KEH 2447 | Tagging to Image Digest

concourse/scripts/terraform_infra.sh

@@ -12,6 +12,7 @@ aws_secret_access_key=$(echo "$secrets" | jq -r .aws_secret_access_key)
 
 lambda_name=$(echo "$secrets" | jq -r .lambda_name)
 env_name=$(echo "$secrets" | jq -r .env_name)
+ecr_repository=$(echo "$secrets" | jq -r .ecr_repository)
 
 github_app_client_id=$(echo "$secrets" | jq -r .github_app_client_id)
 aws_secret_name=$(echo "$secrets" | jq -r .aws_secret_name)
@@ -50,7 +51,8 @@ terraform apply \
     -var "aws_secret_name=$aws_secret_name" \
     -var "github_org=$github_org" \
     -var "aws_bucket_name=${aws_bucket_name}" \
-    -var "lambda_version=${tag}" \
     -var "lambda_timeout=${lambda_timeout}" \
     -var "lambda_memory=${lambda_memory}" \
+    -var "ecr_repository=${ecr_repository}" \
+    -var "container_ver=${tag}" \
     -auto-approve

terraform/service/data.tf

@@ -1,5 +1,10 @@
 data "aws_ecr_repository" "profile_lambda_ecr_repo" {
-  name = local.lambda_repo
+  name = var.ecr_repository
+}
+
+data "aws_ecr_image" "lambda_image" {
+  repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
+  image_tag       = var.container_ver
 }
 
 # Get the ecs infrastructure outputs from the remote state data source

terraform/service/env/dev/example_tfvars.txt

@@ -11,4 +11,6 @@ lambda_timeout          = 900
 lambda_memory           = 512
 schedule                = "cron(0 6 ? * 2 *)"
 github_org              = "ONS-Innovation"
-github_app_client_id    = "123456789"
+github_app_client_id    = "123456789"
+ecr_repository          = "sdp-dev-address-book-lambda"
+container_ver           = "v1.0.0"

terraform/service/main.tf

@@ -27,7 +27,7 @@ resource "aws_security_group" "lambda_sg" {
 resource "aws_lambda_function" "lambda_function" {
   function_name = var.lambda_name
   timeout       = var.lambda_timeout
-  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}:${var.lambda_version}"
+  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}@${data.aws_ecr_image.lambda_image.image_digest}"
   package_type  = "Image"
   architectures = [var.lambda_arch]
   logging_config {
@@ -55,6 +55,8 @@ resource "aws_lambda_function" "lambda_function" {
       AWS_SECRET_NAME      = var.aws_secret_name
       AWS_ACCOUNT_NAME     = var.env_name
       S3_BUCKET_NAME       = local.bucket_name
+      IMAGE_DIGEST         = data.aws_ecr_image.lambda_image.image_digest
+      IMAGE_TAG            = var.container_ver
     }
   }
 }

terraform/service/outputs.tf

@@ -15,7 +15,7 @@ output "lambda_role" {
 
 output "repo_name" {
   description = "Name of the ECR repository"
-  value       = local.lambda_repo
+  value       = var.ecr_repository
 }
 
 output "rule_arn" {

terraform/service/variables.tf

@@ -36,18 +36,23 @@ variable "lambda_name" {
   default     = "lambda-function"
 }
 
-variable "lambda_version" {
-  description = "AWS Lambda Image Version"
-  type        = string
-  default     = "v0.0.1"
-}
-
 variable "lambda_arch" {
   description = "AWS Lambda Architecture"
   type        = string
   default     = "x86_64"
 }
 
+variable "ecr_repository" {
+  description = "Name of the ECR repository containing the Lambda image"
+  type        = string
+}
+
+variable "container_ver" {
+  description = "Container tag"
+  type        = string
+  default     = "v1.0.0"
+}
+
 variable "lambda_timeout" {
   description = "AWS Lambda Timeout Value in Seconds"
   type        = number
@@ -108,6 +113,5 @@ variable "business_owner_tag" {
 }
 
 locals {
-  lambda_repo = "${var.env_name}-${var.lambda_name}"
   bucket_name = "${var.env_name}-${var.aws_bucket_name}"
 }