Terraform-provider-aws: Error expanding plan for AWS Lambda Provisioned Concurrency

[OleksandrMykytenko]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.12.20

• provider.aws v2.70.0

Affected Resource(s)

• aws_lambda_provisioned_concurrency_config

Terraform Configuration Files

resource "aws_lambda_function" "function" {
  function_name = "${local.name_prefix}-${var.lambda_name_uniq_part}"
  handler       = var.lambda_handler
  role          = aws_iam_role.lambda_execution_role.arn
  runtime       = var.lambda_runtime

  memory_size = var.lambda_memory_size
  timeout     = var.lambda_execution_timeout
  filename    = var.lambda_filename

  source_code_hash = filebase64sha256(var.lambda_filename)

  environment {
    variables = var.lambda_env_vars
  }

  vpc_config {
    security_group_ids = var.lambda_sg_ids
    subnet_ids         = var.lambda_subnet_ids
  }

  reserved_concurrent_executions = 50

  depends_on = [aws_cloudwatch_log_group.lambda_logs, aws_iam_role_policy.lambda_log_policy]

  publish = true

  tags = local.common_tags
}

resource "aws_lambda_provisioned_concurrency_config" "lambda_config" {
  count = 1
  function_name                     = aws_lambda_function.function.function_name
  provisioned_concurrent_executions = 5
  qualifier                         = aws_lambda_function.function.version
}

Debug Output

Expected Behavior

New version of Lambda function should be published and provisioned concurrency config should be created and pointed to the published Lambda function version.

Actual Behavior

I see the following message:

When expanding the plan for
module.my_lambda.aws_lambda_provisioned_concurrency_config.lambda_config[0]
to include new values learned so far during apply, provider
"registry.terraform.io/-/aws" produced an invalid new value for .qualifier:
was cty.StringVal("$LATEST"), but now cty.StringVal("1").

This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Steps to Reproduce

1. terraform apply

Important Factoids

I was able to apply this code during the next (second) run w/o any issues. Seems Lambda is published during the first run and config is not, on the second run config is able to refer published Lambda version and everything is fine.

Plan operation is ok during the both runs.

References

[asmandria]

I am also experiencing this with Terraform 0.12.24 and AWS provider version 2.70.0. Plan also succeeds with no issues.

Apply output:

Error: Provider produced inconsistent final plan
--
 
When expanding the plan for aws_lambda_provisioned_concurrency_config.download
to include new values learned so far during apply, provider
"registry.terraform.io/-/aws" produced an invalid new value for .qualifier:
was cty.StringVal("13"), but now cty.StringVal("14").
 
This is a bug in the provider, which should be reported in the provider's own
issue tracker.


Error: Provider produced inconsistent final plan
 
When expanding the plan for aws_lambda_provisioned_concurrency_config.extract
to include new values learned so far during apply, provider
"registry.terraform.io/-/aws" produced an invalid new value for .qualifier:
was cty.StringVal("13"), but now cty.StringVal("14").
 
This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Config as follows:

resource "aws_lambda_function" "download" {
  filename = data.archive_file.lambda_source.output_path
  source_code_hash = data.archive_file.lambda_source.output_base64sha256
  function_name = "download"
  handler = "functions.download_event_handler"
  role = "..."
  runtime = "python3.8"
  layers = [aws_lambda_layer_version.dependencies.arn]
  timeout = 5 * 60
  memory_size = 1024
  publish = true
  vpc_config {
    security_group_ids = [
      "..."
    ]
    subnet_ids = [
      "...",
      "..."
    ]
  }
}

resource "aws_lambda_function" "extract" {
  filename = data.archive_file.lambda_source.output_path
  source_code_hash = data.archive_file.lambda_source.output_base64sha256
  function_name = "extract"
  handler = "functions.extract_event_handler"
  role = "..."
  runtime = "python3.8"
  layers = [aws_lambda_layer_version.dependencies.arn]
  timeout = 5 * 60
  memory_size = 1024
  publish = true
  vpc_config {
    security_group_ids = [
      "..."
    ]
    subnet_ids = [
      "...",
      "..."
    ]
  }
}

resource "aws_lambda_provisioned_concurrency_config" "download" {
  function_name = aws_lambda_function.download.function_name
  provisioned_concurrent_executions = 1
  qualifier = aws_lambda_function.download.version
}

resource "aws_lambda_provisioned_concurrency_config" "extract" {
  function_name = aws_lambda_function.extract.function_name
  provisioned_concurrent_executions = 1
  qualifier = aws_lambda_function.extract.version
}

[terlar]

I have seen this as well, but for the aws_lambda_alias resource, which is using a lambda function resource in the same way as the aws_lambda_provisioned_concurrency_config is doing.

Error: Provider produced inconsistent final plan

When expanding the plan for aws_lambda_alias.rest_lambda to include new values
learned so far during apply, provider "registry.terraform.io/-/aws" produced
an invalid new value for .function_version: was cty.StringVal("6"), but now
cty.StringVal("7").
This is a bug in the provider, which should be reported in the provider's own
issue tracker.

Could it be a race-condition with the lambda creation and the resources depending on them?

[TomH-TRT]

Any work around guys?

[terlar]

Nope, it fails daily for me, my "workaround" is just keep trying and eventually it will work. Usually the second time, but sometimes the 3rd of 4th

[giom-l]

Same here but with aws_lambda_layer_version

Error: Provider produced inconsistent final plan

When expanding the plan for aws_lambda_layer_version.flows_checker to include
new values learned so far during apply, provider
"registry.terraform.io/hashicorp/aws" produced an invalid new value for
.source_code_hash: was
cty.StringVal("R7yhLmrzuB1/KsL1oMNbt3G+BaGuD9RZaH2T3TJ5doI="), but now
cty.StringVal("0W2MJeRin7GFDAzyj9De38nHQkZZH2Cwf8djXFIL3mM=").

A second apply did work.

Using terraform 0.13.4 and aws provider 3.10.0

[dmitrijslotko]

Same here but with aws_lambda_layer_version

Error: Provider produced inconsistent final plan

When expanding the plan for aws_lambda_layer_version.flows_checker to include
new values learned so far during apply, provider
"registry.terraform.io/hashicorp/aws" produced an invalid new value for
.source_code_hash: was
cty.StringVal("R7yhLmrzuB1/KsL1oMNbt3G+BaGuD9RZaH2T3TJ5doI="), but now
cty.StringVal("0W2MJeRin7GFDAzyj9De38nHQkZZH2Cwf8djXFIL3mM=").

A second apply did work.

Using terraform 0.13.4 and aws provider 3.10.0

I have the same when I change something in the layer. Usually the second works but still annoying.