Deploy an AWS Lambda Function with Terraform

The resource

An AWS Lambda in Terraform is the aws_lambda_function resource. The minimum that actually applies:

resource "aws_lambda_function" "api" {
  function_name = "my-api"
  role          = aws_iam_role.lambda.arn   # an execution role
  filename      = "lambda.zip"              # the packaged code
  source_code_hash = filebase64sha256("lambda.zip")
  handler       = "lambda_function.lambda_handler"   # file.function
  runtime       = "python3.12"
}

The arguments that trip people up

• runtime is required - omit it and terraform apply errors before the function is created. Use a valid identifier like python3.12, nodejs20.x, go1.x.
• handler is file.function - for lambda_function.py with a lambda_handler function it's lambda_function.lambda_handler. A wrong handler deploys but fails at invoke time with "Unable to import module".
• source_code_hash - without it Terraform won't detect code changes, so re-deploys silently ship stale code. filebase64sha256() fixes that.
• role - Lambda needs an execution role ARN (even a minimal one with the basic logging policy).

Packaging the code

Terraform can zip the source for you so you don't commit a binary:

data "archive_file" "lambda" {
  type        = "zip"
  source_file = "lambda_function.py"
  output_path = "lambda.zip"
}

Then point filename and source_code_hash at data.archive_file.lambda.

Apply

terraform init
terraform apply -auto-approve

Read the error if it fails - Terraform names the missing/invalid argument directly (e.g. "argument runtime is required"). Fix that one line and re-apply.

Permissions, environment variables, and triggers

aws_lambda_function alone gives you a function that can run but can't do anything or be reached. Three things complete it:

• An execution role. The role argument points to an IAM role the function assumes. At minimum attach AWSLambdaBasicExecutionRole so it can write CloudWatch logs; add more for whatever services it calls (S3, DynamoDB).
• Environment variables. Pass config with an environment { variables = { ... } } block instead of hard-coding - the function reads them from os.environ.
• A trigger. A function with no invoker never runs. Wire one with aws_lambda_permission plus the source: an API Gateway route, an S3 notification, an SQS event source mapping, or an EventBridge schedule.

Common apply errors are a missing role, a handler that doesn't match file.function in your code, or a runtime AWS does not recognize. Fix them one at a time and re-run terraform apply.