Skip to content

fix: Explicitly define IAM permission dependencies before Lambda invocation - #616

Open
Hi6mu-Sa10 wants to merge 1 commit into
aws-ia:mainfrom
Hi6mu-Sa10:feature/fix-lambda-invokation-role-create-timing
Open

fix: Explicitly define IAM permission dependencies before Lambda invocation#616
Hi6mu-Sa10 wants to merge 1 commit into
aws-ia:mainfrom
Hi6mu-Sa10:feature/fix-lambda-invokation-role-create-timing

Conversation

@Hi6mu-Sa10

@Hi6mu-Sa10 Hi6mu-Sa10 commented Mar 25, 2026

Copy link
Copy Markdown

related issue: #614

Root Cause

  • data.aws_lambda_invocation.trigger_codebuild_job was being executed without waiting for IAM role and policy creation to complete
  • The Lambda function was being invoked before IAM resources were propagated across AWS
  • This issue becomes more pronounced when the Lambda function execution time is long

Changes Made

Modified File

  • terraform-aws-control_tower_account_factory/modules/aft-lambda-layer/lambda.tf

Change Details

Added the following dependencies to data.aws_lambda_invocation.trigger_codebuild_job:

depends_on = [
  aws_iam_role.codebuild_trigger_lambda_role,
  aws_iam_role_policy.codebuild_trigger_policy,
  aws_iam_role_policy_attachment.codebuild_trigger_VPC_access
]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant