From 84f226ee67629c1aa73facd7e9db60c2c2f684d2 Mon Sep 17 00:00:00 2001
From: Cooper Wright <cooper.wright@ons.gov.uk>
Date: Fri, 3 Jul 2026 15:34:11 +0100
Subject: [PATCH 1/5] feat: tagging to image digest

---
 concourse/scripts/terraform_infra.sh         |  3 ++-
 terraform/service/data.tf                    |  5 +++++
 terraform/service/env/dev/example_tfvars.txt |  4 +++-
 terraform/service/main.tf                    | 10 +++++++++-
 terraform/service/variables.tf               | 17 +++++++++++------
 5 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index e55c482..67e58b4 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -12,6 +12,7 @@ aws_secret_access_key=$(echo "$secrets" | jq -r .aws_secret_access_key)
 
 lambda_name=$(echo "$secrets" | jq -r .lambda_name)
 env_name=$(echo "$secrets" | jq -r .env_name)
+ecr_repository=$(echo "$secrets" | jq -r .ecr_repository)
 
 github_app_client_id=$(echo "$secrets" | jq -r .github_app_client_id)
 aws_secret_name=$(echo "$secrets" | jq -r .aws_secret_name)
@@ -50,7 +51,7 @@ terraform apply \
     -var "aws_secret_name=$aws_secret_name" \
     -var "github_org=$github_org" \
     -var "aws_bucket_name=${aws_bucket_name}" \
-    -var "lambda_version=${tag}" \
     -var "lambda_timeout=${lambda_timeout}" \
     -var "lambda_memory=${lambda_memory}" \
+    -var "ecr_repository=${ecr_repository}" \
     -auto-approve
diff --git a/terraform/service/data.tf b/terraform/service/data.tf
index 48ff7ae..73d203b 100644
--- a/terraform/service/data.tf
+++ b/terraform/service/data.tf
@@ -2,6 +2,11 @@ data "aws_ecr_repository" "profile_lambda_ecr_repo" {
   name = local.lambda_repo
 }
 
+data "aws_ecr_image" "lambda_image" {
+  repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
+  image_tag       = var.container_ver
+}
+
 # Get the ecs infrastructure outputs from the remote state data source
 data "terraform_remote_state" "vpc" {
   backend = "s3"
diff --git a/terraform/service/env/dev/example_tfvars.txt b/terraform/service/env/dev/example_tfvars.txt
index dc4b7a0..d9362bb 100644
--- a/terraform/service/env/dev/example_tfvars.txt
+++ b/terraform/service/env/dev/example_tfvars.txt
@@ -11,4 +11,6 @@ lambda_timeout          = 900
 lambda_memory           = 512
 schedule                = "cron(0 6 ? * 2 *)"
 github_org              = "ONS-Innovation"
-github_app_client_id    = "123456789"
\ No newline at end of file
+github_app_client_id    = "123456789"
+ecr_repository          = "sdp-dev-address-book-lambda"
+container_ver           = "v1.0.0"
\ No newline at end of file
diff --git a/terraform/service/main.tf b/terraform/service/main.tf
index f43df53..60c37b8 100644
--- a/terraform/service/main.tf
+++ b/terraform/service/main.tf
@@ -27,7 +27,7 @@ resource "aws_security_group" "lambda_sg" {
 resource "aws_lambda_function" "lambda_function" {
   function_name = var.lambda_name
   timeout       = var.lambda_timeout
-  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}:${var.lambda_version}"
+  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}@${data.aws_ecr_image.lambda_image.image_digest}"
   package_type  = "Image"
   architectures = [var.lambda_arch]
   logging_config {
@@ -55,6 +55,8 @@ resource "aws_lambda_function" "lambda_function" {
       AWS_SECRET_NAME      = var.aws_secret_name
       AWS_ACCOUNT_NAME     = var.env_name
       S3_BUCKET_NAME       = local.bucket_name
+      IMAGE_DIGEST         = data.aws_ecr_image.lambda_image.image_digest
+      IMAGE_TAG            = var.container_ver
     }
   }
 }
@@ -148,6 +150,12 @@ resource "aws_iam_role_policy_attachment" "eventbridge_policy" {
   policy_arn = aws_iam_policy.lambda_eventbridge_policy.arn
 }
 
+# Resolve the pushed image (must exist before terraform apply)
+data "aws_ecr_image" "lambda_image" {
+  repository_name = var.ecr_repository
+  image_tag       = var.container_ver
+}
+
 resource "aws_cloudwatch_log_group" "loggroup" {
   name              = "/aws/lambda/${aws_lambda_function.lambda_function.function_name}"
   retention_in_days = var.log_retention_days
diff --git a/terraform/service/variables.tf b/terraform/service/variables.tf
index 2c181b9..efde037 100644
--- a/terraform/service/variables.tf
+++ b/terraform/service/variables.tf
@@ -36,18 +36,23 @@ variable "lambda_name" {
   default     = "lambda-function"
 }
 
-variable "lambda_version" {
-  description = "AWS Lambda Image Version"
-  type        = string
-  default     = "v0.0.1"
-}
-
 variable "lambda_arch" {
   description = "AWS Lambda Architecture"
   type        = string
   default     = "x86_64"
 }
 
+variable "ecr_repository" {
+  description = "Name of the ECR repository containing the Lambda image"
+  type        = string
+}
+
+variable "container_ver" {
+  description = "Container tag"
+  type        = string
+  default     = "v1.0.0"
+}
+
 variable "lambda_timeout" {
   description = "AWS Lambda Timeout Value in Seconds"
   type        = number

From 49ce2fecfd1ed02a12cdeb966910d08e9eeb2a6e Mon Sep 17 00:00:00 2001
From: Cooper Wright <cooper.wright@ons.gov.uk>
Date: Fri, 3 Jul 2026 15:53:04 +0100
Subject: [PATCH 2/5] fix: removed duplicate ecr_image

---
 terraform/service/data.tf | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/terraform/service/data.tf b/terraform/service/data.tf
index 73d203b..48ff7ae 100644
--- a/terraform/service/data.tf
+++ b/terraform/service/data.tf
@@ -2,11 +2,6 @@ data "aws_ecr_repository" "profile_lambda_ecr_repo" {
   name = local.lambda_repo
 }
 
-data "aws_ecr_image" "lambda_image" {
-  repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
-  image_tag       = var.container_ver
-}
-
 # Get the ecs infrastructure outputs from the remote state data source
 data "terraform_remote_state" "vpc" {
   backend = "s3"

From 0083ebec2e9171555f63ba5c391054185c9802cf Mon Sep 17 00:00:00 2001
From: Cooper Wright <cooper.wright@ons.gov.uk>
Date: Fri, 3 Jul 2026 15:59:55 +0100
Subject: [PATCH 3/5] fix: ...

---
 terraform/service/data.tf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/terraform/service/data.tf b/terraform/service/data.tf
index 48ff7ae..73d203b 100644
--- a/terraform/service/data.tf
+++ b/terraform/service/data.tf
@@ -2,6 +2,11 @@ data "aws_ecr_repository" "profile_lambda_ecr_repo" {
   name = local.lambda_repo
 }
 
+data "aws_ecr_image" "lambda_image" {
+  repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
+  image_tag       = var.container_ver
+}
+
 # Get the ecs infrastructure outputs from the remote state data source
 data "terraform_remote_state" "vpc" {
   backend = "s3"

From 08d89e7b28a2647cd1dfbdfce203c64511b2189e Mon Sep 17 00:00:00 2001
From: Cooper Wright <cooper.wright@ons.gov.uk>
Date: Fri, 3 Jul 2026 16:08:58 +0100
Subject: [PATCH 4/5] fix: removed correct duplicate ecr_image

---
 terraform/service/main.tf | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/terraform/service/main.tf b/terraform/service/main.tf
index 60c37b8..9c9039e 100644
--- a/terraform/service/main.tf
+++ b/terraform/service/main.tf
@@ -150,12 +150,6 @@ resource "aws_iam_role_policy_attachment" "eventbridge_policy" {
   policy_arn = aws_iam_policy.lambda_eventbridge_policy.arn
 }
 
-# Resolve the pushed image (must exist before terraform apply)
-data "aws_ecr_image" "lambda_image" {
-  repository_name = var.ecr_repository
-  image_tag       = var.container_ver
-}
-
 resource "aws_cloudwatch_log_group" "loggroup" {
   name              = "/aws/lambda/${aws_lambda_function.lambda_function.function_name}"
   retention_in_days = var.log_retention_days

From a3217672d0095695ac912fb0a7dd20de6d6a598d Mon Sep 17 00:00:00 2001
From: Cooper Wright <cooper.wright@ons.gov.uk>
Date: Mon, 6 Jul 2026 15:21:30 +0100
Subject: [PATCH 5/5] fix: configured ECR repository for Lambda image lookup

---
 concourse/scripts/terraform_infra.sh | 1 +
 terraform/service/data.tf            | 2 +-
 terraform/service/outputs.tf         | 2 +-
 terraform/service/variables.tf       | 1 -
 4 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/concourse/scripts/terraform_infra.sh b/concourse/scripts/terraform_infra.sh
index 67e58b4..150c48b 100644
--- a/concourse/scripts/terraform_infra.sh
+++ b/concourse/scripts/terraform_infra.sh
@@ -54,4 +54,5 @@ terraform apply \
     -var "lambda_timeout=${lambda_timeout}" \
     -var "lambda_memory=${lambda_memory}" \
     -var "ecr_repository=${ecr_repository}" \
+    -var "container_ver=${tag}" \
     -auto-approve
diff --git a/terraform/service/data.tf b/terraform/service/data.tf
index 73d203b..f1db894 100644
--- a/terraform/service/data.tf
+++ b/terraform/service/data.tf
@@ -1,5 +1,5 @@
 data "aws_ecr_repository" "profile_lambda_ecr_repo" {
-  name = local.lambda_repo
+  name = var.ecr_repository
 }
 
 data "aws_ecr_image" "lambda_image" {
diff --git a/terraform/service/outputs.tf b/terraform/service/outputs.tf
index fc81df5..c473d0d 100644
--- a/terraform/service/outputs.tf
+++ b/terraform/service/outputs.tf
@@ -15,7 +15,7 @@ output "lambda_role" {
 
 output "repo_name" {
   description = "Name of the ECR repository"
-  value       = local.lambda_repo
+  value       = var.ecr_repository
 }
 
 output "rule_arn" {
diff --git a/terraform/service/variables.tf b/terraform/service/variables.tf
index efde037..3f7b843 100644
--- a/terraform/service/variables.tf
+++ b/terraform/service/variables.tf
@@ -113,6 +113,5 @@ variable "business_owner_tag" {
 }
 
 locals {
-  lambda_repo = "${var.env_name}-${var.lambda_name}"
   bucket_name = "${var.env_name}-${var.aws_bucket_name}"
 }
\ No newline at end of file