feat: tagging to image digest

Author: co-opsw

concourse/scripts/terraform_infra.sh

@@ -12,6 +12,7 @@ aws_secret_access_key=$(echo "$secrets" | jq -r .aws_secret_access_key)
 
 lambda_name=$(echo "$secrets" | jq -r .lambda_name)
 env_name=$(echo "$secrets" | jq -r .env_name)
+ecr_repository=$(echo "$secrets" | jq -r .ecr_repository)
 
 github_app_client_id=$(echo "$secrets" | jq -r .github_app_client_id)
 aws_secret_name=$(echo "$secrets" | jq -r .aws_secret_name)
@@ -50,7 +51,7 @@ terraform apply \
     -var "aws_secret_name=$aws_secret_name" \
     -var "github_org=$github_org" \
     -var "aws_bucket_name=${aws_bucket_name}" \
-    -var "lambda_version=${tag}" \
     -var "lambda_timeout=${lambda_timeout}" \
     -var "lambda_memory=${lambda_memory}" \
+    -var "ecr_repository=${ecr_repository}" \
     -auto-approve

terraform/service/data.tf

@@ -2,6 +2,11 @@ data "aws_ecr_repository" "profile_lambda_ecr_repo" {
   name = local.lambda_repo
 }
 
+data "aws_ecr_image" "lambda_image" {
+  repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
+  image_tag       = var.container_ver
+}
+
 # Get the ecs infrastructure outputs from the remote state data source
 data "terraform_remote_state" "vpc" {
   backend = "s3"

terraform/service/env/dev/example_tfvars.txt

@@ -11,4 +11,6 @@ lambda_timeout          = 900
 lambda_memory           = 512
 schedule                = "cron(0 6 ? * 2 *)"
 github_org              = "ONS-Innovation"
-github_app_client_id    = "123456789"
+github_app_client_id    = "123456789"
+ecr_repository          = "sdp-dev-address-book-lambda"
+container_ver           = "v1.0.0"

terraform/service/main.tf

@@ -27,7 +27,7 @@ resource "aws_security_group" "lambda_sg" {
 resource "aws_lambda_function" "lambda_function" {
   function_name = var.lambda_name
   timeout       = var.lambda_timeout
-  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}:${var.lambda_version}"
+  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}@${data.aws_ecr_image.lambda_image.image_digest}"
   package_type  = "Image"
   architectures = [var.lambda_arch]
   logging_config {
@@ -55,6 +55,8 @@ resource "aws_lambda_function" "lambda_function" {
       AWS_SECRET_NAME      = var.aws_secret_name
       AWS_ACCOUNT_NAME     = var.env_name
       S3_BUCKET_NAME       = local.bucket_name
+      IMAGE_DIGEST         = data.aws_ecr_image.lambda_image.image_digest
+      IMAGE_TAG            = var.container_ver
     }
   }
 }
@@ -148,6 +150,12 @@ resource "aws_iam_role_policy_attachment" "eventbridge_policy" {
   policy_arn = aws_iam_policy.lambda_eventbridge_policy.arn
 }
 
+# Resolve the pushed image (must exist before terraform apply)
+data "aws_ecr_image" "lambda_image" {
+  repository_name = var.ecr_repository
+  image_tag       = var.container_ver
+}
+
 resource "aws_cloudwatch_log_group" "loggroup" {
   name              = "/aws/lambda/${aws_lambda_function.lambda_function.function_name}"
   retention_in_days = var.log_retention_days

terraform/service/variables.tf

@@ -36,18 +36,23 @@ variable "lambda_name" {
   default     = "lambda-function"
 }
 
-variable "lambda_version" {
-  description = "AWS Lambda Image Version"
-  type        = string
-  default     = "v0.0.1"
-}
-
 variable "lambda_arch" {
   description = "AWS Lambda Architecture"
   type        = string
   default     = "x86_64"
 }
 
+variable "ecr_repository" {
+  description = "Name of the ECR repository containing the Lambda image"
+  type        = string
+}
+
+variable "container_ver" {
+  description = "Container tag"
+  type        = string
+  default     = "v1.0.0"
+}
+
 variable "lambda_timeout" {
   description = "AWS Lambda Timeout Value in Seconds"
   type        = number