terraform-provider-aws: resource/aws_lambda_function - possible regression w/3.17.0 on us-east-2

I found this while debugging an issue and found that I also needed to grant lambda:GetFunctionCodeSigningConfig

I’m getting the same error in ap-northeast-3 and we are not trying to enable code signing at all. This code used to work fine, so something about introducing Lambda code signing into the AWS Provider has broken Lambda functions in general in ap-northeast-3, whether or not you are trying to use the code signing functionality.

This is a problem preventing the deployment of lambdas to ap-northeast-3 entirely. The most trivial example fails with the issue described, even will full admin permissions because the code signing service (AWS Signer) does not exist in ap-northeast-3. It is not a matter of permissions it is a matter of the service not existing in this region.

Try the following with the latest aws provider:

resource "aws_iam_role" "iam_for_lambda" {
  name = "role-for-ap-northeast-3"
  assume_role_policy = ""
}

resource "aws_lambda_function" "test_lambda" {
  filename      = "lambda_function_payload.zip"
  function_name = "test_function"
  role          = aws_iam_role.iam_for_lambda.arn
  handler       = "handler.lambda_handler"

  runtime = "python3.8"
}

provider "aws" {
  region ="ap-northeast-3"
}

results in:

$ terraform apply
aws_lambda_function.test_lambda: Refreshing state... [id=lambda_function_name]
╷
│ Error: error getting Lambda Function (lambda_function_name) code signing config AccessDeniedException: 
│       status code: 403, request id: 9c6cf779-8ce2-49bd-8ab3-e97e8fa5dd0f
│ 
│   with aws_lambda_function.test_lambda,
│   on main.tf line 6, in resource "aws_lambda_function" "test_lambda":
│    6: resource "aws_lambda_function" "test_lambda" {
│ 

This is not a small unusual region either anymore as Osaka ap-northeast-3 went GA on 2021-03-1 https://aws.amazon.com/blogs/aws/aws-asia-pacific-osaka-region-now-open-to-all-with-three-azs-more-services/

@kyleckf Yes, lambda:GetCodeSigningConfig is a required permission. If I attach an IAM policy like

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "lambda:GetCodeSigningConfig",
            "Resource": "*"
        }
    ]
}

to my test account then I get

$ make testacc TEST=./aws/ TESTARGS='-run=TestAccAWSLambdaFunction_codeSigningConfig'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./aws -v -count 1 -parallel 20 -run=TestAccAWSLambdaFunction_codeSigningConfig -timeout 120m
=== RUN   TestAccAWSLambdaFunction_codeSigningConfig
=== PAUSE TestAccAWSLambdaFunction_codeSigningConfig
=== CONT  TestAccAWSLambdaFunction_codeSigningConfig
    resource_aws_lambda_function_test.go:194: Step 1/5 error: Error running apply: 2020/12/15 11:58:49 [DEBUG] Using modified User-Agent: Terraform/0.12.26 HashiCorp-terraform-exec/0.10.0
        
        Error: error reading Lambda code signing config (arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-0db84535440db24e0): AccessDeniedException: 
        	status code: 403, request id: 19c55ac6-51b3-43a0-bc84-b291c9595eec
        
        
        
        Error: error reading Lambda code signing config (arn:aws:lambda:us-west-2:123456789012:code-signing-config:csc-00bf60596266984f7): AccessDeniedException: 
        	status code: 403, request id: d731cb3d-8fc8-4996-8892-8cb69d264a78
        
        
--- FAIL: TestAccAWSLambdaFunction_codeSigningConfig (9.72s)
FAIL
FAIL	github.com/terraform-providers/terraform-provider-aws/aws	9.790s
FAIL
GNUmakefile:27: recipe for target 'testacc' failed
make: *** [testacc] Error 1

See the Roadmap for a research task on how we can better describe required IAM permissions.