From 2c41b5f1a3068a52b544c99727dcf204b9e92d43 Mon Sep 17 00:00:00 2001
From: aidenvaines-cgi <aiden.vaines@cgi.com>
Date: Mon, 10 Aug 2026 15:31:17 +0100
Subject: [PATCH] CCM-22077 Adding replace SG on delete to Lambda

---
 .../terraform/modules/lambda/README.md          |  2 ++
 .../terraform/modules/lambda/lambda_function.tf |  3 +++
 .../terraform/modules/lambda/variables.tf       | 17 +++++++++++++++++
 3 files changed, 22 insertions(+)

diff --git a/infrastructure/terraform/modules/lambda/README.md b/infrastructure/terraform/modules/lambda/README.md
index 5f30a6d..ebfeeeb 100644
--- a/infrastructure/terraform/modules/lambda/README.md
+++ b/infrastructure/terraform/modules/lambda/README.md
@@ -76,6 +76,8 @@ output "processor_lambda_error_rate_alarm_arn" {
 | <a name="input_permission_statements"></a> [permission\_statements](#input\_permission\_statements) | Statements giving an external source permission to invoke the Lambda function | <pre>list(object({<br/>    action         = optional(string)<br/>    principal      = string<br/>    source_arn     = optional(string)<br/>    source_account = optional(string)<br/>    statement_id   = string<br/>  }))</pre> | `[]` | no |
 | <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
+| <a name="input_replace_security_groups_on_destroy"></a> [replace\_security\_groups\_on\_destroy](#input\_replace\_security\_groups\_on\_destroy) | Whether to swap Lambda security groups before destroy to reduce ENI-related SG deletion delays | `bool` | `false` | no |
+| <a name="input_replacement_security_group_ids"></a> [replacement\_security\_group\_ids](#input\_replacement\_security\_group\_ids) | Security group IDs to use for replacement when replace\_security\_groups\_on\_destroy is enabled | `list(string)` | `[]` | no |
 | <a name="input_reserved_concurrent_executions"></a> [reserved\_concurrent\_executions](#input\_reserved\_concurrent\_executions) | The reserved concurrency for the Lambda function. Set to -1 to remove the concurrency limit, or 0 to prevent the Lambda from being invoked. | `number` | `-1` | no |
 | <a name="input_runtime"></a> [runtime](#input\_runtime) | The runtime to use for the lambda function | `string` | `null` | no |
 | <a name="input_schedule"></a> [schedule](#input\_schedule) | The fully qualified Cloudwatch Events schedule for when to run the lambda function, e.g. rate(1 day) or a cron() expression. Default disables all events resources | `string` | `""` | no |
diff --git a/infrastructure/terraform/modules/lambda/lambda_function.tf b/infrastructure/terraform/modules/lambda/lambda_function.tf
index f00e777..fa7ec9e 100644
--- a/infrastructure/terraform/modules/lambda/lambda_function.tf
+++ b/infrastructure/terraform/modules/lambda/lambda_function.tf
@@ -67,6 +67,9 @@ resource "aws_lambda_function" "main" {
     }
   }
 
+  replace_security_groups_on_destroy = var.replace_security_groups_on_destroy
+  replacement_security_group_ids     = var.replace_security_groups_on_destroy ? var.replacement_security_group_ids : null
+
   tags = merge(
     local.default_tags,
     {
diff --git a/infrastructure/terraform/modules/lambda/variables.tf b/infrastructure/terraform/modules/lambda/variables.tf
index a39fe10..d7af209 100644
--- a/infrastructure/terraform/modules/lambda/variables.tf
+++ b/infrastructure/terraform/modules/lambda/variables.tf
@@ -226,6 +226,23 @@ variable "vpc_config" {
   default     = null
 }
 
+variable "replace_security_groups_on_destroy" {
+  type        = bool
+  description = "Whether to swap Lambda security groups before destroy to reduce ENI-related SG deletion delays"
+  default     = false
+}
+
+variable "replacement_security_group_ids" {
+  type        = list(string)
+  description = "Security group IDs to use for replacement when replace_security_groups_on_destroy is enabled"
+  default     = []
+
+  validation {
+    condition     = !var.replace_security_groups_on_destroy || length(var.replacement_security_group_ids) > 0
+    error_message = "replacement_security_group_ids must be set when replace_security_groups_on_destroy is true."
+  }
+}
+
 variable "enable_dlq_and_notifications" {
   type        = bool
   description = "Create an SQS Queue and on-failure destination to be used as the Lambda's Dead Letter Queue and notifications"