title: Terraform for AWS: How to have multiple events per S3 bucket filtered on object path?
body: <p>My understanding is that when configuring an <a href="https://www.terraform.io/docs/providers/aws/r/s3_bucket_notification.html" rel="nofollow noreferrer">S3 bucket notification</a> with Terraform we can only configure a single notification per S3 bucket:</p>
  
  <pre><code>NOTE: S3 Buckets only support a single notification configuration. Declaring multiple
  ws_s3_bucket_notification resources to the same S3 Bucket will cause a perpetual difference in
  configuration. See the example "Trigger multiple Lambda functions" for an option.
  </code></pre>
  
  <p>The application uses a single S3 bucket as a data repository, i.e. when JSON files land there they trigger a lambda which submits a corresponding batch job to ingest from the file into a database.</p>
  
  <p>This works well when we have a single developer deploying the infrastructure, but with multiple developers each time one of us runs <code>terraform apply</code> then it updates the only/single notification for the bucket, overwriting the resource's previous settings.</p>
  
  <p>What is the best practice for utilizing S3 buckets for notifications? Are they best configured/created per Terraform workspace, and/or how are the buckets managed to allow for simultaneous developers standing up/down infrastructure resources using a common S3 bucket via <code>terraform apply</code>, etc.? Must you use one bucket per workspace for this use case, as suggested by the docs?</p>
  
  <p>The current Terraform I have for the S3 notification (the code that allows for overwriting with the latest configuration):</p>
  
  <pre><code>data "aws_s3_bucket" "default" {
    bucket = var.bucket
  }
  
  resource "aws_lambda_permission" "allow_bucket_execution" {
    statement_id  = "AllowExecutionFromS3Bucket"
    action        = "lambda:InvokeFunction"
    function_name = var.lambda_function_name
    principal     = "s3.amazonaws.com"
    source_arn    = data.aws_s3_bucket.default.arn
  }
  
  resource "aws_s3_bucket_notification" "bucket_notification" {
    bucket = data.aws_s3_bucket.default.bucket
  
    lambda_function {
      lambda_function_arn = var.lambda_function_arn
      events              = ["s3:ObjectCreated:*"]
      filter_prefix       = var.namespace
      filter_suffix       = ".json"
    }
  }
  </code></pre>
  
  <p>The <code>namespace</code> variable is passed in as <code>"${local.env}-${terraform.workspace}"</code>, with <code>local.env</code> as "dev", "uat", "prod", etc.</p>
  
  <p>How can we modify the Terraform code above to allow for multiple notifications per S3 bucket (essentially one per Terraform workspace), or can it just not be done? If not then how is this best handled? Should I just use a bucket per workspace using a namespace variable like above as the S3 bucket name, and have it updated accordingly to the production bucket at deployment?</p>