Merge pull request #37646 from hashicorp/b-lambda_layer_version_hash

r/lambda_layer_version: fix `ForceNew` issue with `source_code_hash` attribute

.changelog/37646.txt

@@ -0,0 +1,15 @@
+```release-note:bug
+resource/aws_lambda_layer_version: Fix issue when `source_code_hash` forces a replacement even if source code has not changed
+```
+
+```release-note:enhancement
+resource/aws_lambda_layer_version: Add `code_sha256` attribute
+```
+
+```release-note:enhancement
+data-source/aws_lambda_layer_version: Add `code_sha256` attribute
+```
+
+```release-note:note
+data-source/aws_lambda_layer_version: `source_code_hash` attribute has been deprecated in favor of `code_sha256`. Will be removed a future major version
+```

internal/service/lambda/layer_version.go

@@ -45,6 +45,10 @@ func resourceLayerVersion() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"code_sha256": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"compatible_architectures": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -234,6 +238,7 @@ func resourceLayerVersionRead(ctx context.Context, d *schema.ResourceData, meta
 	}
 
 	d.Set(names.AttrARN, output.LayerVersionArn)
+	d.Set("code_sha256", output.Content.CodeSha256)
 	d.Set("compatible_architectures", output.CompatibleArchitectures)
 	d.Set("compatible_runtimes", output.CompatibleRuntimes)
 	d.Set(names.AttrCreatedDate, output.CreatedDate)
@@ -243,7 +248,7 @@ func resourceLayerVersionRead(ctx context.Context, d *schema.ResourceData, meta
 	d.Set("license_info", output.LicenseInfo)
 	d.Set("signing_job_arn", output.Content.SigningJobArn)
 	d.Set("signing_profile_version_arn", output.Content.SigningProfileVersionArn)
-	d.Set("source_code_hash", output.Content.CodeSha256)
+	d.Set("source_code_hash", d.Get("source_code_hash"))
 	d.Set("source_code_size", output.Content.CodeSize)
 	d.Set(names.AttrVersion, strconv.FormatInt(versionNumber, 10))
 

internal/service/lambda/layer_version_data_source.go

@@ -28,6 +28,10 @@ func dataSourceLayerVersion() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+			"code_sha256": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 			"compatible_architecture": {
 				Type:             schema.TypeString,
 				Optional:         true,
@@ -83,8 +87,9 @@ func dataSourceLayerVersion() *schema.Resource {
 				Computed: true,
 			},
 			"source_code_hash": {
-				Type:     schema.TypeString,
-				Computed: true,
+				Type:       schema.TypeString,
+				Computed:   true,
+				Deprecated: "This attribute is deprecated and will be removed in a future major version. Use `code_sha256` instead.",
 			},
 			"source_code_size": {
 				Type:     schema.TypeInt,
@@ -142,6 +147,7 @@ func dataSourceLayerVersionRead(ctx context.Context, d *schema.ResourceData, met
 
 	d.SetId(aws.ToString(output.LayerVersionArn))
 	d.Set(names.AttrARN, output.LayerVersionArn)
+	d.Set("code_sha256", output.Content.CodeSha256)
 	d.Set("compatible_architectures", output.CompatibleArchitectures)
 	d.Set("compatible_runtimes", output.CompatibleRuntimes)
 	d.Set(names.AttrCreatedDate, output.CreatedDate)

internal/service/lambda/layer_version_data_source_test.go

@@ -35,7 +35,8 @@ func TestAccLambdaLayerVersionDataSource_basic(t *testing.T) {
 					resource.TestCheckResourceAttrPair(dataSourceName, names.AttrARN, resourceName, names.AttrARN),
 					resource.TestCheckResourceAttrPair(dataSourceName, "layer_arn", resourceName, "layer_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, names.AttrCreatedDate, resourceName, names.AttrCreatedDate),
-					resource.TestCheckResourceAttrPair(dataSourceName, "source_code_hash", resourceName, "source_code_hash"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "code_sha256", resourceName, "code_sha256"),
+					resource.TestCheckResourceAttrPair(dataSourceName, "source_code_hash", resourceName, "code_sha256"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "source_code_size", resourceName, "source_code_size"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "signing_profile_version_arn", resourceName, "signing_profile_version_arn"),
 					resource.TestCheckResourceAttrPair(dataSourceName, "signing_job_arn", resourceName, "signing_job_arn"),

website/docs/d/lambda_layer_version.html.markdown

@@ -35,6 +35,7 @@ This data source supports the following arguments:
 
 This data source exports the following attributes in addition to the arguments above:
 
+* `code_sha256` - Base64-encoded representation of raw SHA-256 sum of the zip file.
 * `description` - Description of the specific Lambda Layer version.
 * `license_info` - License info associated with the specific Lambda Layer version.
 * `compatible_runtimes` - List of [Runtimes][1] the specific Lambda Layer version is compatible with.
@@ -44,9 +45,9 @@ This data source exports the following attributes in addition to the arguments a
 * `created_date` - Date this resource was created.
 * `signing_job_arn` - ARN of a signing job.
 * `signing_profile_version_arn` - The ARN for a signing profile version.
-* `source_code_hash` - Base64-encoded representation of raw SHA-256 sum of the zip file.
+* `source_code_hash` - (**Deprecated** use `code_sha256` instead) Base64-encoded representation of raw SHA-256 sum of the zip file.
 * `source_code_size` - Size in bytes of the function .zip file.
-* `version` - This Lamba Layer version.
+* `version` - This Lambda Layer version.
 
 [1]: https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html#SSS-GetLayerVersion-response-CompatibleRuntimes
 [2]: https://docs.aws.amazon.com/lambda/latest/dg/API_GetLayerVersion.html#SSS-GetLayerVersion-response-CompatibleArchitectures

website/docs/r/lambda_layer_version.html.markdown

@@ -53,13 +53,14 @@ The following arguments are optional:
 * `s3_key` - (Optional) S3 key of an object containing the function's deployment package. Conflicts with `filename`.
 * `s3_object_version` - (Optional) Object version containing the function's deployment package. Conflicts with `filename`.
 * `skip_destroy` - (Optional) Whether to retain the old version of a previously deployed Lambda Layer. Default is `false`. When this is not set to `true`, changing any of `compatible_architectures`, `compatible_runtimes`, `description`, `filename`, `layer_name`, `license_info`, `s3_bucket`, `s3_key`, `s3_object_version`, or `source_code_hash` forces deletion of the existing layer version and creation of a new layer version.
-* `source_code_hash` - (Optional) Used to trigger updates. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3_key`. The usual way to set this is `${filebase64sha256("file.zip")}` (Terraform 0.11.12 or later) or `${base64sha256(file("file.zip"))}` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda layer source archive.
+* `source_code_hash` - (Optional) Virtual attribute used to trigger replacement when source code changes. Must be set to a base64-encoded SHA256 hash of the package file specified with either `filename` or `s3_key`. The usual way to set this is `${filebase64sha256("file.zip")}` (Terraform 0.11.12 or later) or `${base64sha256(file("file.zip"))}` (Terraform 0.11.11 and earlier), where "file.zip" is the local filename of the lambda layer source archive.
 
 ## Attribute Reference
 
 This resource exports the following attributes in addition to the arguments above:
 
 * `arn` - ARN of the Lambda Layer with version.
+* `code_sha256` - Base64-encoded representation of raw SHA-256 sum of the zip file.
 * `created_date` - Date this resource was created.
 * `layer_arn` - ARN of the Lambda Layer without version.
 * `signing_job_arn` - ARN of a signing job.