InvalidParameterValueException: We currently do not support adding policies for $LATEST.

[agconti]

The problem

I'm running into an error while following trying to attach IAM policies to my lambda function. I've modeled my terraform off the complete example in the docs. The result is that they're really similar so I'm not sure how I'm running into this issue. I also see that you've handled this issue before this the source.

Error:

Error: Error adding new Lambda Permission for sign-up: InvalidParameterValueException: We currently do not support adding policies for $LATEST.
{
  RespMetadata: {
    StatusCode: 400,
    RequestID: "ed82baaf-7fb8-4291-b2af-b8796d7bbea4"
  },
  Message_: "We currently do not support adding policies for $LATEST.",
  Type: "User"
}

  on .terraform/modules/lambda_function/terraform-aws-lambda-1.15.0/main.tf line 161, in resource "aws_lambda_permission" "current_version_triggers":
 161: resource "aws_lambda_permission" "current_version_triggers" {

Terraform

locals {
  table_name = "test"
}

module "lambda_function" {
  source = "terraform-aws-modules/lambda/aws"

  function_name = "sign-up"
  description   = "Allows users to sign up"
  handler       = "index.handler"
  runtime       = "nodejs12.x"
  publish       = true

  source_path = "../../index.js"
  environment_variables = {
    TABLE_NAME = local.table_name
  }

  allowed_triggers = {
    AllowExecutionFromAPIGateway = {
      service = "apigateway"
      arn     = aws_api_gateway_rest_api.sign_up.arn
    }
  }

  attach_policy_statements = true
  policy_statements = {
    dynamodb = {
      effect    = "Allow",
      actions   = ["dynamodb:PutItem"],
      resources = [module.dynamodb_table.this_dynamodb_table_arn]
    }
  }
}

resource "aws_api_gateway_rest_api" "sign_up" {
  name        = "Test rest API gateway"
  description   = "Test"

  endpoint_configuration {
    types = ["REGIONAL"]
  }
}

module "dynamodb_table" {
  source   = "terraform-aws-modules/dynamodb-table/aws"

  name     = local.table_name
  hash_key = "created"

  attributes = [
    {
      name = "created"
      type = "S"
    },
  ]
}

index.js:

exports.handler =  async function(event, context) {
  console.log("EVENT: \n" + JSON.stringify(event, null, 2))
  return context.logStreamName
}

Steps to reproduce

1. Copy terraform and index.js to testing directory
2. terraform init
3. terraform plan
4. See error.

Please let me know if I can give you more information. Thanks for taking a look!

[antonbabenko]

Hi @agconti !

Thanks for opening this issue. I forgot to describe this case in the README, but I will do this soon.

Here is the solution:
When the Lambda function is created with publish = true the new version is automatically increased and a qualified identifier (version number) created and used when setting Lambda permissions.

When publish = false (default), only unqualified identifier ($LATEST) is available which leads to the error - "We currently do not support adding policies for $LATEST."

The solution is to either disable the creation of allowed triggers for the current version:

create_current_version_allowed_triggers = false

or to enable publish of Lambda function (publish = true).

[antonbabenko]

Fixed in dccacab

[agconti]

Hey @antonbabenko, this worked for me. Thanks for your help!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.