Skip to content

fix(terraform): rebuild every Lambda that bundles lambda/shared - #604

Merged
JWThewes merged 1 commit into
aws-samples:mainfrom
thenom:fix/lambda-shared-sources-hash
Oct 26, 2026
Merged

JWThewes merged 1 commit into
aws-samples:mainfrom
thenom:fix/lambda-shared-sources-hash

Conversation

@thenom

@thenom thenom commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Issue #, if available: None

Description of changes:

Problem

The Lambda module names each package after a hash of the Lambda's own source_path. Most esbuild-bundled Lambdas also set hash_extra = local.shared_sources_hash, so a change under lambda/shared/ rebuilds them. Nine don't:

  • modules/api/lambda/main.tf: sprints, tasks, questions, sprint-graph, timeline-events, migrate-tracker-fields, building-blocks and seed-blocks
  • modules/realtime/lambda.tf: ws-connection

When a change touches only lambda/shared/, their package filename stays the same, so the plan keeps the deployed source_code_hash. The apply then fails with Provider produced inconsistent final plan once the rebuilt zip turns out to differ.

Solution

  • Add hash_extra = local.shared_sources_hash to those nine modules.
  • Add the same shared_sources_hash local to the realtime module, mirroring modules/api/lambda.

Testing

  • terraform fmt -check, terraform validate -no-tests and every terraform test suite from the Terraform workflow pass on Terraform 1.15.0, including lambda-packaging.tftest.hcl (7 passed). The SSO plan-privacy test also passes.
  • These changes already run as a patch in our own deployment.

Impact

The first apply after merging rebuilds and redeploys those nine Lambdas once, because their package names change. After that, they redeploy only when their own code or lambda/shared/ changes.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Nine esbuild-bundled Lambdas lacked hash_extra = local.shared_sources_hash:
sprints, tasks, questions, sprint-graph, timeline-events,
migrate-tracker-fields, building-blocks, seed-blocks and ws-connection. A
change only under lambda/shared/ left their package name unchanged, so the
plan kept the deployed source_code_hash and the apply failed with
"Provider produced inconsistent final plan" once the rebuilt zip differed.
Add the hash to those modules, and the same local to the realtime module.
@JWThewes

Copy link
Copy Markdown
Contributor

@thenom is there any reason all of the PRs you created are in draft? Just checking if I should start reviewing already. Thanks for contributing to this project!

@thenom

thenom commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor Author

Hey @JWThewes, yeh thanks, i am just getting a couple of additional internal reviews before removing the draft markers.

Its just a load of patches we were applying locally but it ran away with us so just trying to submit them all back 😄

If your happy with any of them, by all means let me know and i will remove the marker 👍

@thenom
thenom marked this pull request as ready for review October 23, 2026 10:45

@JWThewes JWThewes left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for contributing

@JWThewes
JWThewes merged commit 94daccc into aws-samples:main Oct 26, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants