Merge branch 'master' into feat/add-uv-support

Author: antonbabenko

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [8.3.0](https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v8.2.1...v8.3.0) (2026-01-25)
+
+### Features
+
+* Add support for tenant isolation mode feature ([#718](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/718)) ([ab332c1](https://github.com/terraform-aws-modules/terraform-aws-lambda/commit/ab332c1e75f956144bce193966eb2b194d3194a3))
+
+## [8.2.1](https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v8.2.0...v8.2.1) (2026-01-25)
+
+### Bug Fixes
+
+* Avoids issue due to strict requirement for fileexists to return consistent results ([#722](https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/722)) ([d6b4321](https://github.com/terraform-aws-modules/terraform-aws-lambda/commit/d6b4321d9633b0f5b02c6b9162a453816dd559c5))
+
 ## [8.2.0](https://github.com/terraform-aws-modules/terraform-aws-lambda/compare/v8.1.2...v8.2.0) (2026-01-08)
 
 ### Features

README.md

@@ -858,6 +858,7 @@ No modules.
 | <a name="input_source_path"></a> [source\_path](#input\_source\_path) | The absolute path to a local file or directory containing your Lambda source code | `any` | `null` | no |
 | <a name="input_store_on_s3"></a> [store\_on\_s3](#input\_store\_on\_s3) | Whether to store produced artifacts on S3 or locally. | `bool` | `false` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to assign to resources. | `map(string)` | `{}` | no |
+| <a name="input_tenant_isolation_mode"></a> [tenant\_isolation\_mode](#input\_tenant\_isolation\_mode) | Enable tenant isolation mode for the Lambda Function | `bool` | `false` | no |
 | <a name="input_timeout"></a> [timeout](#input\_timeout) | The amount of time your Lambda Function has to run in seconds. | `number` | `3` | no |
 | <a name="input_timeouts"></a> [timeouts](#input\_timeouts) | Define maximum timeout for creating, updating, and deleting Lambda Function resources | `map(string)` | `{}` | no |
 | <a name="input_tracing_mode"></a> [tracing\_mode](#input\_tracing\_mode) | Tracing mode of the Lambda Function. Valid value can be either PassThrough or Active. | `string` | `null` | no |

main.tf

@@ -7,12 +7,10 @@ locals {
 
   archive_filename        = try(data.external.archive_prepare[0].result.filename, null)
   archive_filename_string = local.archive_filename != null ? local.archive_filename : ""
-  archive_was_missing     = try(data.external.archive_prepare[0].result.was_missing, false)
 
   # Use a generated filename to determine when the source code has changed.
   # filename - to get package from local
-  filename    = var.local_existing_package != null ? var.local_existing_package : (var.store_on_s3 ? null : local.archive_filename)
-  was_missing = var.local_existing_package != null ? !fileexists(var.local_existing_package) : local.archive_was_missing
+  filename = var.local_existing_package != null ? var.local_existing_package : (var.store_on_s3 ? null : local.archive_filename)
 
   # s3_* - to get package from S3
   s3_bucket         = var.s3_existing_package != null ? try(var.s3_existing_package.bucket, null) : (var.store_on_s3 ? var.s3_bucket : null)
@@ -55,7 +53,7 @@ resource "aws_lambda_function" "this" {
   }
 
   filename         = local.filename
-  source_code_hash = var.ignore_source_code_hash ? null : (local.filename == null ? false : fileexists(local.filename)) && !local.was_missing ? filebase64sha256(local.filename) : null
+  source_code_hash = var.ignore_source_code_hash ? null : (local.filename == null ? false : fileexists(local.filename)) ? filebase64sha256(local.filename) : null
 
   s3_bucket         = local.s3_bucket
   s3_key            = local.s3_key
@@ -139,6 +137,13 @@ resource "aws_lambda_function" "this" {
     }
   }
 
+  dynamic "tenancy_config" {
+    for_each = var.tenant_isolation_mode ? [true] : []
+    content {
+      tenant_isolation_mode = "PER_TENANT"
+    }
+  }
+
   tags = merge(
     var.tags,
     var.function_tags
@@ -182,7 +187,7 @@ resource "aws_lambda_layer_version" "this" {
   skip_destroy             = var.layer_skip_destroy
 
   filename         = local.filename
-  source_code_hash = var.ignore_source_code_hash ? null : (local.filename == null ? false : fileexists(local.filename)) && !local.was_missing ? filebase64sha256(local.filename) : null
+  source_code_hash = var.ignore_source_code_hash ? null : (local.filename == null ? false : fileexists(local.filename)) ? filebase64sha256(local.filename) : null
 
   s3_bucket         = local.s3_bucket
   s3_key            = local.s3_key

variables.tf

@@ -280,6 +280,12 @@ variable "skip_destroy" {
   default     = null
 }
 
+variable "tenant_isolation_mode" {
+  description = "Enable tenant isolation mode for the Lambda Function"
+  type        = bool
+  default     = false
+}
+
 ###############
 # Function URL
 ###############

wrappers/main.tf

@@ -128,6 +128,7 @@ module "wrapper" {
   source_path                                  = try(each.value.source_path, var.defaults.source_path, null)
   store_on_s3                                  = try(each.value.store_on_s3, var.defaults.store_on_s3, false)
   tags                                         = try(each.value.tags, var.defaults.tags, {})
+  tenant_isolation_mode                        = try(each.value.tenant_isolation_mode, var.defaults.tenant_isolation_mode, false)
   timeout                                      = try(each.value.timeout, var.defaults.timeout, 3)
   timeouts                                     = try(each.value.timeouts, var.defaults.timeouts, {})
   tracing_mode                                 = try(each.value.tracing_mode, var.defaults.tracing_mode, null)