terraform-provider-artifactory: Not able to use artifactory_file data source as the input to a lambda

Hi everyone,

Interestingly, I’ve landed on the same problem with a similar scenario where we have nested child modules that are referenced in an intermediate and root module. I’m currently stumped as well because I can reproduce this locally where I get a similar error and issues described:

Our workflow looks this like:

root/
├── (references intermediate module)
├── (deploys a slew of other resources)

intermediate/
├── (references child module)
├── (additional resources related to the functionality of the lambda)
└── (calls additional helper child modules for vpc details, etc)

child-module/
├── (near exact same implementation as the tf code above at its core)
└── (where the data resource is defined)

child-module.tf (snippet)
#--- Artifactory --------------------------------------------------------------
data "artifactory_file" "artifact" {
  count = module.this.enabled ? 1 : 0

  repository      = var.artifactory_repository
  path            = var.artifactory_path
  output_path     = "tmp/${basename(var.artifactory_path)}"
  force_overwrite = var.artifactory_force_overwrite
}

#--- Lambda ----------------------------------------------------------------
resource "aws_lambda_function" "default" {
  count = module.this.enabled ? 1 : 0

  function_name = module.this.id
  role          = var.lambda_iam_role_arn
  description   = local.description

  filename         = data.artifactory_file.artifact[0].output_path
  source_code_hash = filebase64sha256(data.artifactory_file.artifact[0].output_path)
#-- Settings -----------------------------------------------------------------
...

}

I can see the zip file is never downloaded locally. What’s interesting is that this only happens on clean runs (the state is clean and no .zip exists already). Whenever we run our tests for the first time from the root module. It isn’t to ever able to evaluate the data resource (artifactory_file) in the child module and download the zip. If the zip already exists, then it’s no problem. The issue is that it’ll never pass in the CICD the first time.

Also to add, because we have a toggle for most of our resources in tf with a count. If I specifically disable the child module to deploy the lambda and its resources for a first run without deploying/calling the child module, then toggle the child module to deploy. The entire TF plan and apply succeed and our tests pass, which feels like a dependency/timing issue. I’ve tried to add depends_on, waits, null triggers on the child module and within the intermediate modules and no luck.

A workaround is if I split up the child module and build the lambda resource in the intermediate module. I can have the artifactory data resource on the root level, and pass the path down to the intermediate which works fine, except we don’t have a reusable lambda child module 😭 …

Open to any thoughts, my next steps are to try using a curl to artifactory to rule out any provider/resource issues to grab the zip file in the child module. I’ve tested the child module by itself and nested and it’s behaving correctly… I still feel like it’s a dependency issue that I could be missing as we get into more nesting and toggles. 😞