KEH 2445 | Changing versioning from Tags to Image Digest

concourse/scripts/terraform_infra.sh

@@ -12,6 +12,7 @@ aws_secret_access_key=$(echo "$secrets" | jq -r .aws_secret_access_key)
 
 lambda_name=$(echo "$secrets" | jq -r .lambda_name)
 env_name=$(echo "$secrets" | jq -r .env_name)
+ecr_repository=$(echo "$secrets" | jq -r .ecr_repository)
 
 lambda_timeout=$(echo "$secrets" | jq -r .lambda_timeout)
 
@@ -46,6 +47,6 @@ terraform apply \
 	-var "github_app_client_id=$github_app_client_id" \
 	-var "aws_secret_name=$aws_secret_name" \
 	-var "github_org=$github_org" \
-	-var "lambda_version=${tag}" \
 	-var "lambda_timeout=${lambda_timeout}" \
+	-var "ecr_repository=${ecr_repository}" \
 	-auto-approve

terraform/data.tf

@@ -2,6 +2,11 @@ data "aws_ecr_repository" "profile_lambda_ecr_repo" {
   name = local.lambda_repo
 }
 
+data "aws_ecr_image" "lambda_image" {
+  repository_name = data.aws_ecr_repository.profile_lambda_ecr_repo.name
+  image_tag       = var.container_ver
+}
+
 # Get the ecs infrastructure outputs from the remote state data source
 data "terraform_remote_state" "vpc" {
   backend = "s3"

terraform/env/dev/example_tfvars.txt

@@ -5,9 +5,10 @@ aws_secret_access_key   = "AWSSECRETASSOCIATEDWITHACCESSKEY"
 aws_secret_name         = "sdp/pem"
 env_name                = "sdp-dev"
 lambda_name             = "copilot-usage-lambda"
-lambda_version          = "v0.0.1"
 lambda_arch             = "x86_64"
 lambda_timeout          = 300
 schedule                = "cron(0 6 ? * 2 *)"
 github_org              = "ONS-Innovation"
-github_app_client_id    = "123456789"
+github_app_client_id    = "123456789"
+ecr_repository          = "sdp-dev-address-book-lambda"
+container_ver           = "v1.0.0"

terraform/main.tf

@@ -27,7 +27,7 @@ resource "aws_security_group" "lambda_sg" {
 resource "aws_lambda_function" "lambda_function" {
   function_name = var.lambda_name
   timeout       = var.lambda_timeout
-  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}:${var.lambda_version}"
+  image_uri     = "${data.aws_ecr_repository.profile_lambda_ecr_repo.repository_url}@${data.aws_ecr_image.lambda_image.image_digest}"
   package_type  = "Image"
   architectures = [var.lambda_arch]
   logging_config {
@@ -55,6 +55,8 @@ resource "aws_lambda_function" "lambda_function" {
       GITHUB_APP_CLIENT_ID = var.github_app_client_id
       AWS_SECRET_NAME      = var.aws_secret_name
       AWS_ACCOUNT_NAME     = var.env_name
+      IMAGE_DIGEST         = data.aws_ecr_image.lambda_image.image_digest
+      IMAGE_TAG            = var.container_ver
     }
   }
 }

terraform/variables.tf

@@ -30,12 +30,6 @@ variable "lambda_name" {
   default     = "lambda-function"
 }
 
-variable "lambda_version" {
-  description = "AWS Lambda Image Version"
-  type        = string
-  default     = "v0.0.1"
-}
-
 variable "lambda_arch" {
   description = "AWS Lambda Architecture"
   type        = string
@@ -77,6 +71,17 @@ variable "region" {
   default     = "eu-west-2"
 }
 
+variable "ecr_repository" {
+  description = "Name of the ECR repository containing the Lambda image"
+  type        = string
+}
+
+variable "container_ver" {
+  description = "Container tag"
+  type        = string
+  default     = "v1.0.0"
+}
+
 variable "project_tag" {
   description = "Project"
   type        = string