reference for the full module page.
AWS account & region
string
required
AWS account.
- Immutable after creation
string
required
Region.
- Immutable after creation
Lambda function config
string
required
Lambda type.
- Default:
regional - Allowed values:
regional(Regional Lambda),edge(CloudFront Lambda@Edge) - Immutable after creation
string
required
Function name. Name for the Lambda function and related resources.
- Default:
<<project.given_id>>-<<environment.given_id>>-<<module.given_id>> - Immutable after creation
- Pattern:
^[A-Za-z0-9_-]{1,64}$— 1-64 letters, numbers, underscores, or hyphens.
string
Function description. Description shown for the Lambda function in AWS.
string
required
Package type.
- Default:
Zip - Allowed values:
Zip(Zip package),Image(Container image) - Immutable after creation
string
required
Architecture. CPU architecture used by the function.
- Default:
x86_64 - Allowed values:
x86_64,arm64 - Shown when:
{"lambda_type":"regional"}
boolean
Version publishing. Publish a new immutable Lambda version on function updates. Required for Lambda@Edge and aliases that target published versions.
- Default:
false - Shown when:
{"lambda_type":"regional"}
Zip package
string
required
Runtime. Lambda runtime for Zip packages.
- Default:
$values:first - Allowed values:
nodejs24.x(Node.js 24.x),nodejs22.x(Node.js 22.x),nodejs20.x(Node.js 20.x),python3.13(Python 3.13),python3.12(Python 3.12),python3.11(Python 3.11),ruby3.4(Ruby 3.4),ruby3.3(Ruby 3.3),java21(Java 21),java17(Java 17),dotnet8(.NET 8),provided.al2023(Go provided AL2023) - Shown when:
{"package_type":"Zip"}
string
required
Handler. Function entrypoint for the zip package, such as index.handler.
- Shown when:
{"package_type":"Zip"}
string
Package S3 bucket. S3 bucket containing the deployment package. Leave empty to create a managed code bucket.
- Shown when:
{"package_type":"Zip"}
string
Package S3 key. S3 key of the deployment package. Required when Package S3 bucket is set.
- Shown when:
{"package_type":"Zip"}
string
Code bucket name. Name for the s3 bucket used for Lambda zip artifacts. Must be globally unique. Defaults to <function-name>-code-<account-id>.
- Immutable after creation
- Pattern:
^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$— Use a valid S3 bucket name: lowercase letters, numbers, hyphens, and periods; start and end with a letter or number. - Shown when:
{"package_type":"Zip"}
boolean
Force destroy code bucket. Delete the code bucket even when it contains package objects during stack destroy.
- Default:
true - Shown when:
{"package_type":"Zip"}
string
Bootstrap object key. S3 key for the initial bootstrap deployment package in the managed code bucket.
- Default:
bootstrap-package.zip - Shown when:
{"package_type":"Zip"}
Build config
string
required
Build source.
- Default:
dockerfile - Allowed values:
dockerfile(Dockerfile),s3_package(Pull from S3),image_registry(Pull from image registry)
gitrepo
required
Git repository. Repository containing the application source for Dockerfile or Railpack builds.
- Shown when:
{"build_source":["nixpacks","dockerfile"]}
string
Source base path. Repository-relative source and build root.
- Default:
. - Shown when:
{"build_source":["nixpacks","dockerfile"]}
string
required
Package output directory. Directory inside the built image that contains the Lambda package files.
- Default:
/app - Shown when:
{"build_source":["nixpacks","dockerfile"],"package_type":"Zip"}
string
required
Image repository. ECR repository URI without a tag or digest, such as 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-function. The repository must be in the same region as the function. A repository in a different AWS account works when its repository policy grants pull access to the function’s account and the Lambda service principal.
- Shown when:
{"build_source":"image_registry","package_type":"Image"}
string
required
Initial image tag or digest. Tag or digest used only to create the function before its first deployment. It must already exist in the image repository above. Deployments promote the tag or digest you pass at deploy time; changing this value afterward has no effect. Do not include the repository URI.
- Shown when:
{"build_source":"image_registry","package_type":"Image"}
string_array
Start command. Optional command arguments that override the image default command (CMD). Leave empty to use the image default.
- Default:
[] - Shown when:
{"build_source":"image_registry","lambda_type":"regional","package_type":"Image"}
string_array
Entry point. Optional entry point arguments that override the image default ENTRYPOINT.
- Default:
[] - Shown when:
{"build_source":"image_registry","lambda_type":"regional","package_type":"Image"}
string
Working directory. Optional working directory override inside the image.
- Shown when:
{"build_source":"image_registry","lambda_type":"regional","package_type":"Image"}
Docker
string
Dockerfile path. Path to the Dockerfile to use for the build, relative to the repository root or configured source base path.
- Shown when:
{"build_source":"dockerfile"}
string
Docker build context path. Directory to use as the Docker build context, relative to the repository root or configured source base path.
- Shown when:
{"build_source":"dockerfile"}
Nixpacks
string
Install command.
- Shown when:
{"build_source":"nixpacks"}
string
Build command.
- Shown when:
{"build_source":"nixpacks"}
string
Start command.
- Shown when:
{"build_source":"nixpacks","package_type":"Image"}
string
Nixpacks config file path. Path to a custom Nixpacks config file, relative to the repository root or configured source base path.
- Shown when:
{"build_source":"nixpacks"}
string
Nixpacks build path. Application path for Nixpacks to build, relative to the repository root or configured source base path.
- Shown when:
{"build_source":"nixpacks"}
string
Nixpacks version. Optional Nixpacks version to use for the build. Leave blank to use the default version.
- Shown when:
{"build_source":"nixpacks"}
string_array
Nix packages. Additional Nix packages to install during the Nixpacks build.
- Shown when:
{"build_source":"nixpacks"}
string_array
APT packages. Additional APT packages to install during the Nixpacks build.
- Shown when:
{"build_source":"nixpacks"}
string_array
Nix libraries. Additional Nix libraries to make available during the Nixpacks build.
- Shown when:
{"build_source":"nixpacks"}
Runtime configuration
number
required
Memory (MB). Memory allocated to the function. Lambda CPU scales with memory.
- Default:
128 - Min:
128 - Max:
10240 - Shown when:
{"lambda_type":"regional"}
number
required
Timeout (secs). Maximum runtime for a single invocation.
- Default:
5 - Min:
1 - Max:
900 - Shown when:
{"lambda_type":"regional"}
number
Ephemeral storage (MB). Size of the function’s /tmp directory.
- Default:
512 - Min:
512 - Max:
10240 - Shown when:
{"lambda_type":"regional"}
string_array
Lambda layers. Versioned Lambda layer ARNs to attach to the function.
- Default:
[] - Shown when:
{"lambda_type":"regional","package_type":"Zip"}
number
Reserved concurrency. Reserved concurrent executions for this function. Use -1 to remove limits.
- Min:
-1 - Shown when:
{"lambda_type":"regional"}
string
Environment KMS key ARN. Optional customer-managed KMS key ARN used to encrypt environment variables.
- Shown when:
{"lambda_type":"regional"}
string
X-Ray tracing. Choose whether Lambda actively traces invocations with AWS X-Ray.
- Default:
PassThrough - Allowed values:
PassThrough(Pass through),Active - Shown when:
{"lambda_type":"regional"}
string
Code signing config ARN. Optional Lambda code signing configuration ARN.
- Shown when:
{"lambda_type":"regional","package_type":"Zip"}
string
Dead-letter target ARN. Optional SQS queue or SNS topic ARN for asynchronous invocation failures.
- Shown when:
{"lambda_type":"regional"}
object_array
File systems. EFS access points mounted into the function.
- Default:
[] - Shown when:
{"lambda_type":"regional"}
Environment variables
object
Build environment variables. Only available during the build, not at runtime.
- Shown when:
{"build_source":["nixpacks","dockerfile"]}
boolean
Inject environment variables in Dockerfile. Pass build environment variables into Dockerfile builds as build arguments.
- Default:
false - Shown when:
{"build_source":"dockerfile"}
object
Runtime environment variables. Environment variables passed to the Lambda function.
- Default:
{} - Shown when:
{"lambda_type":"regional"}
VPC config
boolean
VPC access. Optional. Attach the Lambda function to a VPC only when it needs private network access.
- Default:
false - Shown when:
{"lambda_type":"regional"}
$ref:rvn-aws-network
required
VPC network. Optional VPC network for Lambda VPC access. Leave empty for a Lambda function that does not attach to a VPC.
- Immutable after creation
- Shown when:
{"lambda_type":"regional","vpc_config_enabled":true}
network to null.
Mapped inputs for network: set these keys alongside network, not inside it, when supplying existing infrastructure instead of a module reference.
string
VPC ID.
- Default:
<<ref.stack.output.vpc_id>> - Immutable after creation
string_array
Private subnet IDs. Private subnet IDs from the selected VPC network.
- Default:
<<ref.stack.output.private_subnet_ids>> - Immutable after creation
string_array
Public subnet IDs. Public subnet IDs from the selected VPC network.
- Default:
<<ref.stack.output.public_subnet_ids>> - Immutable after creation
boolean
Run in private subnets. Use private subnets from the selected VPC network. Turn off to use public subnets.
- Default:
true - Shown when:
{"lambda_type":"regional","vpc_config_enabled":true}
string_array
required
Security group IDs. Security group IDs to attach to the Lambda function ENIs.
- Shown when:
{"lambda_type":"regional","vpc_config_enabled":true}
boolean
IPv6 allowed for dual stack. Allow outbound IPv6 for dual-stack subnets.
- Default:
false - Shown when:
{"lambda_type":"regional","vpc_config_enabled":true}
IAM permissions
boolean
Create IAM role. Create and manage the Lambda execution role in this module.
- Default:
true - Immutable after creation
string
required
Existing role ARN. IAM role ARN to use when this module should not create the role.
- Shown when:
{"role_creation_enabled":false}
string
Role name. Custom IAM role name. Defaults to <function-name>-lambda-role.
- Immutable after creation
- Shown when:
{"role_creation_enabled":true}
string
Role path. IAM path for the created role.
- Default:
/ - Immutable after creation
- Shown when:
{"role_creation_enabled":true}
string
Permissions boundary ARN. Optional IAM permissions boundary for the created role.
- Shown when:
{"role_creation_enabled":true}
boolean
Basic execution policy. Attach AWSLambdaBasicExecutionRole to the created role.
- Default:
true - Shown when:
{"role_creation_enabled":true}
boolean
VPC execution policy. Attach AWSLambdaVPCAccessExecutionRole to the created role when VPC config is set.
- Default:
true - Shown when:
{"lambda_type":"regional","role_creation_enabled":true}
string_array
Managed policy ARNs. Additional managed policies to attach to the created role.
- Default:
[] - Shown when:
{"role_creation_enabled":true}
object
Inline role policies. Map of inline policy name to JSON policy document for the created role.
- Default:
{} - Shown when:
{"role_creation_enabled":true}
object_array
Invoke permissions. Permission statements for services or accounts that invoke this function.
- Default:
[] - Shown when:
{"lambda_type":"regional"}
CloudWatch alarms
boolean
Monitor invocation error rate. Keep enabled to detect invocation failures. Disable if monitored elsewhere. Configure SNS actions or an EventBridge relay for notifications.
- Default:
true
number
Error rate threshold (%). Failed invocations as a percentage of all invocations; triggers at or above this value.
- Default:
1 - Min:
1 - Max:
100 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Consecutive alarm periods.
- Default:
1 - Min:
1 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
number
Alarm period (seconds).
- Default:
300 - Allowed values:
60(60),300(300),900(900),3600(3600) - Min:
60 - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
string_array
Alarm action ARNs. SNS topics must share the metric region. Use the overrides below for Edge.
- Default:
[] - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
string_array
Recovery action ARNs. SNS topics must share the metric region. Use the overrides below for Edge.
- Default:
[] - Shown when:
{"cloudwatch_alarms_creation_enabled":true}
string_array
Additional Edge alarm regions. Select every region where this function executes. The origin region is always included. Update this list as traffic expands.
- Default:
[] - Shown when:
{"cloudwatch_alarms_creation_enabled":true,"lambda_type":"edge"}
object
Alarm actions by region. Overrides shared destinations by region. Set a region to [] to suppress direct actions there.
- Default:
{} - Shown when:
{"cloudwatch_alarms_creation_enabled":true,"lambda_type":"edge"}
object
Recovery actions by region. Overrides shared destinations by region. Set a region to [] to suppress direct actions there.
- Default:
{} - Shown when:
{"cloudwatch_alarms_creation_enabled":true,"lambda_type":"edge"}
Logs
boolean
Create log group. Create and manage the CloudWatch log group for this function.
- Default:
true
string
Log group name. Custom CloudWatch log group name. Defaults to /aws/lambda/{function name}.
- Shown when:
{"log_group_creation_enabled":true}
number
Log retention days. Days to retain CloudWatch logs. Use 0 to retain indefinitely.
- Default:
30 - Allowed values:
0(Never expire),1(1 day),3(3 days),5(5 days),7(7 days),14(14 days),30(30 days),60(60 days),90(90 days),180(180 days),365(1 year) - Shown when:
{"log_group_creation_enabled":true}
string
Log KMS key ID. Optional KMS key ID or ARN for log group encryption.
- Shown when:
{"log_group_creation_enabled":true}
Function URL
boolean
Function URL. Create an HTTPS endpoint for the function.
- Default:
false - Shown when:
{"lambda_type":"regional"}
string
required
Function URL auth type. Choose whether the function URL requires AWS IAM authorization.
- Default:
AWS_IAM - Allowed values:
AWS_IAM(AWS IAM),NONE(None) - Shown when:
{"function_url_enabled":true,"lambda_type":"regional"}
string
required
Function URL invoke mode. Choose buffered responses or response streaming.
- Default:
BUFFERED - Allowed values:
BUFFERED(Buffered),RESPONSE_STREAM(Response stream) - Shown when:
{"function_url_enabled":true,"lambda_type":"regional"}
boolean
Function URL CORS. Configure CORS headers for the function URL.
- Default:
false - Shown when:
{"function_url_enabled":true,"lambda_type":"regional"}
string_array
required
Allowed origins. Origins allowed to call the function URL.
- Shown when:
{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}
string_array
required
Allowed methods. HTTP methods allowed by function URL CORS.
- Default:
["GET","POST"] - Allowed values:
GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS - Shown when:
{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}
string_array
Allowed headers. HTTP headers allowed in CORS requests.
- Default:
[] - Shown when:
{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}
boolean
Allow credentials. Allow browsers to include credentials in CORS requests.
- Default:
false - Shown when:
{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}
string_array
Exposed headers. Response headers browsers may expose to client code.
- Default:
[] - Shown when:
{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}
number
Max age (secs). Seconds browsers can cache the CORS preflight response.
- Min:
0 - Shown when:
{"function_url_cors_enabled":true,"function_url_enabled":true,"lambda_type":"regional"}
Event sources and aliases
object_array
Event source mappings. Event source mappings for streams, queues, and self-managed sources. Use advanced Terraform variables for uncommon nested mapping options.
- Default:
[] - Shown when:
{"lambda_type":"regional"}
object_map
Aliases. Lambda aliases keyed by alias name. Use aliases when callers need a stable function ARN, when routing traffic between published versions, or when integrating with services that should not point directly at $LATEST.
- Default:
{} - Shown when:
{"lambda_type":"regional"}
Advanced Lambda settings
string
SnapStart. Enable Lambda SnapStart for published versions. AWS currently supports this for Java runtimes.
- Allowed values:
PublishedVersions(Published versions) - Shown when:
{"lambda_type":"regional","package_type":"Zip"}
Builder config
string
required
Builder capacity type. Sandbox starts fastest. EC2 spot costs less but may wait for capacity or be interrupted.
- Default:
sandbox - Allowed values:
sandbox(Sandbox),ec2(EC2),ec2-spot(EC2 spot) - Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
string
required
Builder instance type. EC2 instance type for builds. Start with the default value, then increase or decrease it based on the resource usage report at the end of builds.
- Default:
c7a.4xlarge - Shown when:
{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}
number
required
Builder vCPUs.
- Default:
14 - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
number
required
Builder memory (GiB).
- Default:
28 - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
number
Builder disk (GiB). Space the build reserves on the pool host for what it writes. Larger values let fewer builds share a host.
- Default:
30 - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
boolean
Interruptible build. Lets the build run on spot hosts and start over if AWS reclaims the host. Turn off if your build commands change anything outside the build, such as running database migrations.
- Default:
true - Shown when:
{"build_capacity_type":"sandbox","build_source":["dockerfile","railpack","nixpacks"]}
string
Builder execution environment. Optional execution environment ID or given ID for builds. Defaults to the module Terraform execution environment.
- Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
string
Builder AMI. Optional AMI ID for build runners. Leave empty to use the default runner image.
- Shown when:
{"build_capacity_type":["ec2","ec2-spot"],"build_source":["dockerfile","railpack","nixpacks"]}
boolean
Include default build policies. The step’s built-in policies (ECR/S3 access, CloudWatch agent) stay attached alongside your Builder IAM policies. Turn off to run the build with only the policies listed below.
- Default:
true - Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}
string_array
Builder IAM policies. IAM managed policy ARNs for the EC2 build runner role, applied for the duration of each build.
- Default:
[] - Shown when:
{"build_source":["dockerfile","railpack","nixpacks"]}