Add support for lambda permission import

aws/resource_aws_lambda_permission.go

@@ -22,6 +22,9 @@ func resourceAwsLambdaPermission() *schema.Resource {
 		Create: resourceAwsLambdaPermissionCreate,
 		Read:   resourceAwsLambdaPermissionRead,
 		Delete: resourceAwsLambdaPermissionDelete,
+		Importer: &schema.ResourceImporter{
+			State: resourceAwsLambdaPermissionImport,
+		},
 
 		Schema: map[string]*schema.Schema{
 			"action": {
@@ -400,6 +403,41 @@ func getFunctionNameFromLambdaArn(arn string) (string, error) {
 	return matches[5], nil
 }
 
+func resourceAwsLambdaPermissionImport(d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	idParts := strings.Split(d.Id(), "/")
+	if len(idParts) != 2 || idParts[0] == "" || idParts[1] == "" {
+		return nil, fmt.Errorf("Unexpected format of ID (%q), expected FUNCTION_NAME/STATEMENT_ID", d.Id())
+	}
+
+	functionName := idParts[0]
+
+	input := &lambda.GetFunctionInput{FunctionName: &functionName}
+
+	var qualifier string
+	fnParts := strings.Split(functionName, ":")
+	if len(fnParts) == 2 {
+		functionName = fnParts[0]
+		qualifier = fnParts[1]
+		input.Qualifier = &qualifier
+	}
+	statement := idParts[1]
+	log.Printf("[DEBUG] Importing Lambda Permission %s for function name %s", statement, functionName)
+
+	conn := meta.(*AWSClient).lambdaconn
+	getFunctionOutput, err := conn.GetFunction(input)
+	if err != nil {
+		return nil, err
+	}
+
+	d.Set("function_name", getFunctionOutput.Configuration.FunctionArn)
+	d.Set("statement_id", statement)
+	if qualifier != "" {
+		d.Set("qualifier", qualifier)
+	}
+	d.SetId(statement)
+	return []*schema.ResourceData{d}, nil
+}
+
 type LambdaPolicy struct {
 	Version   string
 	Statement []LambdaPolicyStatement

aws/resource_aws_lambda_permission_test.go

@@ -188,6 +188,12 @@ func TestAccAWSLambdaPermission_basic(t *testing.T) {
 					resource.TestCheckResourceAttr("aws_lambda_permission.allow_cloudwatch", "event_source_token", "test-event-source-token"),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.allow_cloudwatch",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.allow_cloudwatch"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -231,12 +237,19 @@ func TestAccAWSLambdaPermission_withRawFunctionName(t *testing.T) {
 					resource.TestMatchResourceAttr("aws_lambda_permission.with_raw_func_name", "function_name", funcArnRe),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.with_raw_func_name",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.with_raw_func_name"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
 func TestAccAWSLambdaPermission_withStatementIdPrefix(t *testing.T) {
 	var statement LambdaPolicyStatement
+
 	rName := acctest.RandomWithPrefix("tf-acc-test")
 	endsWithFuncName := regexp.MustCompile(":function:lambda_function_name_perm$")
 	startsWithPrefix := regexp.MustCompile("^AllowExecutionWithStatementIdPrefix-")
@@ -256,6 +269,13 @@ func TestAccAWSLambdaPermission_withStatementIdPrefix(t *testing.T) {
 					resource.TestMatchResourceAttr("aws_lambda_permission.with_statement_id_prefix", "function_name", endsWithFuncName),
 				),
 			},
+			{
+				ResourceName:            "aws_lambda_permission.with_statement_id_prefix",
+				ImportState:             true,
+				ImportStateIdFunc:       testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.with_statement_id_prefix"),
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"statement_id_prefix"},
+			},
 		},
 	})
 }
@@ -285,6 +305,12 @@ func TestAccAWSLambdaPermission_withQualifier(t *testing.T) {
 					resource.TestCheckResourceAttr("aws_lambda_permission.with_qualifier", "qualifier", aliasName),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.with_qualifier",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.with_qualifier"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -346,6 +372,18 @@ func TestAccAWSLambdaPermission_multiplePerms(t *testing.T) {
 					resource.TestMatchResourceAttr("aws_lambda_permission.third", "function_name", funcArnRe),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.first",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.first"),
+				ImportStateVerify: true,
+			},
+			{
+				ResourceName:      "aws_lambda_permission.sec0nd",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.sec0nd"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -376,6 +414,12 @@ func TestAccAWSLambdaPermission_withS3(t *testing.T) {
 						fmt.Sprintf("arn:aws:s3:::%s", bucketName)),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.with_s3",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.with_s3"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -407,6 +451,12 @@ func TestAccAWSLambdaPermission_withSNS(t *testing.T) {
 					resource.TestMatchResourceAttr("aws_lambda_permission.with_sns", "source_arn", topicArnRe),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.with_sns",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.with_sns"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -435,6 +485,12 @@ func TestAccAWSLambdaPermission_withIAMRole(t *testing.T) {
 					resource.TestMatchResourceAttr("aws_lambda_permission.iam_role", "function_name", funcArnRe),
 				),
 			},
+			{
+				ResourceName:      "aws_lambda_permission.iam_role",
+				ImportState:       true,
+				ImportStateIdFunc: testAccAWSCLambdaPermissionImportStateIdFunc("aws_lambda_permission.iam_role"),
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
@@ -568,6 +624,20 @@ func lambdaPermissionExists(rs *terraform.ResourceState, conn *lambda.Lambda) (*
 	return findLambdaPolicyStatementById(&policy, rs.Primary.ID)
 }
 
+func testAccAWSCLambdaPermissionImportStateIdFunc(resourceName string) resource.ImportStateIdFunc {
+	return func(s *terraform.State) (string, error) {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return "", fmt.Errorf("Not found: %s", resourceName)
+		}
+
+		if v, ok := rs.Primary.Attributes["qualifier"]; ok && v != "" {
+			return fmt.Sprintf("%s:%s/%s", rs.Primary.Attributes["function_name"], *aws.String(v), rs.Primary.Attributes["statement_id"]), nil
+		}
+		return fmt.Sprintf("%s/%s", rs.Primary.Attributes["function_name"], rs.Primary.Attributes["statement_id"]), nil
+	}
+}
+
 func testAccAWSLambdaPermissionConfig(funcName, roleName string) string {
 	return fmt.Sprintf(`
 resource "aws_lambda_permission" "allow_cloudwatch" {

website/docs/r/lambda_permission.html.markdown

@@ -151,3 +151,11 @@ resource "aws_lambda_permission" "lambda_permission" {
  * `statement_id_prefix` - (Optional) A statement identifier prefix. Terraform will generate a unique suffix. Conflicts with `statement_id`.
 
 [1]: https://developer.amazon.com/docs/custom-skills/host-a-custom-skill-as-an-aws-lambda-function.html#use-aws-cli
+
+## Import
+
+Lambda permission statements can be imported using the function_name/statement_id, e.g.
+
+```
+$ terraform import aws_lambda_function_permission.test_lambda_permission my_test_lambda_function/AllowExecutionFromCloudWatch
+```