terraform-provider-awsenvsecretlayer

README

AWS Lambda Environment Secret Layer Terraform Provider

This Terraform provider offers a custom resource for managing AWS Lambda environment secret layers. It allows you to create and update Lambda layers with environment variables and secrets from AWS Secrets Manager. The layer is created with a .env file containing the environment variables and secrets, which can then be used by your Lambda functions.

Features

• Creates a Lambda layer with environment variables and secrets.
• Supports updating the Lambda layer when changes are detected in environment variables or secrets.
• Allows controlling the deletion of the Lambda layer during the update process with the skip_destroy parameter.

Usage

./envs/vars.yaml

var1: "example-1"
var2: "example-2"
var3: "example-3"

main.tf

terraform {
  required_providers {
    awsenvsecretlayer = {
      source = "saltydogtechnology/awsenvsecretlayer"
      version = "1.0.1"
    }
  }
}

provider "awsenvsecretlayer" {
  region  = "us-east-1"
  profile = "aws-profile-name"
}

locals {
  yaml_data = yamldecode(file("${path.module}/envs/vars.yaml"))
}

resource "awsenvsecretlayer_lambda" "example" {
  layer_name          = "example-layer"
  file_name           = "example.env"
  yaml_config         = jsonencode(local.yaml_data)
  secrets_arns        = [
    "arn:aws:secretsmanager:us-east-1:111111111111:secret:example1/env-1/123",
    "arn:aws:secretsmanager:us-east-1:222222222222:secret:example2/secret/1233"
  ]
  envs_map = {
    "ENV_VAR_FROM_MAP_1" = "value_1"
    "ENV_VAR_FROM_MAP_2" = "value_2"
    "ENV_VAR_FROM_MAP_3" = "value_3"
  }
  compatible_runtimes = ["nodejs14.x", "python3.8"]
  skip_destroy        = false
  license_files       = ["${path.module}/envs/LICENSE.txt"]
}

Inputs

Name	Description	Type	Default	Required
layer_name	Name of the Lambda Layer.	string	n/a	yes
file_name	Name of the environment file within the Lambda Layer.	string	n/a	yes
yaml_config	YAML configuration content, as a string.	string	""	no
secrets_arns	List of AWS Secrets Manager ARNs to fetch secrets from.	list(string)	[]	no
envs_map	A map of environment variables to be included in the AWS Lambda Layer .env file.	map(string)	{}	no
compatible_runtimes	List of compatible runtimes for the Lambda Layer.	list(string)	[]	no
skip_destroy	Whether to skip deleting the layer version during updates.	bool	false	no
license_files	A list of file paths for license files that you want to include in the layer.	list(string)	[]	no

Outputs

Name	Description
layer_id	The ARN of the created Lambda layer.

Limitations

• The module does not support reading the existing Lambda layer, as the API does not provide information that can be used for this purpose.
• The plan output does not show "1 to destroy" when a layer is deleted during an update, as Terraform considers it an update rather than a delete/create operation.