Lambda function needed to be manually tainted to adopt changes

[ghost]

This issue was originally opened by @RobWalker as hashicorp/terraform#19599. It was migrated here as a result of the provider split. The original body of the issue is below.

---

Terraform Version

Terraform v0.11.10
+ provider.aws v1.45.0
+ provider.null v1.0.0

I was trying to configure a lambda@edge function on a cloudfront distribution:

Terraform Configuration Files

resource "aws_cloudfront_distribution" "guide" {
  origin {
    lambda_function_association {
      event_type = "origin-request"
      lambda_arn = "${aws_lambda_function.s3redirect_guide.arn}:${aws_lambda_function.s3redirect_guide.version}"
    }    
...

Actual Behavior

Initially I had specified the aws_lambda_function.s3redirect_guide function without the publish flag, which did not create a published version, so cloudfront rejected the distribution. All good.

Adding

resource "aws_lambda_function" "s3redirect_guide" {
...
publish: true
}

and rerunning terraform apply had no effect, terraform did not mark the lambda as needing to be recreated.

Manually tainting the resource worked.

Cloudfront then complained that the lambda had an environment variable defined which was not allowed for edge functions.

I removed the block:

  environment {
    variables = {
      ENV             = "${var.env}"
    }
  }

rerunning terraform apply identified the change to the environment and applied it, but not in a way that cloudfront would accept: produced the same error.

Again manually tainting the resource worked and the edge function was acccepted.

Expected Behavior

The lambda resource show have been recreated automatically based on the configuration changes without the need to manually taint

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.