Legend
LambdaModuleDeployment
AWS Lambda deployment configuration. v1 supports UpdateFunctionCode- PublishVersion + UpdateAlias. Pre/post deploy hooks and weighted- routing alias shifts are deliberately out of scope for v1.
enum
required
Deployment type discriminatorAllowed values:
aws:lambdaLambdaDeploymentInfrastructure
required
Infrastructure resources required by the deployment.See: LambdaDeploymentInfrastructure
integer
Maximum total wall-clock budget (in seconds) for a single deploy,
measured from the moment the workflow starts (including time spent
waiting for the deployment-manager lock). Matches the semantics of
pipeline step
timeout.
Default: unset (no wall-clock cap).(format:int32,min:60)InputProperty[]
required
Deployment-specific inputs shown in the deploy modal.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
LambdaDeploymentDefinition
required
Per-deploy definition. Templateable — supports both module.input
and deploy.input references inside string fields.See: LambdaDeploymentDefinition(templateable)
LambdaFunctionConfiguration
Per-deploy function-configuration overrides applied via
UpdateFunctionConfiguration before the new code is published.
Every field is optional — omitted fields are left untouched on
AWS (partial update semantic). Omitting the entire block skips
the UpdateFunctionConfiguration phase.Templateable — every string/scalar leaf supports module.input and
deploy.input references.See: LambdaFunctionConfiguration(templateable)LambdaDeploymentDefinition
Per-deploy Lambda definition — discriminated bypackage_type.Discriminated union. The package_type field selects which schema applies.LambdaDeploymentInfrastructure
Infrastructure resources required for AWS Lambda deployment. Not provisioned by the deploy manager — must already exist (typically created by thecompute/lambda Terraform module). The alias is
expected to already exist on the function; the deploy step only
flips it onto a freshly-published version.string
required
Full ARN of the Lambda function the deploy targets.(minLen:1; templateable)
string
required
AWS region of the function. Mirrors
aws_static_module_deployment’s
s3_region — needed because Lambda’s regional endpoint is the only
thing the workflow can reach the function through.(minLen:1; templateable)string | null
Alias the deploy flips after publishing the new function version.
Default:
live. The alias must already exist on the function — the
deploy step calls UpdateAlias, never CreateAlias.(templateable)string | null
S3 bucket the build step uploaded the zip artifact into. Optional —
captured into the deploy snapshot for audit even when the deploy
itself targets an Image-packaged function.(templateable)
LambdaFunctionConfiguration
AWS Lambda function configuration — every field optional, applied as a partial update viaUpdateFunctionConfiguration. Fields the user
omits are left untouched on AWS; an empty block (or omitting the
function_configuration key entirely) skips the
UpdateFunctionConfiguration phase altogether.All scalar/string fields are templateable for << module.input.* >>
and << deploy.input.* >> expressions.https://docs.aws.amazon.com/lambda/latest/api/API_UpdateFunctionConfiguration.htmlstring | null
IAM execution role ARN.(templateable)
string | null
Handler entrypoint (Zip only — ignored for Image).(templateable)
string | null
Lambda runtime (Zip only — ignored for Image).(templateable)
integer | null
Memory size in MiB. 128–10240.(format:int32,min:128,max:10240; templateable)
integer | null
Wall-clock timeout in seconds. 1–900.(format:int32,min:1,max:900; templateable)
string | null
Function description shown in the AWS console.(templateable)
enum[x86_64,arm64][] | null
CPU architectures — exactly one of
x86_64 or arm64.(templateable)LambdaEnvironment
LambdaVpcConfig
VPC configuration. Setting empty arrays disconnects the function
from the VPC.See: LambdaVpcConfig(templateable)
string[] | null
Lambda layer ARNs (versioned, e.g.
arn:aws:lambda:us-east-1:123456789012:layer:foo:3).(templateable)LambdaEphemeralStorage
LambdaTracingConfig
string | null
Customer-managed KMS key ARN for environment variable encryption.(templateable)
LambdaDeadLetterConfig
LambdaFileSystemConfig[] | null
LambdaSnapStart
SnapStart configuration. Java-only on AWS today, but the field is
forwarded as-is to Lambda.See: LambdaSnapStart(templateable)
LambdaLoggingConfig
LambdaImageConfig
LambdaImageDefinition
Image-packaged Lambda deploy definition. The image must already exist in ECR (typically pushed by the upstream build step’secr destination).enum
required
Definition type discriminator.Allowed values:
image(templateable)string
required
Full ECR image URI. Prefer
<repo>@sha256:<digest> form for
reproducibility — Lambda resolves a mutable tag at deploy time and
silently pins it, but the deploy snapshot records the resolved
digest only when one was provided.(minLen:1; templateable)LambdaZipDefinition
Zip-packaged Lambda deploy definition. The code object must already exist in S3 (typically uploaded by the upstream build step’ss3-zip destination).enum
required
Definition type discriminator.Allowed values:
zip(templateable)string
required
S3 key the build step uploaded into.
Templateable — typically references a deploy input that holds the
key written by the upstream build step.(minLen:1; templateable)
LambdaDeadLetterConfig
Dead-letter destination for async invocations.string | null
SQS queue ARN or SNS topic ARN.(templateable)
LambdaEnvironment
Lambda function environment block. Mirrors AWS Lambda’sEnvironment shape — a single variables map of string → string.map<string,string> | null
Environment variables applied to the function. Replaces the
existing variable set on AWS — the API doesn’t merge.(templateable)
LambdaEphemeralStorage
Function-level ephemeral storage (/tmp) size in MiB.integer
required
Size in MiB. 512–10240.(format:int32,min:512,max:10240; templateable)
LambdaFileSystemConfig
EFS file system attached to the function.string
required
EFS access point ARN.(templateable)
string
required
Mount path inside the container — must start with
/mnt/.(templateable)LambdaImageConfig
Container image configuration overrides — image-packaged functions only.string[] | null
Override the image’s CMD.(templateable)
string[] | null
Override the image’s ENTRYPOINT.(templateable)
string | null
Override the image’s WORKDIR.(templateable)
LambdaLoggingConfig
Function logging configuration (CloudWatch destination + log levels).enum | null
Format the logs are emitted in.Allowed values:
JSON | Text(templateable)enum | null
Application log level — only valid when
log_format is JSON.Allowed values: TRACE | DEBUG | INFO | WARN | ERROR | FATAL(templateable)enum | null
System log level — only valid when
log_format is JSON.Allowed values: DEBUG | INFO | WARN(templateable)string | null
Destination CloudWatch log group.(templateable)
LambdaSnapStart
SnapStart configuration.enum
required
When to take the snapshot.
None disables SnapStart;
PublishedVersions snapshots each PublishVersion call.Allowed values: None | PublishedVersions(templateable)LambdaTracingConfig
AWS X-Ray tracing configuration.enum
required
Active samples + traces requests; PassThrough only propagates an
upstream sampling decision.Allowed values:
Active | PassThrough(templateable)LambdaVpcConfig
VPC configuration for a Lambda function.string[] | null
Subnet IDs the function’s ENIs are placed into.(templateable)
string[] | null
Security group IDs attached to the function’s ENIs.(templateable)
boolean | null
Whether the function gets dual-stack IPv6 networking.(templateable)